COURT OF APPEALS DECISION NOTICE DATED AND FILED This opinion is subject to further editing. If published, the official version will appear in the bound volume of the Official Reports. November 18, 2025 A party may file with the Supreme Court a Samuel A. Christensen petition to review an adverse decision by the Clerk of Court of Appeals Court of Appeals. See WIS. STAT. § 808.10 and RULE 809.62.
Appeal No. 2024AP1882 Cir. Ct. No. 2024CV124
STATE OF WISCONSIN IN COURT OF APPEALS DISTRICT III
MICHAEL BAUER, BONNIE BAUER, NOAH PEARSON, BOBBI SILKWORTH, CRISTA COTTRELL, THERESA LAFOND AND JAMES LAFOND,
PLAINTIFFS-APPELLANTS,
V.
FINCANTIERI MARINE GROUP, LLC,
DEFENDANT-RESPONDENT,
ABC INSURANCE COMPANY AND STARR INSURANCE HOLDINGS D/B/A STARR INDEMNITY & LIABILITY CO.,
DEFENDANTS.
APPEAL from an order of the circuit court for Brown County: MARC A. HAMMER, Judge. Affirmed.
Before Stark, P.J., Hruz, and Gill, JJ. No. 2024AP1882
¶1 STARK, P.J. Michael Bauer, Bonnie Bauer, Noah Pearson, Bobbi Silkworth, Crista Cottrell, Theresa LaFond, and James LaFond (collectively, the Employees) appeal from a circuit court order granting Fincantieri Marine Group, LLC’s (FMG) motion to dismiss the Employees’ multiple contract and tort claims.1 The Employees’ claims are based on a ransomware attack on FMG’s computer systems, which resulted in certain employees’ personally identifiable information and/or personal health information being accessed and/or acquired by an unauthorized third party or parties. However, the Employees do not allege in their complaint that the breach of their sensitive information resulted in identity theft, fraud, or any other misuse of the data.
¶2 The circuit court dismissed the complaint, concluding that the Employees lacked standing to assert their negligence claim and that they otherwise failed to state a claim on their remaining causes of action. The Employees challenge the dismissal on appeal. Under the circumstances of this case, we conclude that the Employees lack standing to assert any of their claims against FMG because the possibility of future identity theft is not sufficiently imminent. For the reasons that follow, we affirm dismissal of the Employees’ complaint.
BACKGROUND
¶3 On April 12, 2023, FMG, an American shipbuilder of government and commercial vessels, discovered a cyberattack on its computer systems, and it determined that its current and former employees’ sensitive information may have
1 The named plaintiffs-appellants in this class action lawsuit are “individuals who were previously employed or currently employed” by FMG and had their personal information accessed during a data breach. The plaintiffs-appellants seek to certify two subclasses in this case: those individuals affected by the data breach living in Wisconsin and Michigan.
2 No. 2024AP1882
been viewed or collected by an unauthorized third party or parties. FMG notified the affected individuals of the data breach on January 5, 2024. The notice explained that the personal information impacted in the data breach included “individuals’ names, … date of birth, Social Security number, diagnosis information, health insurance information, full face picture, medical account number, and/or claim or complaint number.” The notice further stated that “[u]pon learning of this incident, we immediately secured our environment, investigated to determine the nature and scope of the incident, and notified law enforcement” and that FMG had “implemented additional technical safeguards to help prevent a similar incident in the future.” Finally, FMG offered “impacted individuals access to complimentary credit monitoring and identity protection services through Experian.”
¶4 On January 25, 2024, the Employees brought this class action lawsuit against FMG. The complaint alleges claims for negligence, negligence per se, breach of contract, breach of implied contract, unjust enrichment, breach of fiduciary duty, breach of the implied covenant of good faith and fair dealing, breach of a third-party beneficiary contract, and for declaratory and injunctive relief.
¶5 In particular, the Employees assert that FMG failed to “properly secure and safeguard sensitive and confidential personally identifiable information.” The Employees further claim that, “[a]s a direct and proximate result of” the data breach, they are
facing ongoing, imminent, impending threats of identity theft crimes, fraud, scams, and other misuses of their [p]ersonal [i]nformation; ongoing monetary loss and economic harm; loss of value of privacy and confidentiality of the stolen [p]ersonal [i]nformation; illegal sales of the compromised [p]ersonal [i]nformation; mitigation expenses and time spent on credit monitoring; identity theft
3 No. 2024AP1882
insurance costs; credit freezes/unfreezes; expense and time spent on initiating fraud alerts and contacting third parties; decreased credit scores; lost work time; and other injuries.
