UNITED STATES DISTRICT COURT EASTEN DISTRICT OF KENTUCKY CENTRAL DIVISON AT LEXINGTON
MATTHEW PEDERSEN, e¢ al.., Case No.: 5:25-cv-00086-KKC Plaintiffs,
OPINION AND ORDER ASBURY THEOLOGICAL SEMINARY, Defendant.
BS DIR 2k OC ak 2k oi This matter is before the Court on Motion to Dismiss by Asbury Theological Seminary. (R. 21.) This matter is fully briefed, and ripe for review. For the following reasons, Defendants’ Motion (R. 21) is GRANTED in part and DENIED in part. I. BACKGROUND This putative class action arises from a data breach (“the breach”) affecting Defendant Asbury Theological Seminary (“Defendant”) that occurred between June 1 and June 6, 2024. (R. 20.) Plaintiffs Matthew Pedersen and Joy Singh (collectively, “Plaintiffs”) brought this action individually and on behalf of all others similarly situated. (/d.) Plaintiffs allege that they were required to share their name, driver’s license, government-issued identification number, financial information, date of birth and Social Security number (collectively, “Private Information”) with the school as a requirement of applying to the Seminary. (/d. at 5, 10.) Plaintiffs allege that they provided their Private Information to Defendant with reasonable expectation and mutual
understanding that Defendant would comply with its obligation to keep such information confidential and secure. (Id. at 6.) On February 19, 2025, Defendant learned that an unauthorized third party may have accessed certain files containing Private Information, including the full name and social security number belonging to current and former students. Defendant notified the affected individuals via
letter in March of 2025. (Id.) The letter informed possible victims that their full name and social security number may have been impacted by an unauthorized actor. (Id.) Plaintiffs allege that they incurred damages from the data breach, including time spent monitoring their financial accounts; increased fraudulent bills, spam calls, and fraudulent login attempts; out-of-pocket expenses related to preventing and remedying identity theft or fraud; lost time, opportunity costs, and lost wages spent mitigating the breach; delayed tax refunds; unauthorized use of their stolen personal information; loss of control over their personal information; diminution in the value of that information; and the compromise and continued publication of their Private Information. (Id. at 21-22, 25, 27-28.)
Plaintiffs further allege that they face a continuing risk of future harm because their Private Information remains in Defendant’s possession and may be subject to future breaches. (Id. at 21.) Plaintiffs seek compensatory damages, reimbursement of out-of-pocket costs, and injunctive relief including improvements to Defendant’s data security systems, future annual audits, and adequate credit monitoring services funded by Defendant. (Id. at 4.) Plaintiffs bring five claims against Defendant: negligence (Count I); breach of implied contract (Count II); invasion of privacy based on intrusion upon seclusion (Count III); breach of fiduciary duty (Count IV); and unjust enrichment (Count V). (Id. at 34-40.) Defendant now moves to dismiss Plaintiffs’ claims under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). (R. 21.) II. ANALYSIS A. Federal Rule of Civil Procedure 12(b)(1) Defendant moves to dismiss Plaintiffs’ claims under Federal Rule of Civil Procedure 12(b)(1) for lack of standing under Article III of the United States Constitution. Specifically, Defendant directs its Rule 12(b)(1) challenge at Plaintiffs’ “embedded requests for prospective
injunctive and declaratory relief in Counts I and II, within the class allegations, and in the Prayer for relief.” (R. 23 at 2 (internal citations omitted).) Federal Rule of Civil Procedure 12(b)(1) provides for dismissal of a complaint for lack of subject matter jurisdiction. When reviewing a facial attack under Rule 12(b)(1), as here, the Court accepts the Complaint’s allegations as true for purposes of the jurisdictional analysis. Cartwright v. Garner, 751 F.3d 752, 759 (6th Cir. 2014). To survive facial attack, the complaint must contain a “short and plain statement of the grounds” for jurisdiction. Rote v. Zel Custom Mfg. LLC, 816 F.3d 383, 387 (6th Cir. 2016). Under Article III, a federal court’s jurisdiction is limited to “Cases” and “Controversies.”
