Koziol v. Tri State Fed Credit Union

• Court: Vermont Superior Court
• Decided: March 27, 2025
• Docket: 24-cv-3972
• Status: Published

Opinion

VERMONT SUPERIOR COURT CIVIL DIVISION Bennington Unit Case No. 24-CV-03972 207 South St Bennington VT 05201 802-447-2700 www.vermontjudiciary.org

Nancy Koziol v. Tri State Area Federal Credit Union

ENTRY REGARDING MOTION Title: Motion to Dismiss (Motion: 1) Filer: John Daniel Prendergast Filed Date: January 10, 2025

This case involves a class action dispute between Plaintiffs and Defendant Tri State Area Federal Credit Union (Tri State) arising after Tri State was subject to a data breach that resulted in a leak of Plaintiffs’ personal information. Tri State filed a Motion to Dismiss on January 10, 2025, arguing that the claims should be dismissed because the Plaintiffs lack standing. On January 24, 2025, Plaintiffs filed a Response in Opposition to Defendant’s Motion to Dismiss. Tri State filed a Reply Memorandum in Support of Defendant’s Motion to Dismiss on February 7, 2025. This Court held a hearing on this matter on March 21, 2025.

The ruling on the motion, for the reasons herein, is:

1. Defendant’s Motion to Dismiss is denied. Facts

The following facts are accepted as true. On May 9 and 10, 2024, Tri State experienced a criminal cyberattack. This breach compromised the Personal Identifying Information (PII) of current and former customers. The compromised PII includes Social Security numbers, dates of birth, and bank or financial account numbers. As a result of the breach, Tri State notified its former and current customers of the attack and that their PII may have been impacted from the cyberattack. Plaintiffs describe their harms resulting from the breach, including having to make reasonable efforts to mitigate the impact of the breach, spending time responding to the dangers from the breach, and the knowledge that the PII could be abused in the future by cybercriminals.

Discussion

I. The Motion to Dismiss is denied because Plaintiffs have alleged actionable harm under the McMorris factors. Tri State moves to dismiss all counts by Plaintiffs for lack of standing. Specifically, Tri State insists that time spent mitigating a data breach and the risk of potential future harm Entry Regarding Motion Page 1 of 5 24-CV-03972 Nancy Koziol v. Tri State Area Federal Credit Union provides no concrete harm to Plaintiffs from the data breach. Plaintiffs maintain that they do have standing based on these facts, and that they have suffered concrete harm that gives them standing to sue Tri State. Since the parties have framed the issue as a standing issue, the Court will analyze whether Plaintiffs have sufficiently alleged a particular injury in fact.1

Under Vermont law, a motion to dismiss should be granted where it is “beyond doubt that there exist no facts or circumstances that would entitle the plaintiff to relief.” Kaplan v. Morgan Stanley & Co., 2009 VT 78, ¶ 7, 186 Vt. 605. In deciding a motion to dismiss, courts assume the truth of factual allegations asserted in the complaint, as well as any reasonable inferences that may follow, and focus their inquiry “on the absence of any facts, reasonable factual inferences, and legal bases for recovery alleged in the complaint, attachments thereto, or to matters the court may judicially notice.” Sprague v. Nally, 2005 VT 85, ¶ 2, 178 Vt. 222 (quoting Gilman v. Maine Mutual Fire Ins. Co., 2003 VT 55, ¶ 20, 175 Vt. 554 (mem.) (internal quotations omitted)). The “purpose of a motion to dismiss is to test the law of the claim, not the facts which support it.” Powers v. Office of Child Support, 173 Vt. 390, 395 (2002) (citing Levinsky v. Diamond, 140 Vt. 595, 600 (1982)). Motions under Rule 12(b)(6) are not favored and rarely granted. Endres v. Endres, 2006 VT 108, ¶ 4, 180 Vt. 640.

Standing is a constitutional doctrine, grounded in the Article III limitation of federal- court jurisdiction to actual cases and controversies. See U.S. Const. art. III, § 2, cl. 1. While the Vermont Constitution lacks equivalent language, the Vermont Supreme Court has adopted federal standing requirements, stating that “[t]he judicial power, as conferred by the Constitution of this State upon this Court, is the same as that given to the Federal Supreme Court by the United States Constitution; that is, the right to determine actual controversies arising between adverse litigants, duly instituted in courts of proper jurisdiction.” In re Constitutionality of House Bill 88, 115 Vt. 524, 529 (1949) (quotations omitted); see also Hous. Our Seniors in Vermont Inc. v. Agency of Com. & Cmty. Dev., 2024 VT 12, ¶ 12.

