Malinowski v. International Business Machines Corporation

• Court: District Court, S.D. New York
• Decided: March 31, 2025
• Docket: 7:23-cv-08421
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK ELAINE MALINOWSKI, KRISTAL MIZE, USDC SDNY MICHELLE PETTIFORD, VANESSA DOCUMENT HAYS, DANIEL ROBERT BRAWNER, ROWDY JAMES ALDRIGE, JOSEPH BOC RILED TYLER HALEY, MARY LEA KIRBY, MICHAEL WRIGHT, ANTHONY HANNA, DATE FILED: _3/31/2025 _ PATRICK CALHOUN, individually, and on behalf of all others similarly situated, 23-cv-8421 (NSR) Plaintiffs, OPINION & ORDER -against- INTERNATIONAL BUSINESS MACHINES CORPORATION and JOHNSON & JOHNSON HEALTH CARE SYSTEMS, INC., Defendants.

NELSON S. ROMAN, United States District Judge: Plaintiffs Elaine Malinowski (“Malinowski”), Kristal Mize (“Mize”), Michelle Pettiford (‘“Pettiford”), Vanessa Hays (“Hays”), Daniel Robert Brawner (“Brawner”), Rowdy James Aldridge (“Aldridge”), Joseph Tyler Haley (“Haley”), Mary Lea Kirby (“Kirby”), Michael Wright (“Wright”), Anthony Hanna (“Hanna”), and Patrick Calhoun (“Calhoun”) (together, “Plaintiffs’’) against Defendants International Business Machines Corporation (“IBMC”) and John & Johnson Health Care Systems, Inc., (“J&J”) (together, “Defendants”), bringing claims of negligence, negligence per se, breach of implied contract, breach of fiduciary duty, breach of third-party beneficiary contract, unjust enrichment, violations of the Florida Unfair and Deceptive Trade

Practices Act, and violations of the Illinois Consumer Fraud and Deceptive Business Practices Act.1 Presently before the Court is International Business Machines Corporation and John & Johnson Healthcare System, Inc.’s Motion to Dismiss Plaintiffs’ consolidated class action

complaint pursuant to Federal Rules of Civil Procedure 12(b)(6). For the following reasons, Defendants’ Motion is GRANTED. BACKGROUND The following facts are derived from the Consolidated Complaint (“Con. Compl.”) and are taken as true and constructed in the light most favorable to the Plaintiffs at this stage. Johnson & Johnson Health Care Systems, Inc., owns and operates Janssen CarePath (“CarePath”), a patient support program. (Con. Compl. ¶ 2.) J&J encourages its patients to use CarePath as part of their receiving care within J&J. (Id.) International Business Machines Corporation manages the CarePath platform as a service provider to J&J. (Id. ¶ 3.) On August 2, 2023, IBM discovered that CarePath had been breach and that Plaintiffs’ and putative class

members’ confidential information had been accessed by an unauthorized third party. (Id. ¶ 4.) The compromised information consisted of names, contact information, and dates of birth, as well as health insurance information and information about medications and medical conditions. (Id.) The compromised information implicates the named Plaintiffs’ and approximately 631,000 other J&J patients. (Id. ¶ 8.) Plaintiffs assert that after the Data Breach, they experienced store and credit card accounts being opened in their names (Id. ¶¶ 150, 211), credit charges (Id. ¶¶ 211, 223, 247, 258, 271), their personal information being published on the dark web (Id. ¶¶ 163, 235, 247, 271), emails claiming

1 The Court notes that statutory damages are not available under the Florida Unfair and Deceptive Trade Practices Act and under the Illinois Consumer Fraud and Deceptive Business Practices Act. to know information regarding Plaintiffs’ health insurer and their respective medical conditions, (Id. ¶¶ 247, 271), and an increase in spam texts, emails and calls. (Id. ¶¶ 12, 150, 163, 175, 187, 199, 211, 223, 235, 247, 259, 271.) Plaintiffs allege suffering a myriad of injuries as a consequence of the Data Breach, namely