U.S. Const., Art. III, § 2. An essential component of this limitation is the doctrine of standing, which “limits the category of litigants empowered to maintain a lawsuit in federal court to [those who] seek redress for a legal wrong.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). To establish Article III standing, a plaintiff must allege an “injury in fact” that is “fairly traceable” to the defendant’s challenged conduct and likely to be redressed by a favorable judicial decision. Susan B. Anthony List v. Driehaus, 573 U.S. 149, 157-58 (2014) (quoting Lujan v. Def’s. of Wildlife, 504 U.S. 555, 560–61 (1992)). The party invoking federal jurisdiction has the burden of showing that it has standing. TransUnion LLC v. Ramirez, 594 U.S. 413, 430-31 (2021). Here, Defendant seems to take issue with the “injury in fact” and “redressability” requirements. 1. Injury in Fact To establish an injury in fact, the alleged injury must be “an invasion of a legally protected interest” that is “concrete and particularized” and “actual or imminent,” not “conjectural” or
“hypothetical.” Driehaus, 573 U.S. at 158 (quoting Lujan, 504 U.S. at 560) (internal quotation marks omitted). Thus, to satisfy the injury in fact requirement, a plaintiff must demonstrate a legally protected interest, concreteness, particularization, and imminence. See Trichell v. Midland Credit Mgmt, Inc., 964 F.3d 990, 996-97 (11th Cir. 2020) (“Each subsidiary element of injury—a legally protected interest, concreteness, particularization, and imminence—must be satisfied.”) (citing Spokeo, 578 U.S. at 334; Lujan, 504 U.S. at 560)). Here, Defendant appears to attack only the imminence and concreteness elements. To satisfy the imminence element, Plaintiffs can show either that they have already sustained an injury or are in immediate danger of sustaining an injury. Savidge v. Pharm-Save,
Inc., 727 F. Supp. 3d 661, 676 (W.D. Ky. Mar. 29, 2024) (citing Airline Professionals Assoc. of Intern. Broth. Of Teamsters, Local Union No. 1224, AFL-CIO v. Airborne, Inc., 332 F.3d 983, 987 (6th Cir. 2003)). In the data breach context, “[w]here Plaintiffs already know that they have lost control of their data, it would be unreasonable to expect Plaintiffs to wait for actual misuse—a fraudulent charge on a credit card, for example—before taking steps to ensure their own personal and financial security[.]” Galaria v. Nationwide Mutual Insurance Co., 663 F. App’x 384, 388 (6th Cir. 2016). Accordingly, Plaintiffs’ allegations of losing control over their data following the data breach satisfies the imminence element. To satisfy the concreteness element, a harm must be “real, and not abstract.” Spokeo, Inc. v. Robins, 578 U.S. 330, 340 (2016) (citations omitted). Various intangible harms, such as disclosure of private information and intrusion upon seclusion, can constitute concrete harms. TransUnion LLC v. Ramirez, 594 U.S. 413, 425 (2021) (citations omitted). In the data breach context, where plaintiffs “must expend time and money to monitor their credit, check their bank
statements, and modify their financial accounts . . . these costs are a concrete injury suffered to mitigate an imminent harm, and satisfy the injury requirement of Article III standing.” Galaria v. Nationwide Mut. Ins. Co., 663 F. App’x 384, 388-389 (6th Cir. 2016). These are precisely the kinds of damages Plaintiffs claim here. Here, Plaintiffs allege harm including invasion of privacy rights, diminution in value of the data, lost time, and emotional distress. (R. 22 at 6.) Further, Plaintiffs allege that, because their Private Information remains in the possession of Defendant, it is “subject to further breaches so long as Defendant fails to undertake the appropriate measures to protect the [Private Information.]” (Id. at 11 (internal citations omitted).) At this stage, those allegations are sufficient to establish an injury in fact.