However, in the complaint, none of the Employees allege that any identity theft or data misuse has actually occurred.
¶6 As a result, FMG filed a motion to dismiss, arguing that the Employees’ complaint should be dismissed for lack of standing because they “cannot point to a legally protected interest that suffered an injury.” According to FMG, the Employees “can point to no evidence that their information was accessed or misused in any way; rather, their primary argument is that they face ‘ongoing, imminent, impending threats of’” “identity theft at some unknown time in the future.” FMG argued that the Employees “offer[ed] zero facts to suggest any such harm is truly imminent or substantially likely to occur.”
¶7 Based on the parties’ briefs, the circuit court issued a thorough and well-reasoned written decision granting FMG’s motion to dismiss. The court concluded, based on its review of both binding and persuasive legal authority, that “[i]t is clearly not the case, as [the Employees] have declared, that a ‘threat of future identity theft’ alone is sufficient to establish standing.” According to the court, it had not been presented with a case that “would support a finding of standing in this matter absent some allegation that identity theft or misuse of protected information has actually already occurred such that future, related harms like those alleged in [the Employees’] complaint are sufficiently imminent under the law.” As a result, the court determined that the Employees did not have standing to bring their negligence action.
¶8 On a distinct, but related basis, the circuit court further determined that the Employees had failed to state a claim for relief on their remaining causes
4 No. 2024AP1882
of action. Specifically, the court observed that the Employees “seem to have abandoned their negligence per se claim in failing to rebut FMG’s arguments in briefing.” On the claims for breach of an express and an implied contract, the court reiterated that the Employees had “alleged unduly speculative, future harms that [also] cannot serve as the basis for a breach of contract claim.” The court dismissed the Employees’ unjust enrichment claim because the Employees “conferred no benefit to FMG when they provided FMG with their personal information.”
¶9 The circuit court also dismissed the breach of fiduciary duty claim, noting that under Wisconsin law, an employer-employee relationship does not create a fiduciary duty and finding that the “complaint alleges no facts that demonstrate the existence of a special relationship between [the Employees] and FMG.” On the causes of action for breach of third-party beneficiary contract and breach of the covenant of good faith and fair dealing, the court found that the Employees had “not established the existence of a valid contract between [the Employees] and FMG which would impose an obligation of the sort that is relevant to their underlying claim.” Finally, the court found that claims for both declaratory and injunctive relief were inappropriate under the circumstances. The Employees appeal.
DISCUSSION
¶10 We resolve this case based entirely on whether the Employees have standing to bring their claims. Although the circuit court narrowed its conclusion on standing to the Employees’ negligence claim specifically, we conclude that the Employees lack standing to pursue all of their claims based on their failure to allege an injury in fact or an interest that will be injured. See Blum v. 1st Auto &
5 No. 2024AP1882
Cas. Ins. Co., 2010 WI 78, ¶27 n.4, 326 Wis. 2d 729, 786 N.W.2d 78 (explaining that we may affirm the circuit court on other grounds).
¶11 “Whether a party has standing is a question of law that we review independently.” Friends of the Black River Forest v. Kohler Co., 2022 WI 52, ¶10, 402 Wis. 2d 587, 977 N.W.2d 342 (citation omitted). Under Wisconsin law, we determine whether a party has standing by considering the following:
(1) whether the party whose standing is challenged has a personal interest in the controversy (sometimes referred to in the case law as a “personal stake” in the controversy); (2) whether the interest of the party whose standing is challenged will be injured, that is, adversely affected; and (3) whether judicial policy calls for protecting the interest of the party whose standing has been challenged.
Foley-Ciccantelli v. Bishop’s Grove Condo. Ass’n, 2011 WI 36, ¶5, 333 Wis. 2d 402, 797 N.W.2d 789. The law of standing is liberally construed. Krier v. Vilione, 2009 WI 45, ¶20, 317 Wis. 2d 288, 766 N.W.2d 517. “To say that the plaintiffs have standing is to say that they have alleged injury in fact, and if they have suffered an injury then damages are available.” Reetz v. Advocate Aurora Health, Inc., 2022 WI App 59, ¶8, 405 Wis. 2d 298, 983 N.W.2d 669 (citation omitted). “Being damaged, however, without more, does not automatically confer standing.” Krier, 317 Wis. 2d 288, ¶20.