“(i) invasion of privacy; (ii) theft of [their] Personal Information; (iii) lost or diminished value of Personal Information; (iv) lost time and opportunity costs associated with attempting to mitigate the actual consequences of the Data Breach; (v) loss of the benefit of the bargain; (vi) lost opportunity costs associated with attempting to mitigate the actual consequences of the Data Breach; (vii) statutory damages; (viii) damages in the amount of the costs of identity theft protection services for the remainder of their lives; (ix) nominal damages; and (x) the present and continuing risk to [their] Personal Information.” (Id. ¶ 12.) As a result, Plaintiffs bring claims against the Defendants of negligence, negligence per se, breach of implied contract, breach of fiduciary duty, breach of third-party beneficiary contract, unjust enrichment, for violations of the Florida Unfair and Deceptive Trade Practices Act, and for

violations of the Illinois Consumer Fraud and Deceptive Business Practices Act. PROCEDURAL HISTORY On September 22, 2023, Plaintiffs commenced this action against the Defendants in their Complaint. (ECF No. 1.) Thereafter, on January 18, 2024, Plaintiffs filed their Consolidated Complaint against Defendants. (ECF No. 22.) Defendants filed their motion to dismiss Plaintiffs’ Consolidated Complaint and their memorandum of law in support (“Mot.”) (ECF Nos. 50, 52.) Plaintiffs filed their opposition to Defendants’ motion to dismiss (“Opp.”) (ECF No. 53.) Defendants filed their reply in further support of their motion to dismiss (“Reply”) (ECF No. 54.) LEGAL STANDARD A. Rule 12(b)(6) Under Federal Rule of Civil Procedure 12(b)(6), dismissal is proper unless the complaint “contain[s] sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on

its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). When there are well-pled factual allegations in the complaint, “a court should assume their veracity and then determine whether they plausibly give rise to an entitlement to relief.” Id. at 679. While the Court must take all material factual allegations as true and draw reasonable inferences in the non-moving party’s favor, the Court is “not bound to accept as true a legal conclusion couched as a factual allegation,” or to credit “mere conclusory statements” or “[t]hreadbare recitals of the elements of a cause of action.” Id. at 678 (quoting Twombly, 550 U.S. at 555). The Second Circuit “deem[s] a complaint to include any written instrument attached to it as an exhibit or any statements or documents incorporated in it by reference . . . and documents that plaintiffs either possessed or knew about and upon which they relied in bringing the suit.”

Rotham v. Gregor, 220 F.3d 81, 88 (2d Cir. 2000) (internal citations omitted). The critical inquiry is whether the Plaintiff has pled sufficient facts to nudge the claims “across the line from conceivable to plausible.” Twombly, 550 U.S. at 570. A motion to dismiss will be denied where the allegations “allow[] the court to draw the reasonable inference that the Defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. B. Article III Standing “[T]he irreducible constitutional minimum of standing [in federal court] contains three elements”: injury, traceability, and redressability. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L. Ed.2d 351 (1992). “First, the plaintiff must have suffered an ‘injury in fact’— an invasion of a legally protected interest which is (a) concrete and particularized, and (b) actual or imminent, not conjectural or hypothetical.” Id. (internal quotations and citations omitted). “Second, there must be a causal connection between the injury and the conduct complained of— the injury has to be ‘fairly ... trace[able] to the challenged action of the defendant, and not ... th[e]

result [of] the independent action of some third party not before the court.’” Id. at 560–61, 112 S. Ct. 2130 (quoting Simon v. Eastern Ky. Welfare Rights Org., 426 U.S. 26, 41–42, 96 S. Ct. 1917, 48 L. Ed.2d 450, (1976)). “Third, it must be likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision.” Lujan, 504 U.S. at 561, 112 S. Ct. 2130 (internal quotation and citation omitted). DISCUSSION Plaintiffs brings forth a Consolidated Complaint, bringing claims against the Defendants of negligence, negligence per se, breach of implied contract, breach of fiduciary duty, breach of third-party beneficiary contract, unjust enrichment, violations of the Florida Unfair and Deceptive Trade Practices Act, and violations of the Illinois Consumer Fraud and Deceptive Business