To establish standing, plaintiffs must “at an irreducible minimum demonstrate the following constitutional elements: (1) injury in fact, (2) causation, and (3) redressability.” Hinesburg Sand & Gravel Co. v. State, 166 Vt. 337, 341 (1997). Plaintiffs must allege sufficient facts to establish standing “[o]n the face of the complaint.” Town of Cavendish v. Vt. Pub. Power Supply Auth., 141 Vt. 144, 147–48 (1982). Here, Tri State asserts that there is no injury in fact present.

To satisfy this initial burden, a plaintiff must demonstrate that there is “an actual controversy between the parties.” Id. “Otherwise, the judgment would be no more than an advisory opinion, which we lack the constitutional power to render.” Parker v. Town of Milton,

1 This Court doubts that “standing” is the correct legal framework for determining whether a plaintiff has a valid action against a credit union for damages resulting from a data breach. Vermont cases have repeatedly emphasized that the “standing” doctrine serves the purpose of enforcing “the separation of powers between the three different branches of government by confining the judiciary to the adjudication of actual disputes and preventing the judiciary from presiding over broad-based policy questions that are properly resolved in the legislative arena.” Parker v. Town of Milton, 169 Vt. 74, 76–77 (1998); accord Housing Our Seniors in Vermont Inc. v. Agency of Commerce & Community Development, 2024 VT 12, ¶ 21; Paige v. State, 2018 VT 136, ¶ 8, 209 Vt. 379; Turner v. Shumlin, 2017 VT 2, ¶ 10, 204 Vt. 78. Entry Regarding Motion Page 2 of 5 24-CV-03972 Nancy Koziol v. Tri State Area Federal Credit Union 169 Vt. 74, 77 (1998). The existence of an actual controversy “turns on whether the plaintiff is suffering the threat of actual injury to a protected legal interest, or is merely speculating about the impact of some generalized grievance.” Town of Cavendish, 141 Vt. at 147.

There is no Vermont caselaw directly on point on standing for future harm of class action plaintiffs resulting from a data breach. That said, the Vermont Supreme Court has adopted the federal three-part test for standing and has frequently cited federal standing precedents when deciding Vermont cases involving adequate and independent state law grounds. See Ferry v. City of Montpelier, 2023 VT 4, ¶ 14, 217 Vt. 450. While not obliged to follow federal standing rules, this Court can look to analogous federal caselaw as persuasive authority. Id. ¶ 15–17. Tri State relies on analogous federal caselaw in its Motion. So, while not bound by the Second Circuit, this Court will look at the analogous federal caselaw since the parties have framed the issue and their arguments on federal caselaw.

The Second Circuit has held that “plaintiffs may establish standing based on an increased risk of identity theft or fraud following the unauthorized disclosure of their data,” even where no such misuse of the data has yet occurred. McMorris v. Carlos Lopez & Assocs., LLC, 995 F.3d 295, 300–01 (2d Cir. 2021) (“[R]equiring plaintiffs to allege that they have already suffered identity theft or fraud as the result of a data breach would seem to run afoul of the Supreme Court's recognition that ‘[a]n allegation of future injury may suffice’ to establish Article III standing ‘if the threatened injury is certainly impending, or there is a substantial risk that the harm will occur.’ ”) (quoting Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158 (2014)); see Bohnak v. Marsh & McLennan Cos., Inc., 79 F.4th 276, 289 (2d Cir. 2023)). The Second Circuit has set forth a non-exclusive set of three factors for courts to consider in determining whether “an increased risk of identity theft or fraud” qualifies as an injury in fact in each case:

(1) whether the plaintiffs’ data has been exposed as the result of a targeted attempt to obtain that data;

(2) whether any portion of the dataset has already been misused, even if the plaintiffs themselves have not yet experienced identity theft or fraud; and

(3) whether the type of data that has been exposed is sensitive such that there is a high risk of identity theft or fraud.

McMorris, 995 F.3d at 303.

The first factor supports a finding of standing because Plaintiffs have alleged that the breach was the result of a targeted cyberattack conducted by cybercriminals. This Court finds that this data breach qualifies as a “targeted attempt to obtain the data” and satisfies the first McMorris factor.

The second factor does not support a finding of standing. Plaintiffs have not alleged in their Complaint that any portion of the leaked PII has been misused yet. Rather, they aver that

Entry Regarding Motion Page 3 of 5 24-CV-03972 Nancy Koziol v. Tri State Area Federal Credit Union future harm from the breach is inevitable. Thus, the second factor favors dismissal for a lack of standing.