¶12 “Unlike in federal courts, which can only hear ‘cases’ or ‘controversies,’ standing in Wisconsin is not a matter of jurisdiction, but of sound judicial policy.” McConkey v. Van Hollen, 2010 WI 57, ¶15, 326 Wis. 2d 1, 783 N.W.2d 855 (footnote omitted). Nevertheless, Wisconsin courts look to federal case law as persuasive authority to resolve questions of standing. Friends of the Black River Forest, 402 Wis. 2d 587, ¶17.
6 No. 2024AP1882
¶13 The Employees allege that they “are at a risk of future injuries such as the increased risk of fraudulent charges and identity theft … because their data has already been stolen,” and they assert that “[t]he threat of this future harm or injury is concrete and proximately caused by FMG’s negligence despite the lack of fraudulent charges or activities to date.” In response, FMG stresses that there are no allegations that any of the Employees have “had his or her identity stolen, suffered any sort of fraud, or had his or her personal data misused in any way.” Thus, explains FMG, the Employees’ “theory of injury is based entirely on the premise” of a speculative, future harm.
¶14 We conclude that the circuit court appropriately determined that the Employees lack standing to bring their negligence claim because they have not alleged any injury, apart from the risk of future harm, as a result of FMG’s data breach. For this same reason, we also conclude that the Employees’ claims against FMG for breach of contract, breach of implied contract, breach of fiduciary duty, breach of the implied covenant of good faith and fair dealing, unjust enrichment, breach of a third-party beneficiary contract, and for declaratory and injunctive relief fail for a lack of standing.2 Based on our review of the
2 We note that the Employees also asserted a claim for negligence per se based on FMG’s alleged failure to meet data security standards set forth in Section 5 of the Federal Trade Commission Act and the Health Insurance Portability and Accountability Act. See Antwaun A. ex rel Muwonge v. Heritage Mut. Ins. Co., 228 Wis. 2d 44, 66-67, 596 N.W.2d 456 (1999) (outlining the elements of a negligence per se claim).
Based on our review of the briefing before the circuit court, we agree with the court and FMG that the Employees abandoned their negligence per se claim by failing to refute FMG’s arguments seeking dismissal of that claim. See State v. Huebner, 2000 WI 59, ¶10, 235 Wis. 2d 486, 611 N.W.2d 727 (“It is a fundamental principle of appellate review that issues must be preserved at the circuit court.”); see also Charolais Breeding Ranches, Ltd. v. FPC Sec. Corp., 90 Wis. 2d 97, 109, 279 N.W.2d 493 (Ct. App. 1979) (noting that arguments not refuted are deemed conceded). We affirm the circuit court’s dismissal of the Employees’ negligence per se claim on this basis.
7 No. 2024AP1882
relevant legal authority, we conclude that the threat of future identity theft or fraud, on its own, is insufficient to establish standing for any claim in this case.
¶15 Both FMG and the Employees rely on Reetz in support of their respective positions. In Reetz, Janet Reetz filed a class action lawsuit against Advocate Aurora Healthcare, Inc., alleging many of the same claims as those asserted by the Employees in this case, based on a data breach of personal information from Advocate Aurora’s systems. See Reetz, 405 Wis. 2d 298, ¶1. As a result of the data breach, 63 employees had their direct deposit information changed to deposit paychecks into the cybercriminal’s account(s), and Reetz specifically “alleged that she suffered $2,700 in fraudulent charges against her bank account and a resulting $600 in insufficient funds and overdraft fees.” Id., ¶¶3, 8. We concluded that Reetz’s allegations were sufficient to establish standing. Id., ¶9. In addition to the alleged fraudulent charges on her bank account and the resulting fees, we credited her claims of time spent addressing the fraud charges on her account, money spent mitigating threats of future fraud, and the threat of future identity theft as sufficient to establish standing. Id., ¶8 (citing Fox v. Iowa Health Sys., 399 F. Supp. 3d 780, 790 (W.D. Wis. 2019)).