Plaintiffs do not rely merely on speculative possibility that their information could be exposed in the future; rather, they allege that their information has already been accessed by unauthorized actors, has been misused, and remains in their possession. (Id. at 10-11). Accordingly, Plaintiffs have sufficiently alleged facts pertaining to the concreteness element. Accordingly, the Court finds that Plaintiffs have sufficiently alleged injuries in fact as to its claims for damages, as well as its claims for injunctive and declaratory relief. 2. Redressability To establish the “redressability” requirement, Plaintiffs must show that the alleged injury “is likely to be redressed by a favorable judicial decision.” Wittman v. Personhuballah, 578 U.S. 539, 544 (2016) (citation omitted). Plaintiffs seek compensatory damages and other monetary remedies, which would redress their financial harms. (See R. 20 at 43-44; Accord Galaria, 663 F. App’x at 391 (“Plaintiffs seek compensatory damages for their injuries, and a favorable verdict would provide redress.”).) Defendant points out that Plaintiffs also “embed requests” for declaratory and injunctive relief “within their substantive causes of action.” (R. 21-1 at 9.)
Specifically, Defendant notes the following: In Counts I and II for negligence and breach of implied contract, Plaintiffs allege that they are “entitled to injunctive relief requiring [Asbury] to (i) strengthen its data security systems and monitoring procedures; [and] (ii) submit to future annual audits of those systems and monitoring procedures.” (Compl. ¶¶ 171, 183.) Likewise, in their class allegations, (Compl. § VI.), Plaintiffs assert that “class certification, injunctive relief, and corresponding declaratory relief are appropriate on a Class-wide basis.” (Id. ¶ 156.) Beyond that, Plaintiffs repeat the demand for improvements to data security systems and future annual audits, (id. ¶ 15), and in their Prayer for Relief, where they seek equitable orders enjoining Asbury from the alleged wrongful conduct and compelling it to adopt new data-security policies. (Id. § VIII(b)-(c).) (Id.) Plaintiffs have plausibly alleged an injury in fact based on a substantial risk of future harm, and an injunction would redress that injury. Accord TransUnion, 594 U.S. at 435 (“As this Court has recognized, a person exposed to a risk of future harm may pursue forward-looking, injunctive relief to prevent the harm from occurring, at least so long as the risk of harm is sufficiently imminent and substantial.”). Taken together, the Court finds that Plaintiffs have adequately alleged facts establishing Article III standing. Accordingly, the Court will deny Defendants’ motion pursuant to Federal Rule of Civil Procedure 12(b)(1) for lack of standing. B. Federal Rule of Civil Procedure 12(b)(6) Defendant moves to dismiss Plaintiffs’ claims under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim upon which relief can be granted. “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S.
662, 678 (2009) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007)); see also Courier v. Alcoa Wheel & Forged Products, 577 F. 3d 625, 629 (6th Cir. 2009). While a complaint attacked by a Rule 12(b)(6) motion does not need detailed factual allegations, “a formulaic recitation of the elements of a cause of action will not do.” Twombly, 550 U.S. at 555. When reviewing a motion under Rule 12(b)(6), the Court must “accept all of plaintiff’s factual allegations as true and determine whether any set of facts consistent with the allegations would entitle the plaintiff to relief.” G.M. Eng’rs & Assoc., Inc. v. West Bloomfield Twp., 922 F.2d 328, 330 (6th Cir. 1990) (citation omitted). 1. Negligence
Defendant moves to dismiss Plaintiffs’ negligence claim on the ground that Plaintiffs have failed to plead cognizable damages. (R. 21-1 at 11.) To successfully plead a negligence claim under Kentucky state law, Plaintiffs must allege facts supporting “(1) a duty owed by the defendant to the plaintiff, (2) breach of that duty, (3) injury to the plaintiff, and (4) legal causation between the defendant’s breach and the plaintiff’s injury.” Wright v. House of Imports, Inc., 381 S.W.3d 209, 213 (Ky. 2012). The injury must be actual, because “[a] cause of action does not exist until the conduct causes injury that produce loss or damage.” Capital Holding Corp. v. Bailey, 873 S.W.2d 187, 192 (Ky. 1994) (internal quotation omitted). Here, Plaintiffs claim that, because of the data breach, they spent time and money mitigating its effects, incurred out-of-pocket expenses, and experienced unauthorized login attempts. (R. 22 at 12.) These allegations identify present, concrete injuries, not merely a fear that harm may occur later. At the motion-to-dismiss stage, Plaintiffs need not prove the full extent of their damages; they only need to allege facts making their claim for damages plausible. Twombly,