The third factor weighs in Plaintiffs’ favor. The leaked PII includes Social Security numbers, financial account numbers, and the names of Plaintiffs. The Second Circuit has acknowledged that Social Security numbers are “high-risk” and sensitive information making victims more vulnerable to “future identity theft or fraud.” McMorris, 995 F.3d at 302; see Bohnak, 79 F.4th at 289 (noting that Social Security numbers are “exactly the kind of information that gives rise to a high risk of identity theft ... [and] among the worst kind of personal information to have stolen because they may be put to a variety of fraudulent uses and are difficult for an individual to change”). Moreover, the Complaint includes allegations of financial account numbers being leaked, which can also be used by cybercriminals to carry out identity theft or fraud. This factor favors Plaintiffs.

While Plaintiffs have not shown that the second factor supports standing, the Second Circuit has held that doing so is not necessary if the other factors are met. Specifically, in Bohnak, the Second Circuit held that a data breach victim had standing even where “she ha[d] not alleged any known misuse of information in the dataset accessed in the hack.” Bohnak, 79 F.4th at 289. The Bohnak court found that the plaintiff had plausibly alleged standing where the first and third factors were otherwise satisfied, as is the case here. Id. at 288–89. Accordingly, Plaintiffs have alleged a sufficiently substantial risk of future identity theft and fraud to confer standing at the motion to dismiss stage.

II. TransUnion does not bar Plaintiffs’ claims for lacking standing because Plaintiffs have alleged more than the risk of future harm.

Tri State points to the 2021 United States Supreme Court decision in TransUnion to contend that Plaintiffs have not alleged standing. In that case, the Court found that the risk of future harm is insufficient, by itself, to confer standing. See TransUnion LLC v. Ramirez, 594 U.S. 413, 435 (2021). Plaintiffs’ claim is distinguishable from that decision. Here, Plaintiffs, in addition to potential future harm, have alleged harm from time spent monitoring accounts and attempting to mitigate the effects of the data breach.

Indeed, TransUnion recognized that concrete harm may be intangible, particularly where it bears a close relationship to harms traditionally recognized as providing a basis for lawsuits. Those include disclosure of private information and intrusion upon seclusion. Id. at 425. The Second Circuit observed in Bohnak that, “[s]ignificantly, the [TransUnion] Court concluded that the publication of false information ... was itself enough to establish a concrete injury; it did not take further steps to evaluate whether those third parties used the information in ways that harmed the class members.” Bohnak, 79 F.4th at 284–85.

Bohnak applied TransUnion in a class action alleging release of the representative plaintiff’s name and Social Security number to an unauthorized third party. Id. at 281. The Court found that, as in TransUnion, “the core injury here – exposure of Bohnak's private PII to unauthorized third parties – bears some relationship to a well-established common-law analog: public disclosure of private facts.” Id. at 285. The Court further concluded that such core injury Entry Regarding Motion Page 4 of 5 24-CV-03972 Nancy Koziol v. Tri State Area Federal Credit Union “falls squarely within the scope of an intangible harm the Supreme Court has recognized [in TransUnion] as concrete.” Id. at 286.

Following on TransUnion’s discussion of separate, concrete harms, Bohnak next found that the plaintiff had suffered such harms “as a result of the risk of future harm occasioned by the exposure of her PII.” Id. Bohnak specifically cited the plaintiff's allegations of “ ‘out-of-pocket expenses associated with the prevention, detection, and recovery from identify theft,’ and ‘lost time’ and other ‘opportunity costs’ associated with attempting to mitigate the consequences of the data breach.” Id. The Court held that “[t]hese separate and concrete harms foreseeably arising from the exposure of Bohnak’s PII to a malign outside actor, giving rise to a material risk of future harm, independently support standing.” Id.

Here, similarly, Plaintiffs’ PII was exposed to third parties after a cyberattack. The PII is now in the hands of cybercriminals and poses a threat of imminent danger and subjects the Plaintiffs to increased risk of identity theft. Further, Plaintiffs have asserted that they have lost time and have had to take steps to mitigate the impact of the PII leakage. This is a real, and not merely theoretical, controversy that does not involve idle speculation about the impact of a generalized grievance. See Turner v. Shumlin, 2017 VT 2, ¶ 11, 204 Vt. 78 (noting that, to show standing, a plaintiff must “present a real—not merely theoretical—controversy involving the threat of actual injury to a protected legal interest rather than merely speculating about the impact of some generalized grievance”).

This Court concludes that Plaintiffs have sufficiently pled standing in their Complaint. Accordingly, the Motion to Dismiss is denied.

ORDER

Tri State’s Motion to Dismiss is denied because it has not shown that Plaintiffs lack standing at the motion to dismiss stage.

The motion is DENIED. Signed electronically March 25, 2025 pursuant to V.R.E.F 9(d).

_________________________________________ David Barra Superior Court Judge

Entry Regarding Motion Page 5 of 5 24-CV-03972 Nancy Koziol v. Tri State Area Federal Credit Union