Kevin McLinden v. Tangoe US, Inc.

• Court: Indiana Court of Appeals
• Decided: June 5, 2025
• Docket: 24A-PL-01617
• Status: Published

Opinion

FILED Jun 05 2025, 8:53 am

CLERK Indiana Supreme Court Court of Appeals and Tax Court

IN THE

Court of Appeals of Indiana Kevin McLinden, Appellant-Plaintiff,

v.

Tangoe U.S., Inc., Appellee-Defendant.

June 5, 2025

Court of Appeals Case No. 24A-PL-1617

Appeal from the Marion Superior Court

The Honorable Kurt Eisgruber, Judge

Trial Court Cause No. 49D06-2312-PL-48384

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 1 of 9 Opinion by Senior Judge Crone Judges Brown and Felix concur.

Crone, Senior Judge.

[1] Kevin McLinden seeks reinstatement of his lawsuit against his former

employer, Tangoe U.S., Inc., for damages resulting from a data breach. He

contends the trial court erred by dismissing his complaint for lack of standing.

Concluding that McLinden has demonstrated harm sufficient to confer standing

at the pleading stage, we reverse and remand for further proceedings.

Facts and Procedural History [2] Unless otherwise noted, the following facts are taken from McLinden’s

complaint and are assumed true for purposes of this appeal. See infra Hoosier

Contractors, LLC v. Gardner, 212 N.E.3d 1234, 1239 (Ind. 2023). Tangoe is an IT

services and consulting company that is headquartered in Indiana and employs

thousands of individuals around the globe. Appellant’s App. Vol. II, pp. 13, 14

(Complaint). As a condition of employment, Tangoe requires individuals to

provide private information, including their social security numbers. Id. at 14.

[3] Between November 15 and 17, 2022, Tangoe’s information system was

accessed by an unknown third party without authorization. Id. at 34 (Ex. A to

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 2 of 9 1 Complaint). The third party obtained the personally identifiable information

(“PII”) of numerous current and former Tangoe employees, including

McLinden. Data involved in the breach included names, dates of birth, social

security numbers, medical information, health insurance information,

medication information, medical billing/claims information, and financial

account information. Id.

[4] Upon discovering the breach, Tangoe took steps to secure its system and

launched an investigation to determine the nature and scope of the incident. Id.

Tangoe did not immediately alert affected individuals of the data breach;

instead, it delayed notification to McLinden and others until one year later. Id.

at 34 (Ex. A to Complaint), 38 (Ex. B to Complaint). The notice stated that

Tangoe was not aware of any misuse of personal information as a result of the

breach, provided the toll free phone number for the dedicated call center for

questions and concerns, encouraged recipients to review their account

1 We recognize this is a developing area of law as nearly 4,000 new cyberattacks occur every day, and every 14 seconds, a company falls victim to a ransomware attack. https://www.getastra.com/blog/security- audit/how-many-cyber-attacks-per-day/#The_State_of_Cyberattacks_today [https://perma.cc/24QJ-UN98] (last visited May 29, 2025). In 2023, there were 6.06 billion malware attacks globally. https://www.varonis.com/blog/data-breach-statistics#breaches-by-the-numbers [https://perma.cc/9B6K- 7X4F] (last visited May 29, 2025). Indeed, as two of our judges have pointed out, the technological advancements that have digitized our lives and, in many ways made tasks quicker and easier to accomplish, are not without their drawbacks. Judge Crone highlighted the increase in speed and ease with which sensitive, personal information can now be accessed and “broadcast to the public.” Robbins v. Trs. of Ind. Univ., 45 N.E.3d 1, 13 (Ind. Ct. App. 2015) (Crone, J., concurring in part and concurring in result in part). More recently, Judge Bailey similarly observed that “with the ubiquity of digital data, it is easier than ever for unwanted third parties to obtain—and share—sensitive information.” F.B.C. v. MDwise, Inc., 122 N.E.3d 834, 839 (Ind. Ct. App. 2019) (Bailey, J., dissenting), trans. denied, abrogated by Cmty. Health Network, Inc. v. McKenzie, 185 N.E.3d 368 (Ind. 2022).