¶16 We agree with the circuit court and FMG that Reetz does not support a conclusion that a threat of future identity theft alone is sufficient to establish standing in Wisconsin. The circuit court drew an apt distinction between Reetz, which was a “data breach identity theft case,” and this case, which is merely a data breach case. Reetz does not support the proposition that the entirely prospective and hypothetical risk of identity theft—or the expenditures undertaken to guard against that hypothetical risk—are sufficient to establish standing under Wisconsin law.
8 No. 2024AP1882
¶17 Central to our decision in this case is the fact that the Employees do not allege in their complaint that anyone has fallen victim to identity theft, fraud, or any other type of digital scam.3 Neither do the Employees allege that they have been subjected to phishing emails, spam phone calls, or “blackmail from nefarious actors concerning the disclosure of their medical records.” They also do not allege that any of the stolen information was found on the “dark web.” In their complaint, the Employees merely allege an “increased risk” of these things happening. Thus, all of the Employees’ alleged injuries are possible future harms or related to the threat of those future harms.
¶18 Under the circumstance here, in order for the Employees to establish standing—in other words, an injury to a party’s interest that judicial policy calls for protecting, see Foley-Ciccantelli, 333 Wis. 2d 402, ¶5—the Employees must allege sufficiently present or imminent future harm demonstrated, in this case, by asserting that the data subject to the breach has already been accessed and misused by a third party in some way, see Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013) (explaining “that ‘threatened injury must be certainly impending to constitute injury in fact,’ and that ‘[a]llegations of possible future injury’ are not sufficient” (alteration in original; citation omitted)); see also Hennekens v. Hoerl, 160 Wis. 2d 144, 152-53, 465 N.W.2d 812 (1991) (“Actual damage is harm that has already occurred or is reasonably certain to occur in the future,” “not the mere
3 FMG notes that the data breach occurred in April 2023, and “[b]y the time [the Employees] replied to FMG’s motion to dismiss in the [c]ircuit [c]ourt, a year had passed.” See Beck v. McDonald, 848 F.3d 262, 275 (4th Cir. 2017) (“‘[A]s the breaches fade further into the past,’ the Plaintiffs’ threatened injuries become more and more speculative.” (citation omitted)); McCombs v. Delta Grp. Elecs., Inc., 676 F. Supp. 3d 1064, 1072 (D.N.M. 2023) (“[O]ver a year has passed since the data breach and McCombs fails to allege that any of the compromised [personal information]—whether hers or that of the proposed class—has been misused.”).
9 No. 2024AP1882
possibility of future harm.” (footnote omitted)). Speculation about future identity theft, which may or may not occur as a result of a data breach that occurred more than two years ago, is insufficient.
¶19 The Employees argue that our conclusion above lacks support under federal law. Although the Employees concede that “Wisconsin and the [Seventh] Circuit [Court of Appeals] do[] not have a case on all fours” with this case, they present several cases for our review, which they assert provide persuasive authority that the risk of future identity theft is sufficient to establish standing. Specifically, the Employees argue that Fox; Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688 (7th Cir. 2015); and Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963 (7th Cir. 2016), “clearly define what happens in future harm cases related to data breaches” and “are highly persuasive and instructive that the risk of future identity theft is sufficient to establish standing.”
¶20 For example, in Fox, the plaintiffs alleged that hackers obtained private health information and personal identifying information, leading to attempted identity theft, fraudulent charges, and scam communications. Fox, 399 F. Supp. 3d at 787-89. The District Court for the Western District of Wisconsin concluded that the plaintiffs had “alleged facts sufficient to establish an objectively reasonable likelihood of future identity theft,” citing the theft of Social Security numbers, the provision of identity-theft protection services, and the plaintiffs’ experiences of fraud attempts and spam communications. Id. at 790-91.
¶21 In Remijas, a cyberattack against Neiman Marcus disclosed information related to 350,000 customers’ credit cards, and 9,200 of those cards had been used fraudulently. Remijas, 794 F.3d at 690. The Seventh Circuit held that the increased risk of identity theft constituted a substantial risk of harm
10 No. 2024AP1882
sufficient for standing. Id. The court also emphasized the aggravation and time lost addressing fraudulent charges as concrete injuries. Id. at 692.
¶22 Finally, in Lewert, a restaurant data breach exposed credit and debit card information. Lewert, 819 F.3d at 965. The Seventh Circuit, relying on Remijas, found standing based on the substantial risk of harm from the breach, fraudulent charges experienced by one plaintiff, and mitigation expenses incurred. Lewert, 819 F.3d at 966-67.