Practices Act. The Court finds that Plaintiffs lack standing to prosecute such claims, and therefore confines its discussion to the Article III standing analysis. A. Article III Standing Where a party seeks to prosecute a claim predicated on a data breach, it is necessary, but not sufficient, that the plaintiff articulate a cognizable injury-in-fact. If a party cannot demonstrate that those “injuries are fairly traceable to the actions of [the] Defendants,” then the party lacks Article III standing, and their claim must be dismissed for lack of jurisdiction. Thompson v. Equifax Info. Servs. LLC, No. 20CV6101RPKST, 2022 WL 2467662 (E.D.N.Y. Feb. 24, 2022). Notably, “a claim of injury or traceability that is ‘conclusory or threadbare’ is insufficient for Article III standing.” Id. at *7; see also Erkan v. David A. Hidalgo, M.D., P.C., No. 23-CV-9553, 2025 WL 253298, at *3 (E.D.N.Y. Jan. 21, 2025) (dismissing claims that were “too conclusory and threadbare to ground [p]laintiff’s standing to bring suit.”) Plaintiffs argue that Defendants “confuse[] the burden of proof at the pleading stage,” in

that Defendants’ argument rests on the assertion that “allegations that Plaintiffs’ Personal Information has been published on the dark web and that they received threatening emails claiming to know the identity of their health insurers and medical conditions after the Data Breach cannot be traced to the Data Breach without further detail.” (Opp. p. 17.) Plaintiffs reason that such arguments “go to the merits, not standing” and that, based on the allegations of the Consolidated Complaint, Plaintiffs have proffered sufficient allegations needed to satisfy the Article III standing threshold. (Id.) Of course, at the motion to dismiss stage, “‘it is undoubtedly the duty of district courts not to weigh the credibility of the parties.’” Russo v. DiMilia, 894 F. Supp. 2d 391, 410 (S.D.N.Y. 2012). At the same time, statements “too conclusory and lacking in sufficient factual detail” are

insufficient to survive a motion to dismiss. Lurch v. City of New York, No. 19-CV-11253 (AJN), 2021 WL 1226927, at *3 (S.D.N.Y. Mar. 31, 2021). Plaintiffs “must plausibly allege ‘the asserted injury was the consequence of [the] defendants’ actions.” D.H. v. City of New York, 309 F. Supp. 3d 52, 69 (S.D.N.Y. 2018) (quoting Rothstein v. UBS AG, 708 F.3d 82, 91 (2d Cir. 2013)). “Although the challenged actions need not be the proximate cause of the alleged injury, there must exist some causal nexus between the defendant’s conduct and the injury.” Id. at 69 (quoting Heldman ex rel. T.H. v. Sobol, 962 F.2d 148, 156 (2d Cir. 1992)). Therein lies the issue for Plaintiffs in the instant action, even with the principles that “the material allegations of the complaint must be accepted as true and considered in a light most favorable to the plaintiff.” Conley v. Gibson, 355 U.S. 41, 45-46 (1957). Specifically, the Court finds that as currently written, the Consolidated Complaint fails to proffer sufficient allegations to satisfy Article III’s traceability requirement. The Consolidated Complaint avers injuries purportedly experienced by named Plaintiff’s Malinowski, Mize, Hays, Brawner, Aldridge, Haley, Kirby, Pettiford, Wright, Hanna, and Calhoun.