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 3 of 9 statements and monitor their credit reports for suspicious activity, and offered

to provide, at its expense, two years of credit monitoring and identity theft

restoration services. Id. at 34 (Ex. A to Complaint), 38-39 (Ex. B to

Complaint).

[5] McLinden brought this putative class action, alleging negligence, negligence per

se, breach of implied contract, unjust enrichment, and breach of bailment.

Tangoe moved to dismiss the action for lack of standing under Trial Rule

12(B)(6). The court granted Tangoe’s motion, and McLinden moved the court

to reconsider that decision. The court denied McLinden’s motion, and he now

appeals.

Discussion and Decision [6] There are several standards of review at work here. First, the order being

appealed is the trial court’s denial of McLinden’s motion to reconsider the

dismissal of his lawsuit for lack of standing. However, McLinden’s motion to

reconsider is actually a motion to correct error. A motion to correct error asks

the trial court to revisit its final judgment, while a motion to reconsider must be

posed and ruled upon prior to the entry of final judgment. Barclays Inv. Funding

LLC v. Jamalee Invs., LLC, 186 N.E.3d 659, 661 (Ind. Ct. App. 2022) (quoting

Hubbard v. Hubbard, 690 N.E.2d 1219, 1221 (Ind. Ct. App. 1998)). Accordingly,

because the trial court’s dismissal of this action is a final judgment, McLinden’s

motion requesting the court to revisit that decision is a motion to correct error,

which we review for an abuse of discretion. Derr Enters., LLC v. Union City Ind.

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 4 of 9 Props., LLC, 253 N.E.3d 1129, 1133 (Ind. Ct. App. 2025). Such occurs when

the decision is against the logic and effect of the facts and circumstances before

the court or is contrary to law. Id.

[7] Motions to dismiss for lack of standing may be brought under Rule 12(B)(6) for

failure to state a claim upon which relief can be granted. Hoosier Contractors, 212

N.E.3d at 1239 (quoting Thomas v. Blackford Cnty. Area Bd. of Zoning Appeals, 907

N.E.2d 988, 990 (Ind. 2009)). When evaluating such a motion on appeal, we

take the alleged facts as true, consider them in the light most favorable to the

non-movant, and draw every reasonable inference in favor of the non-movant.

Hoosier Contractors, 212 N.E.3d at 1239.

[8] “The threshold issue of standing determines whether a litigant is entitled to

have a court decide the substantive issues of a dispute.” Solarize Ind., Inc. v. S.

Ind. Gas & Elec. Co., 182 N.E.3d 212, 216 (Ind. 2022). Indiana law is clear that

standing requires a party to demonstrate that it has suffered or is in immediate

danger of suffering a direct injury as a result of the conduct at issue. Hoosier

Contractors, 212 N.E.3d at 1238 (quoting Solarize, 182 N.E.3d at 217). Where,

as here, an action is at the pleading stage, “a claimant’s general factual

allegations of injury arising from the defendant’s conduct may suffice to satisfy

standing.” Hoosier Contractors, 212 N.E.3d at 1239. “Whether a party has

standing is a legal question we review de novo.” Id. at 1238.

[9] McLinden argues that the court erred in concluding that the time and money he

allegedly spent avoiding identity theft is not an injury sufficient to confer

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 5 of 9 2 standing. In his complaint, McLinden alleged that he has “suffered and will

continue to suffer damages, including monetary losses, lost time, anxiety, and

emotional distress.” Appellant’s App. Vol. II, p. 17 (Class Action Complaint, ¶

49). He additionally claimed that he has “suffered or [is] at an increased risk of

suffering”:

a. The loss of the opportunity to control how [his] PII is used;

b. The diminution in value of [his] PII;

c. The compromise and continuing publication of [his] PII;

d. Out-of-pocket costs associated with the prevention, detection, recovery, and remediation from identity theft or fraud;

e. Lost opportunity costs and lost wages associated with the time and effort expended addressing and attempting to mitigate the actual and future consequences of the Data Breach, including, but not limited to, efforts spent researching how to prevent, detect, contest, and recover from identity theft and fraud;

f. Delay in receipt of tax refund monies;