¶23 FMG counters that in each of these cases, at least one plaintiff alleged actual misuse of data, which made the risk of future harm sufficiently imminent and concrete. See Fox, 399 F. Supp. 3d at 789 (noting that the “plaintiffs ha[d] been victims of attempted identity theft and fraud as well as scam phone calls and emails” and that one plaintiff “discovered a suspicious charge on his credit card”); Remijas, 794 F.3d at 691 (relating that multiple plaintiffs experienced fraudulent charges); Lewert, 819 F.3d at 965 (noting that one plaintiff had four fraudulent transactions on his credit card).4 FMG argues that the absence of demonstrated data misuse in the present case distinguishes it from these precedents.
¶24 The Employees disagree, arguing that “[w]hether there was already identity theft was not a dispositive fact in [the courts’] analys[e]s” in Fox,
4 The Employees also rely heavily on Linman v. Marten Transport, Ltd., No. 22-CV-204, 2023 WL 2562712 (W.D. Wis. Mar. 17, 2023). In that case, Scott Linman provided his personal information to Marten Transport on a job application, which was stored on Marten’s servers and later compromised in a data breach. Id. at *1. Importantly, Linman alleged that his debit card information was “used by unauthorized third parties.” Id. After noting that the facts in the case were similar to Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688 (7th Cir. 2015), and Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963 (7th Cir. 2016), the court ultimately determined that Linman had standing to sue. Linman, 2023 WL 2562712, at *3.
11 No. 2024AP1882
Remijas, and Lewert. That assertion, however, ignores that the courts in those cases were not asked to resolve the question of whether the plaintiffs had standing absent any demonstrated identity theft. The fact that the above-mentioned courts did not address an issue—i.e., standing absent identity theft—that did not exist in those cases is not dispositive of our review here. Standing derives from the nature and immediacy of the claimed injury, meaning that it is a fact-specific inquiry and legal precedent cannot be applied blindly.
¶25 Furthermore, as FMG identifies, after Fox, Lewert, and Remijas were decided, the United States Supreme Court decided TransUnion LLC v. Ramirez, 594 U.S. 413 (2021). TransUnion involved a claim that the credit reporting agency “failed to use reasonable procedures to ensure the accuracy of their credit files” in violation of the Fair Credit and Reporting Act and that some of the misleading credit reports were disclosed to third parties. Id. at 417. The Court determined that the plaintiffs whose reports were not disclosed did not suffer a concrete harm, even though they faced a risk of future disclosure. Id. at 435-37. Because there was no evidence in the record to “establish[] a serious likelihood of disclosure” of those reports, the Court reasoned that “we cannot simply presume a material risk of concrete harm.” Id. at 438. Thus, the Court held that the risk of future harm, standing alone, cannot constitute an injury-in-fact for Article III purposes in a lawsuit seeking damages. See id. 435-38.
¶26 In the wake of the Court’s TransUnion decision, the Seventh Circuit has recognized that “TransUnion marked a shift in the Court’s standing jurisprudence.” Dinerstein v. Google, LLC, 73 F.4th 502, 516 (7th Cir. 2023); see also Ewing v. MED-1 Sols., LLC, 24 F.4th 1146, 1152 (7th Cir. 2022) (“TransUnion makes clear that a risk of future harm, without more, is insufficiently concrete to permit standing to sue for damages in federal court.”).
12 No. 2024AP1882
Subsequent cases have applied TransUnion to data breach claims, emphasizing the need for allegations of actual data misuse to establish standing. See, e.g., Pulliam v. West Tech. Grp., LLC, No. 23-CV-159, 2024 WL 356777, at *7 (D. Neb. Jan. 19, 2024) (stating that plaintiffs’ “claims of a substantial risk of future injury due to [a] data breach are either conclusory or speculative”); Kim v. McDonald’s USA, LLC, No. 21-CV-05287, 2022 WL 4482826, at *5 (N.D. Ill. Sept. 27, 2022) (dismissing claims for lack of standing where “none of the [p]laintiffs have alleged that they, in fact, fell victim to a phishing scam or otherwise had their identities stolen”); Legg v. Leaders Life Ins. Co., 574 F. Supp. 3d 985, 993 (W.D. Okla. 2021) (“Given the holding in TransUnion, it is far from clear that any case finding a concrete injury based merely on an abstract risk of future identity theft following a data breach is still good law, at least with respect to a claim for damages.”).
