MANTAGAS v. SHI INTERNATIONAL CORP.

CourtDistrict Court, D. New Jersey
DecidedAugust 31, 2023
Docket3:22-cv-06739
StatusUnknown

This text of MANTAGAS v. SHI INTERNATIONAL CORP. (MANTAGAS v. SHI INTERNATIONAL CORP.) is published on Counsel Stack Legal Research, covering District Court, D. New Jersey primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
MANTAGAS v. SHI INTERNATIONAL CORP., (D.N.J. 2023).

Opinion

NOT FOR PUBLICATION

UNITED STATES DISTRICT COURT DISTRICT OF NEW JERSEY

MICHAEL MANTAGAS, et al.,

Plaintiffs, Civil Action No. 22-6739 (ZNQ) (TJB)

v. OPINION

SHI INTERNATIONAL CORP.,

Defendant.

QURAISHI, District Judge THIS MATTER comes before the Court upon a Motion to Dismiss filed by Defendant SHI International Corp. (“Defendant”). (“Motion”, ECF No. 17.) Defendant filed a brief in support of its Motion. (“Moving Br.”, ECF No. 17-1.) Plaintiffs Michael Mantagas and Michael Robina, on behalf of themselves and all others similarly situated, filed an Opposition to Defendant’s Motion (“Opp’n”, ECF No. 18) to which Defendant replied (“Reply”, ECF No. 19.) The Court will also address Defendant’s request to Compel Arbitration incorporated into its Motion to Dismiss. The Court has carefully considered the parties’ submissions and decides the Motion without oral argument pursuant to Federal Rule of Civil Procedure 78 and Local Civil Rule 78.1. For the reasons set forth below, the Court will GRANT-IN-PART and DENY-IN-PART Defendant’s Motion to Dismiss. I. BACKGROUND AND PROCEDURAL HISTORY Defendant removed this action from the Superior Court of New Jersey, Law Division, Somerset County. (ECF No. 1.) On August 24, 2022, Plaintiffs filed their Complaint on behalf of a putative class in connection with a data breach suffered by Defendant for “at least 11,000 persons

whose data was compromised in [the] Data Breach.” (“Compl.”, ECF No. 1-1.) Defendant is an international provider of information technology services, which held in its possession certain personally identifiable information (“PII”) and private health information (“PHI”) (collectively, “Personal Information”) of Plaintiffs and the putative Class Members. (Id. ¶ 1.) Defendant offers the full spectrum of IT solutions, including IT lifecycle services, data centers, cloud computing, data management, professional and technical training, digital infrastructure, and most pertinently, cybersecurity solutions. (Id. ¶ 22.) “Plaintiffs’ and Class Members’ sensitive Personal Information––which was entrusted to Defendant––was compromised and unlawfully accessed due to [a] Data Breach.” (Id. ¶ 2.) “According to the Notice of Data Breach letter (“Notice”) that Defendant sent to state Attorneys General, the private information compromised in the Data

Breach included at least full names, Social Security numbers, home addresses, job titles, dates of employment, salary, tax, banking and loan information, and employees’ COVID-19 vaccination status and dates of COVID-19 illness” (collectively “Private Information”). (Id. ¶ 3.) “The Private Information compromised in the Data Breach was exfiltrated by the cyber-criminals who perpetrated the attack and remains in the hands of those cyber-criminals” and “was a direct result of Defendant’s failure to implement adequate and reasonable cyber-security procedures and protocols necessary to protect employees’ Private Information.” (Id. ¶¶ 4‒5.) In the Notice letters sent to Plaintiffs on July 27, 2022, Defendant admits that it discovered “unauthorized access to its computer systems” and that employee data was “compromised.” (Id. ¶ 32.) Defendant “disclosed the Data Breach’s occurrence on July 6, 2022[,] but did not begin noticing Plaintiffs . . . until July 27, 2022.” (Id. ¶ 34.) Plaintiffs allege that due to “this targeted cyberattack, data thieves were able to gain access to and obtain data from [Defendant] that included the Private Information of Plaintiffs.” (Id. ¶ 39.) Defendant “could have prevented this Data

Breach by, among other things, properly encrypting or otherwise protecting their equipment and computer files containing PII.” (Id. ¶ 43.) Defendant’s webpage is replete with warnings regarding the frequency and severity of cyberattacks and the consequences that result from failures to implement proper data security practices and further acknowledges the need for companies to protect employees and company assets. (Id. ¶¶ 23‒24.) Defendant also “had obligations created by contract, industry standards, and common law to keep Plaintiffs’ . . . Private Information confidential and to protect it from unauthorized access and disclosure.” (Id. ¶ 45.) “Unfortunately for [Defendant]’s employees, . . . [Defendant] failed to adequately protect their Private Information from threats known to and anticipated by it” despite its promises to provide confidentiality and adequate security for