2 To support his argument, McLinden offers up, both in his brief and in his filing of additional authority, cases that apply federal principles of standing. While these cases may be instructive to our decision, they are not binding upon us. See Schulz v. State, 731 N.E.2d 1041, 1044 (Ind. Ct. App. 2000) (recognizing that federal limits on justiciability have no direct applicability to cases brought under state law because state constitution does not contain case or controversy requirement but acknowledging that federal limits are nonetheless instructive because standing requirement under both constitutions fulfills purpose of ensuring litigant is entitled to have court decide merits of dispute) (quotations and citations omitted), trans. denied.

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 6 of 9 g. Unauthorized use of stolen PII; and

h. The continued risk to [his] PII, which remains in the possession of defendant and is subject to further breaches so long as defendant fails to undertake the appropriate measures to protect the PII in their possession.

Id. at 17-18.

[10] It is clear in Indiana that an economic loss satisfies the actual injury

requirement for standing purposes. See, e.g., Mercer Belanger Pro. Corp. v. Gaeta,

241 N.E.3d 1159, 1172 (Ind. Ct. App. 2024) (concluding plaintiff had met

standing requirements where he alleged injury in the form of monetary

damages, specifically the payment of attorney’s fees to defend himself against

debt collector’s illegal mortgage foreclosure efforts), trans. denied. Accepting the

alleged facts as true and drawing all reasonable inferences in favor of McLinden

as we are bound to do, we conclude his allegations of monetary loss are

sufficient to satisfy the requirement of an injury in order to establish standing.

[11] We note that McLinden alternatively argued that the mere disclosure of his

private information is itself an injury sufficient to establish standing.

Specifically, he claims that the disclosure of his PII, though an intangible harm,

constitutes a concrete injury; ergo, he has standing. He bases his argument on a

misreading of TransUnion LLC v. Ramirez, 594 U.S. 413 (2021). There, the

United States Supreme Court held that certain intangible harms that bear “a

close relationship to harms traditionally recognized as providing a basis for

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 7 of 9 3 lawsuits in American courts[,]” such as disclosure of private information, can

constitute concrete injuries for standing purposes. Id. at 425.

[12] However, the allegation of a recognized cause of action does not automatically

equate to the existence of standing; they are two wholly distinct concepts.

Accordingly, even if McLinden alleges a cause of action under our state’s

newly-recognized tort of disclosure, he must still satisfy the standing

requirements of direct injury or the immediate danger thereof.

Conclusion [13] Based on the foregoing, we conclude that McLinden met our state requirements

for standing at the pleading stage in that his allegations of monetary damages

constitute an injury.

[14] Reversed and remanded.

Brown, J., and Felix, J., concur.

3 Indiana has only recently recognized an invasion of privacy tort claim based on the public disclosure of private facts. In 2022, our Supreme Court explicitly recognized such a claim and explicitly adopted the disclosure tort as it is articulated in the Restatement (Second) of Torts § 652D. See Cmty. Health Network, Inc., 185 N.E.3d at 382. The court stated the four elements of the disclosure tort as:

(1) the information disclosed must be private in nature; (2) the disclosure must be made to the public; (3) the disclosure must be one that would be highly offensive to a reasonable person; and (4) the information disclosed is not of legitimate public concern. Id.

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 8 of 9 ATTORNEYS FOR APPELLANT Lynn A. Toops Amina A. Thomas Arend J. Abel Cohen and Malad Indianapolis, Indiana

ATTORNEY FOR APPELLEE Kimberly Castellino Metzger McCarter & English, LLP Carmel, Indiana

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 9 of 9