¶27 Based on our review of the above authorities, we are persuaded that the risk of future harm and the actions taken to protect against that risk, as alleged by the Employees in this case, remain too attenuated and speculative to confer standing to pursue their claims, absent a demonstration that identity theft or data misuse has already occurred. Without allegations of any previous identity theft or data misuse suffered by themselves or any other members of the class, the Employees have failed to allege sufficiently imminent or certainly impending future injury. Cf. Attias v. CareFirst, Inc., 865 F.3d 620, 627 (D.C. Cir. 2017) (“Nobody doubts that identity theft, should it befall one of these plaintiffs, would constitute a concrete and particularized injury.”). Here, the Employees have established only a “mere possibility of future harm.” See Hennekens, 160 Wis. 2d at 153; see also Tietsworth v. Harley-Davidson, Inc., 2004 WI 32, ¶17, 270 Wis. 2d 146, 677 N.W.2d 233 (“Actual damage is harm that has already occurred
13 No. 2024AP1882
or is ‘reasonably certain’ to occur in the future. Actual damage is not the mere possibility of future harm.” (citations omitted)).
¶28 We pause to further discuss the Employees’ claims for declaratory and injunctive relief. The power of courts to issue a declaratory judgment is found under the uniform declaratory judgments act, pursuant to which a circuit court “shall have power to declare rights, status, and other legal relations whether or not further relief is or could be claimed.” WIS. STAT. § 806.04(1) (2023-24). “A court must be presented with a justiciable controversy before it may exercise its jurisdiction over a claim for declaratory judgment.” Olson v. Town of Cottage Grove, 2008 WI 51, ¶28, 309 Wis. 2d 365, 749 N.W.2d 211; see also Milwaukee Dist. Council 48 v. Milwaukee County, 2001 WI 65, ¶37, 244 Wis. 2d 333, 627 N.W.2d 866 (discussing the standard to apply to determine whether there is a justiciable controversy). “Injunctive relief may be granted in aid of a declaratory judgment.” Lewis v. Young, 162 Wis. 2d 574, 581, 470 N.W.2d 328 (Ct. App. 1991). “To obtain injunctive relief, a party must generally show: (1) sufficient probability that future conduct will violate a right and cause injury; (2) that the injury will be irreparable; and (3) that no adequate remedy exists at law for the injury.” Teague v. Schimel, 2017 WI 56, ¶122, 375 Wis. 2d 458, 896 N.W.2d 286.
¶29 The Employees argue that “[a] declaratory judgment does not require that an injury is suffered before seeking relief and [the Employees] have sufficiently proven the threat of future harm.” See Milwaukee Dist. Council 48, 244 Wis. 2d 333, ¶41. However, even if FMG was negligent by failing to adequately protect the Employees’ data, the Employees have not sufficiently alleged that they face an imminent risk of future harm as a result of the data breach in this case.
14 No. 2024AP1882
¶30 We agree with the circuit court that “it is unclear how the injunction that [the Employees] seek would have any effect on the harm that [they] fear may result from the data breach itself” because their “personal information has already been illicitly accessed”; therefore, “no present change in FMG’s policies and practices can put the genie back in the bottle.” The Employees acknowledge that FMG has already “taken some measures to contain the breach,” which finds support in the notice FMG provided to the Employees, but they essentially request that the court order FMG take additional mitigation action. The Employees do not explain, however, how requiring FMG to implement new data security practices would protect against the future risk of the data that was already subject to the data breach being misused. See Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365, 378 (1st Cir. 2023) (“[A]n injunction requiring [the defendant] to improve its cybersecurity systems cannot protect the plaintiffs from future misuse of their [personal information] by the individuals they allege now possess it.”). Any such relief would safeguard only against a future breach.
¶31 Beyond their conclusory statements alleging an increased risk of a future breach, which are undermined by the Employees’ recognition that FMG has already taken some action to prevent further data breaches, the Employees do not and cannot allege that FMG is subject to a different or an increased risk of a cyberattack as compared to other organizations. As the First Circuit Court of Appeals explained, “If that risk were deemed sufficiently imminent to justify injunctive relief, virtually every company and government agency might be exposed to requests for injunctive relief like the one the plaintiffs seek here.” Id.