The injuries are listed as “(i) invasion of privacy; (ii) theft of [their] Personal Information; (iii) lost or diminished value of Personal Information; (iv) lost time and opportunity costs associated with attempting to mitigate the actual consequences of the Data Breach; (v) loss of the benefit of the bargain; (vi) lost opportunity costs associated with attempting to mitigate the actual consequences of the Data Breach; (vii) statutory damages; (viii) damages in the amount of the costs of identity theft protection services for the remainder of their lives; (ix) nominal damages; and (x) the present and continuing risk to [their] Personal Information.” (Con. Compl. ¶ 270.) At best, the Consolidated Complaint’s allegations make it possible that the action occurring following the Data Breach was caused by the Data Breach. However, more than mere possibility is required here to satisfy Article III’s traceability requirement; Plaintiffs’ injuries must be

“plausibly” traceable to Defendants’ actions. D.H., 309 F. Supp. 3d 52 at 69. To demonstrate traceability, named Plaintiffs offer a series of examples of adverse action they experienced following the Data Breach, namely: unauthorized store and credit card accounts being opened in their names (Con. Compl. ¶¶ 150, 211), fraudulent credit charges (Id. ¶¶ 211, 223, 247, 258, 271), their personal information being published on the dark web (Id. ¶¶ 163, 235, 247, 271), emails claiming to know information regarding Plaintiffs’ health insurer and their respective medical conditions, (Id. ¶¶ 247, 271), and, finally, an increase in spam texts, emails and/or calls (Id. ¶¶ 12, 150, 163, 175, 187, 199, 211, 223, 235, 247, 259, 271) (together, “adverse actions”). Where Plaintiffs fatally fall short is that their allegations do not demonstrate that they “would [not have] suffer[ed] the same injury regardless” of the Data Breach. In re Chrysler LLC, 405 B.R. 79, 83 (Bankr. S.D.N.Y. 2009). While Plaintiffs “attribute” the aforementioned adverse actions to the Defendants (Con. Compl. ¶¶ 150, 163, 175, 187, 199, 211, 223, 235, 247, 259, 271),

without further factual allegations as to why such attribution is justified, it is “entirely speculative whether [the Data Breach] le[d]” to said consequences. Allen v. Wright, 468 U.S. 737, 738 (1984). Plaintiffs’ mere assertion that the injuries suffered are attributable to the Defendants – i.e., are traceable to the Defendants – serves as a “legal conclusion couched as a factual allegation,” which the Court is not bound to accept as true. Twombly, 550 U.S. at 555. Likewise, “mere conclusory statements” are not owed credence from the Court in conducting its Article III standing analysis. Id. While the traceability analysis does not entail a burden of the kind to prove proximate cause, a party must nonetheless allege a causal connection between the injury and the Defendants’ conduct. Lerner v. Fleet Bank, N.A., 318 F.3d 113, at n. 8 (2d Cir. 2003). Here, Plaintiffs can only

offer a correlation – that is, after the Data Breach Plaintiffs experienced the adverse actions. Courts in this Circuit have repeatedly stressed that when discerning whether a causal connection exists, correlation is not tantamount to causation, and, without more than mere correlation, a causal relationship cannot be established. Sergeants Benevolent Ass'n Health & Welfare Fund v. Sanofi- Aventis U.S. LLP, 806 F.3d 71, 92 (2d Cir. 2015). Moreover, Defendants correctly note that “the alleged injuries must be tied to the information exposed in a data breach.” (Mot. p. 13.) Plaintiffs fail here as well, for instance, stating in one breath that unauthorized store and credit accounts were opened in their names, and, in the next breath, failing to plead that the information necessary to open such accounts was contained within the CarePath database and was part of the data exposed within the Data Breach. (Mot. p. 14); see also (Con. Compl. ¶¶ 150, 211, 223, 247, 258, 271.) Accordingly, not only have Plaintiffs only offered the Court mere correlation, but they have also failed to demonstrate that the decried adverse actions could be reasonably construed as resulting from the Data Breach. Thus, the Court

must find that Plaintiffs, based on the current allegations of the Consolidated Complaint, do not have Article III standing. It appears that the Plaintiffs can likely satisfy the traceability requirement of Article III standing if they only offer further factual averments that articulate a causal connection between the purported injuries and the Defendants’ conduct, but based on the Consolidated Complaint as currently written, the Court must dismiss Count 1, Count 2, Count 3, Count 4, Count 5, Count 6, Count 7, and Count 8 without prejudice. CONCLUSION For the foregoing reasons, the Court GRANTS Defendants International Business Machines Corporation and Johnson & Johnson Health Care Systems, Inc.’s motion to dismiss Plaintiffs’ claims of negligence, negligence per se, breach of implied contract, breach of fiduciary