employee data. (Id. ¶¶ 25‒26.) Plaintiffs relied on these promises to keep their sensitive Private Information confidential and securely maintained and provided Defendant with—among other sensitive information—their names, dates of birth, Social Security numbers, driver’s license numbers, medical, and health insurance information. (Id. ¶¶ 28‒29.) Defendant also aggregated and maintained information developed during the course of the employment relationship like job titles, dates of employment, salary, tax, and banking and loan information. (Id. ¶ 30.) By obtaining, collecting, and using this Private Information, Defendant “assumed legal and equitable duties and knew or should have known that it was responsible for protecting Plaintiffs’ and Class Members’ Private Information from disclosure.” (Id. ¶ 50.) This is especially the case in light of recent high profile data breaches at other industry leading companies. (Id. ¶ 57.) Plaintiffs took reasonable steps to maintain the confidentiality of their PII and relied on Defendant to keep their PII confidential and securely maintained. (Id. ¶¶ 51‒52.) Although Defendant had the resources necessary to prevent the Data Breach, it neglected

to adequately implement them and invest in security measures commensurate with the foreseeable risk involved. (Id. ¶ 62.) Defendant also failed to comply with industry standards on securing PII and ran afoul of the Federal Trade Commission’s guidelines on security standards. (Id. ¶¶ 77, 87.) Defendant therefore “breached its obligations to Plaintiff[s] . . . or was otherwise negligent and reckless because it failed to properly maintain and safeguard its computer systems, networks, and data.” (Id. ¶ 91.) As a result, “Class Members are now, and for the rest of their lives will be, at a heightened and substantial risk of identity theft. Plaintiffs have also incurred (and will continue to incur) damages in the form of loss of privacy and costs of responding to the Data Breach including engaging adequate credit monitoring and identity theft protection services.” (Id. ¶ 96.) Specifically, Plaintiff Mantagas alleges that he experienced an increase in the number of spam

phone calls, emails, and texts, in particular emails related to payday loans following the Data Breach. (Id. ¶ 111.) On the other hand, Plaintiff Robina’s credit card information was used to make fraudulent charges following the Data Breach. (Id. ¶ 121.) Defendant also failed to give timely and accurate notice of the Data Breach as the breach was discovered on July 4, 2021, but notice was not sent out until July 27, 2022. (Id. ¶ 46.) Defendant’s notice is further incomplete and misleading as it does not disclose the specific information pertaining to each Class Member that was accessed in the Data Breach, the precise means of the attack, and whether Plaintiffs’ Private Information is still in the hands of the attackers. (Id. ¶ 47.) To date, Defendant has offered its employees whose data was compromised, only two years of credit monitoring. (Id. ¶ 75.) Plaintiffs’ Complaint alleges Negligence (Count I), Breach of Implied Contract (Count II), Unjust Enrichment (Count III), and Invasion of Privacy (Count IV). (ECF No. 1-1.) II. JURISDICTION

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Whitmore Ex Rel. Simmons v. Arkansas
495 U.S. 149 (Supreme Court, 1990)
Lujan v. Defenders of Wildlife
504 U.S. 555 (Supreme Court, 1992)
First Options of Chicago, Inc. v. Kaplan
514 U.S. 938 (Supreme Court, 1995)
Lewis v. Casey
518 U.S. 343 (Supreme Court, 1996)
Raines v. Byrd
521 U.S. 811 (Supreme Court, 1997)
Bell Atlantic Corp. v. Twombly
550 U.S. 544 (Supreme Court, 2007)
Ashcroft v. Iqbal
556 U.S. 662 (Supreme Court, 2009)
Reilly Ex Rel. Pluemacher v. Ceridian Corp.
664 F.3d 38 (Third Circuit, 2011)
Krim M. Ballentine v. United States
486 F.3d 806 (Third Circuit, 2007)
Clapper v. Amnesty International USA
133 S. Ct. 1138 (Supreme Court, 2013)
Guidotti v. Legal Helpers Debt Resolution, L.L.C.
716 F.3d 764 (Third Circuit, 2013)
Kirleis v. Dickie, McCamey & Chilcote, P.C.
560 F.3d 156 (Third Circuit, 2009)
Cna v. United States
535 F.3d 132 (Third Circuit, 2008)
Phillips v. County of Allegheny
515 F.3d 224 (Third Circuit, 2008)
Fowler v. UPMC SHADYSIDE
578 F.3d 203 (Third Circuit, 2009)
Aetrex Worldwide Inc v. Sourcing For You Limited
555 F. App'x 153 (Third Circuit, 2014)
Constitution Party of Pennsylv v. Carol Aichele
757 F.3d 347 (Third Circuit, 2014)

Cite This Page — Counsel Stack

Bluebook (online)
MANTAGAS v. SHI INTERNATIONAL CORP., Counsel Stack Legal Research, https://law.counselstack.com/opinion/mantagas-v-shi-international-corp-njd-2023.