¶32 We also separately mention the Employees’ unjust enrichment claim, which differs from their other claims given that damages or an injury are not specifically a required element. See Tri-State Mech., Inc. v. Northland Coll.,
15 No. 2024AP1882
2004 WI App 100, ¶14, 273 Wis. 2d 471, 681 N.W.2d 302 (outlining the elements of an unjust enrichment claim); Management Comput. Servs. v. Hawkins, Ash, Baptie & Co., 206 Wis. 2d 158, 188, 557 N.W.2d 67 (1996) (“[U]njust enrichment is based on equitable principles, with damages being measured by the benefit conferred upon the defendant, not the plaintiff’s loss.”). Here, the Employees lack standing to pursue their unjust enrichment claim because they have not alleged facts demonstrating that they conferred any cognizable benefit upon FMG. Furthermore, the Employees’ complaint asserts what appear to be legal conclusions or speculation rather than factual allegations.
¶33 Wisconsin law requires a direct, material benefit retained by FMG before equity will intervene, and the exchange of routine employment information does not constitute such a benefit. See Reetz, 405 Wis. 2d 298, ¶29 (“To find that a benefit was conferred upon Aurora by Reetz would mean that it was to Aurora’s benefit for Reetz to provide her [personally identifiable information]—rather, at best we could reasonably infer that Aurora needed Reetz’s [information] to comply with federal and state regulations of employers.”). Under the circumstances, we conclude that this claim, which sounds in equity, fails to satisfy the elements necessary to confer standing under Wisconsin law. See Foley-Ciccantelli, 333 Wis. 2d 402, ¶5.
¶34 Therefore, due to the Employees’ overall failure to allege a concrete and particularized injury as a result of the data breach, we conclude that the Employees lack standing to assert any of their claims against FMG. As explained above, and as relevant here, Wisconsin law determines standing by investigating “whether the interest of the party whose standing is challenged will be injured, that is, adversely affected” and “whether judicial policy calls for protecting the interest of the party whose standing has been challenged.” See Foley-Ciccantelli, 333
16 No. 2024AP1882
Wis. 2d 402, ¶5. “When no statute, rule, or constitutional provision directly governs the standing analysis, a court determines these … aspects of standing by examining the facts to determine whether an injured interest exists that falls within the ambit of relevant legal principles that judicial policy calls for protecting.” Id., ¶6. Based on the facts presented in their complaint, the Employees have failed to demonstrate an “injured interest” for any of their claims in this case. See id. Put another way, judicial policy does not support extending protection to a wholly speculative future risk of identity theft, no matter how the Employees attempt to frame the claim. Thus, the Employees lack standing to bring the claims in this case, and the circuit court properly granted FMG’s motion to dismiss.5
By the Court.—Order affirmed.
Not recommended for publication in the official reports.
5 Because we conclude that the Employees lack standing to assert their claims, we need not address whether the Employees failed to state a claim for relief on their asserted causes of action. See Turner v. Taylor, 2003 WI App 256, ¶1 n.1, 268 Wis. 2d 628, 673 N.W.2d 716 (noting that we need not address all issues when the resolution of one of those issues is dispositive).
We note, however, that under the facts of this unique case, the basis for the lack of standing—i.e., a lack of a demonstrated injury or damages—also provides a basis to affirm the circuit court’s conclusion that the Employees failed to state a claim for relief. Most of the claims the Employees assert have an element requiring a showing of an injury, imminent harm, or damages. See Gritzner v. Michael R., 2000 WI 68, ¶19, 235 Wis. 2d 781, 611 N.W.2d 906 (common law negligence); Brew City Redevelopment Grp., LLC v. Ferchill Grp., 2006 WI App 39, ¶11, 289 Wis. 2d 795, 714 N.W.2d 582 (breach of contract); Berner Cheese Corp. v. Krug, 2008 WI 95, ¶40, 312 Wis. 2d 251, 752 N.W.2d 800 (breach of fiduciary duty); Olson v. Town of Cottage Grove, 2008 WI 51, ¶28, 309 Wis. 2d 365, 749 N.W.2d 211 (declaratory judgment requires “justiciable controversy”); Teague v. Schimel, 2017 WI 56, ¶122, 375 Wis. 2d 458, 896 N.W.2d 286 (injunctive relief). For the reasons stated above, the Employees could not and did not plead an injury, imminent harm, or damages.