550 U.S. at 570. Because Plaintiffs allege that they suffered mitigation costs, out-of-pocket losses, and attempted unauthorized access connected to the breach, the Court finds that Plaintiffs have sufficiently alleged more than a mere speculative risk of future harm. The Court finds that the Plaintiffs sufficiently allege facts making the elements of negligence plausible under Kentucky law. Accordingly, the Court will not dismiss Plaintiffs’ negligence claim. 2. Breach of Implied Contract Defendant also moves to dismiss Plaintiffs’ breach of implied contract claim. Under Kentucky law, “[t]o establish breach of an implied contract, the Plaintiff must prove the existence of an implied contract, created by mutual assent, and failure of a party to comply with the contract’s
terms.” McKenzie v. Allconnect, Inc., 369 F. Supp. 3d 810, 821 (E.D. Ky. 2019) (citing Furtula v. Univ. of Ky., 438 S.W.3d 303, 308–09 (Ky. 2014)). An implied contract may be inferred from the parties’ conduct where the circumstances show a mutual intent to contract. Davis v. Davis, 343 S.W.3d 610, 614 (Ky. Ct. App. Apr. 1, 2011) (quoting Rider v. Combs, 256 S.W.2d 749 (Ky. 1953)). However, Plaintiffs must still allege facts supporting mutual assent, and the alleged agreement must contain sufficiently definite terms. Britt v. Univ. of Louisville, 628 S.W.3d 1, 5 (Ky. 2021). The Defendant argues that the Plaintiffs’ implied contract allegations “underscore the disconnect between the Plaintiffs theory and reality.” (R. 21-1 at 12). Defendant points to the Plaintiffs’ allegations that they entered a contract with Defendant “in exchange for employment” and that they “provided labor” thinking that Asbury would use its “earnings” to secure their Private Information. (Id. (citing Compl. ¶¶ 173, 176)). The Plaintiffs here are students, not employees, who provided their Private Information in exchange for enrollment, not wages. (Id.) While this may be true, the Plaintiffs’ implied-contract theory does not rest solely on an employment relationship.
The Plaintiffs’ implied-contract theory instead rests on the exchange of Private Information for educational services. Plaintiffs allege that Defendant collected their Private Information as part of the administrative process of applying and attending the University. (R. 22 at 15.) They contend that, by collecting that information and representing that it would “provide confidentiality and adequate security through its privacy policy and through other disclosures in compliance with statutory privacy requirements,” Defendant created an implied agreement to safeguard their data. (Id. (citing Compl. ¶ 44)). Defendants disagree and argue that, if anything, these alleged facts only imply a unilateral understanding of data security. (R. 21-1 at 13.) At the pleadings stage, Plaintiffs are not required to prove the ultimate existence of an
implied contract. Fed. R. Civ. P. 8(a)(2); Iqbal, 556 U.S. at 678; Twombly, 550 U.S. at 555. As stated above, they must allege facts from which the Court can reasonably infer mutual assent and a failure to comply with the alleged contract terms. The Court finds that Plaintiffs have done so here. Accordingly, the Court will not dismiss Plaintiffs’ breach of implied contract claim. 3. Invasion of Privacy—Intrusion Upon Seclusion Defendant also moves to dismiss Plaintiffs’ invasion of privacy claim for intrusion upon seclusion. Kentucky law recognizes the tort of intrusion upon seclusion, which requires “(1) an intentional intrusion by the defendant, (2) into a matter the plaintiff has a right to keep private, (3) which is highly offensive to a reasonable person.” Wells v. Craig & Landreth Cars, Inc., No. 3:10- CV-376, 2012 WL 6487392, at *5 (W.D. Ky. Dec. 13, 2012) (citing Restatement (Second) of Torts § 652B); see Pearce v. Whitenack, 440 S.W.3d 392, 401 (Ky.App.2014)). “[A] defendant’s actions may be intentional when the defendant acts with such reckless disregard for the privacy of the plaintiff that the actions rise to the level of being an intentional tort.” Silveria v. Commer. Specialty Truck Holdings, LLC, 2025 U.S. Dist. LEXIS 155058, *16-17 (E.D. Ky. Aug. 12, 2025) (citations