duty, breach of third-party beneficiary contract, unjust enrichment, for violations of the Florida Unfair and Deceptive Trade Practices Act, and for violations of the Illinois Consumer Fraud and Deceptive Business Practices Act, all without prejudice. Plaintiffs are granted leave to file an Amended Complaint by May 15, 2025. Plaintiff is advised that the Amended Complaint will replace, not supplement, the Complaint, and so any claims that they wish to pursue must be included in, or attached to, the Amended Complaint. Should Plaintiffs file an Amended Complaint, the Defendants are directed to answer or otherwise respond by June 16, 2025, and the parties are directed to complete and file a Case Management Plan and Scheduling Order (blank form attached) by July 7, 2025. If Plaintiffs fail to file an Amended Complaint within the time allowed, those claims that were dismissed without prejudice shall be deemed dismissed with prejudice. The Clerk of Court is respectfully directed to terminate the motion at ECF No. 50. Dated: March 31, 2025 SO ORDERED: White Plains, New York

________________________________ NELSON S. ROMÁN United States District Judge UNITED STATES DISTRICT COURT Rev. Jan. 2012 SOUTHERN DISTRICT OF NEW YORK -------------------------------------------------------------x

CIVIL CASE DISCOVERY PLAN Plaintiff(s), AND SCHEDULING ORDER - against -

Defendant(s). CV (NSR) -------------------------------------------------------------x

This Civil Case Discovery Plan and Scheduling Order is adopted, after consultation with counsel, pursuant to Fed. R. Civ. P. 16 and 26(f):

1. All parties [consent] [do not consent] to conducting all further proceedings before a Magistrate Judge, including motions and trial, pursuant to 28 U.S.C. § 636(c). The parties are free to withhold consent without adverse substantive consequences. (If all parties consent, the remaining paragraphs of this form need not be completed.) 2. This case [is] [is not] to be tried to a jury. 3. Joinder of additional parties must be accomplished by _______________________.

4. Amended pleadings may be filed until _____________________. 5. Interrogatories shall be served no later than ___________________, and responses thereto shall be served within thirty (30) days thereafter. The provisions of Local Civil Rule 33.3 [shall] [shall not] apply to this case. 6. First request for production of documents, if any, shall be served no later than ____________________. 7. Non-expert depositions shall be completed by ____________________________.

a. Unless counsel agree otherwise or the Court so orders, depositions shall not be held until all parties have responded to any first requests for production of documents. b. Depositions shall proceed concurrently.

c. Whenever possible, unless counsel agree otherwise or the Court so orders, non- party depositions shall follow party depositions. 8. Any further interrogatories, including expert interrogatories, shall be served no later than _______________________. 9. Requests to Admit, if any, shall be served no later than ______________________.

10. Expert reports shall be served no later than ______________________.

11. Rebuttal expert reports shall be served no later than ______________________.

12. Expert depositions shall be completed by ______________________.

13. Additional provisions agreed upon by counsel are attached hereto and made a part hereof. 14. ALL DISCOVERY SHALL BE COMPLETED BY ______________________. 15. Any motions shall be filed in accordance with the Court’s Individual Practices.

16. This Civil Case Discovery Plan and Scheduling Order may not be changed without leave of Court (or the assigned Magistrate Judge acting under a specific order of reference). 17. The Magistrate Judge assigned to this case is the Hon. .

18. If, after entry of this Order, the parties consent to trial before a Magistrate Judge, the Magistrate Judge will schedule a date certain for trial and will, if necessary, amend this Order consistent therewith. 19. The next case management conference is scheduled for _____________________, at ____________. (The Court will set this date at the initial conference.)

SO ORDERED.

Dated: White Plains, New York _______________________

Nelson S. Román, U.S. District Judge