and internal quotations omitted). Plaintiffs allege that Defendant collected and retained Plaintiffs’ Private Information, then failed to implement adequate security measures to protect that information. (R. 20 at 21.) Plaintiffs allege that this resulted in the third-party cybercriminals’ unauthorized access into Plaintiffs’ Private Information. (Id.) Plaintiffs assert that “Defendant’s acts and omissions giving rise to the Data Breach were intentional in that the decisions to implement lax security and failure to timely notice Plaintiffs and the Class were undertaken willfully and intentionally.” (Id. at 38.) Plaintiffs argue that this reckless disregard for their privacy rights is sufficient to support an intrusion upon seclusion claim. (R. 22 at 17.)
Taken as true, these allegations could lead a jury to infer that Defendant acted with such reckless disregard as to the privacy of Plaintiffs’ Private Information to rise to the level of intentionally allowing the intrusion upon Plaintiffs’ seclusion. Accordingly, the Court will not dismiss Plaintiffs’ invasion of privacy claim. 4. Breach of Fiduciary Duty Defendant next moves to dismiss the Plaintiffs’ breach of fiduciary duty claim. Plaintiffs did not respond to this argument. When a party "fails to respond or to otherwise oppose a Defendant's motion, then the district court may deem the plaintiff to have waived opposition to the motion." Scott v. Tennessee, 878 F.2d 382, 382 (6th Cir. 1989) (unpublished table decision); see also Humphrey v. U.S. Attorney General's Office, 279 F. App'x 328, 331 (6th Cir. 2008) (finding that a plaintiff's failure to oppose arguments raised in the defendant's motion to dismiss is grounds for the district court to assume that opposition to the motion is waived). Joint Local Civil Rule 7.1(c) also states that "[f]ailure to timely respond to a motion may be grounds for granting the motion." Because the Plaintiffs did not respond to the motion to dismiss as to their fiduciary duty
claim, the Court finds that Plaintiffs have waived their opposition, and the motion to dismiss this claim will be granted. Even if Plaintiffs did respond, the Court would still grant Defendant’s motion to dismiss as to the fiduciary duty claim. This claim requires more than allegations that Plaintiffs entrusted Defendant with sensitive information or that Defendant owed Plaintiffs a general duty of care. Under Kentucky law, a fiduciary relationship exists only where one party “has expressly undertaken to act for the plaintiff’s primary benefit.” Lurry v. PharMerica Corp., No. 3:23-CV- 297-RGJ, 2024 WL 2965642, at *5 (W.D. Ky. June 12, 2024) (quoting McKenzie v. Allconnect, Inc., 369 F.Supp. 3d 810, 823 (E.D. Ky. 2019)). “Although fiduciary relationships can be informal,
a fiduciary duty does not arise from the universal business duty to deal fairly nor is it created by a unilateral decision to repose trust and confidence[.]” Allconnect, 369 F.Supp. 3d at 823. Here, Plaintiffs have not alleged facts showing that Defendant expressly undertook to act primarily for their benefit with respect to the protection of their Private Information. Plaintiffs, instead, allege that Defendant collected and stored Plaintiffs’ Private Information as part of its ordinary course of running its business, including for routine enrollment and administrative processes. (R. 20 at 5.) While Plaintiffs allege that Defendant had a duty to safeguard what they possessed of Plaintiffs’ Private Information, such allegations do not plausibly establish a fiduciary relationship under Kentucky law. See Lurry v. PharMerica Corp., No. 3:23-CV-297-RGJ, 2024 WL 2965642 (W.D. Ky. June 12, 2024) (dismissing a data-breach fiduciary-duty claim because the plaintiffs alleged only that the defendant collected and maintained their personal information, not that the defendant expressly undertook to act primarily for their benefit). Defendant’s routine collection of student enrollment information for admirative purposes does not, without more, create a fiduciary relationship.
Accordingly, the Court dismiss Plaintiffs’ breach of fiduciary duty claim. 5. Unjust Enrichment Defendant moves to dismiss Plaintiffs’ unjust enrichment claim. Under Kentucky law, unjust enrichment requires: “(1) [a] benefit conferred upon defendant at Plaintiffs’ expense; (2) a resulting appreciation of the benefit by defendant; and (3) inequitable retention of that benefit without payment for its value.” Superior Steel, Inc. v. Ascent at Roebling’s Bridge, LLC, 540 S.W.3d 770, 778 (Ky. 2017) (citations omitted). Here, the parties disagree whether Plaintiff alleged facts to satisfy the first element. Defendant argues that the Complaint does not plausibly allege that Plaintiffs conferred a monetary
benefit on Defendant by saving costs on data security, because the hackers benefitted from the data breach, not Defendant. (R. 21-1 at 16 (citing Jones v. Sparks, 297 S.W.3d 73, 78 (Ky. Ct. App. 2009)).) Plaintiffs, on the other hand, allege that Plaintiffs conferred a monetary benefit on Defendant by providing their Private Information as a condition of applying to and attending the school, then “Defendant enriched itself by saving the costs it reasonably should have expended on data security measures to secure Plaintiffs’ and Class Members’ Private Information.” (R. 20 at 42; see R. 22 at 19 (citing Bowen v. Paxton Media Grp., LLC, 2022 WL 4110319, *1, 8 (W.D. Ky. Sept. 8, 2022)).) This cost-saving measure, according to Plaintiffs, resulted in the breach of Plaintiffs’ Private information. (R. 22 at 19-20.) At this stage in litigation, by alleging that Defendant saved costs on data-security at the costs of Plaintiffs’ Private Information, Plaintiffs have sufficiently pled facts pertaining to unjust enrichment under Kentucky law. See Bowen v. Paxton Media Grp., LLC, 2022 U.S. Dist. LEXIS
162083, *19-20 (W.D. Ky. Sept. 8, 2022) (finding that plaintiffs’ allegations that defendant was “enriched by the savings in costs that should have been reasonably expended to protect the [private information]” sufficiently alleged unjust enrichment in the data breach context); Silveira v. Commer. Specialty Truck Holdings, LLC, 2025 U.S. Dist. LEXIS 155058, *17-18 (Aug. 12, 2025). Accordingly, the Court will not dismiss Plaintiffs’ unjust-enrichment claim. III. CONCLUSION Accordingly, the Court hereby ORDERS that Defendants’ Motion to Dismiss (R. 21-1) is GRANTED in part and DENIED in part as follows:
(1) Defendant’s motion to dismiss under Fed. R. Civ. P. 12(b)(1) is DENIED; (2) Defendant’s motion to dismiss under Fed. R. Civ. P. 12(b)(6) is DENIED as to Count I (Negligence), Count II (Breach of Implied Contract), Count III (Invasion of Privacy), and Count V (Unjust Enrichment); and (3) Defendant’s motion to dismiss under Fed. R. Civ. P. 12(b)(6) is GRANTED as to Count IV (Breach of Fiduciary Duty).
As a result of this Opinion, the remaining claims in this case are Count I (Negligence), Count II (Breach of Implied Contract), Count III (Invasion of Privacy), and Count V (Unjust Enrichment). This 5th of August, 2026. heats Signed By: we Peril ph Karen K. Caldwell AKC “Gass ~=—s« United States District Judge