FIFTH DIVISION MCFADDEN, P. J., HODGES and PIPKIN, JJ.
NOTICE: Motions for reconsideration must be physically received in our clerk’s office within ten days of the date of decision to be deemed timely filed. https://www.gaappeals.us/rules
October 6, 2025
In the Court of Appeals of Georgia
A25A1133. BLAND et al. v. UROLOGY OF GREATER ATLANTA, LLC.
MCFADDEN, Presiding Judge.
The plaintiffs in this putative class-action lawsuit stemming fron a data breach
appeal the dismissal of their complaint under OCGA § 9-11-12 (b) (6) for failure to
state a claim. Because it does not appear with certainty that the plaintiffs would be
entitled to no relief under any set of facts that could be proven in support of their
claims for negligence, breach of implied contract, breach of the implied covenant of
good faith and fair dealing, and injunctive relief, we reverse the trial court’s dismissal
of those claims. We affirm the trial court’s dismissal of the plaintiffs’ claim for unjust enrichment. Finally, we hold that the trial court judge did not abuse her discretion in
dismissing the unjust enrichment claim with prejudice.1
1. Background
(a) Legal principles applicable to motions to dismiss for failure to state a claim
“We review the grant of a motion to dismiss [for failure to state a claim] de
novo. And the well-established test that must be satisfied before a motion to dismiss
can be granted is a demanding one[.]” Norman v. Xytex Corp., 310 Ga. 127, 130-131 (2)
(848 SE2d 835) (2020) (citations and punctuation omitted). A trial court may grant
a motion to dismiss for failure to state a claim “when the plaintiff would not be
entitled to relief under any state of provable facts asserted in support of the allegations
in the complaint and could not possibly introduce evidence within the framework of
the complaint sufficient to warrant a grant of the relief sought.” Collins v. Athens
Orthopedic Clinic, 307 Ga. 555, 560 (2) (a) (837 SE2d 310) (2019) (citation and
punctuation omitted). See also OCGA § 9-11-12 (b) (6). The court must construe
1 Oral argument was held in this case on June 2, 2025, and is archived on the court’s website. See Court of Appeals of Georgia, Oral Argument, Case No. A25A1133 (June 2, 2025), available at https://vimeo.com/1091265038. 2 “any doubts regarding the complaint . . . in favor of the plaintiff.” Norman, 310 Ga.
at 131 (2).
Under Georgia law, a complaint must only “give the defendant fair notice of
what the claim is and a general indication of the type of litigation involved; the
discovery process bears the burden of filling in details.” Dillingham v. Doctors Clinic,
236 Ga. 302, 303 (223 SE2d 625) (1976). For this reason, the “Georgia test is more
difficult for movants to pass than the equivalent federal test, because the federal test
imposes on plaintiffs a more stringent pleading standard.” Norman, 310 Ga. at 131 n.
4 (2) (citations and punctuation omitted). See generally Ashcroft v. Iqbal, 556 U.S. 662,
679 (IV) (A) (129 SCt 1937, 173 LE2d 868) (2009) (under federal law, legal
conclusions recited in complaint “must be supported by factual allegations” that
“plausibly give rise to an entitlement to relief”). Similarly, while “evidence beyond
mere allegations [is] required in order for the claimants to prevail” on a summary
judgment motion, “[n]ot so” for motions to dismiss for failure to state a claim.
Collins, 307 Ga. at 560 (1) (a) (emphasis omitted).
(b) On information and belief
3 Before we set forth the allegations in the plaintiffs’ complaint, we address an
argument made by the appellee that concerns the complaint’s allegations generally.
The appellee argues that the plaintiffs’ allegations made on information and belief
should be disregarded. In support of this argument, it cites a Georgia Supreme Court
opinion from 1936, Nance v. Daniel, 183 Ga. 538 (189 SE 21) (1936), in which the court
affirmed a trial court’s ruling sustaining a general demurrer, in part because the
plaintiffs “allege[d] only the plaintiffs’ information and belief that the defendant
expect[ed] and intend[ed] to comply with [a certain] proclamation, without averring
as a fact that he expect[ed] and intend[ed] to do so.” Id. at 543. The court held that
“[t]he pleader must allege the fact on information and belief, and not that he is
informed and believes that the fact exists.” Id.
But in Tate v. Potter, 216 Ga. 750, 751-752 (1) (a) (119 SE2d 547) (1961), the
court explained that a plaintiff’s claim was sufficiently alleged when an allegation was
a “positive averment[ ] of facts based upon information and belief, presumptively not
within the knowledge of the plaintiff.” Accord McLemore v. Life Ins. Co., 117 Ga. App.
155, 158 (2) (159 SE2d 480) (1968) (“While an allegation that one is informed and
believes a fact exists is a mere statement as to one’s information and belief and is not
4 equivalent to a positive allegation of the fact itself, an allegation of fact on information
and belief is sufficient.”) (citation and punctuation omitted). Such is the case here.
In any event, Nance was decided before the enactment of the Civil Practice Act.
Pre-Act complaints were
construed most strongly against the pleader when considered on general demurrer and in light of its omissions as well as its averments. If an inference unfavorable to the pleader could be fairly drawn from the facts alleged, that inference would prevail in determining the rights of the parties. The Civil Practice Act changed these rules. . . . On a motion to dismiss, a complaint should be construed in the light most favorable to plaintiff with all doubts resolved in his favor.
Harper v. Defreitas, 117 Ga. App. 236, 237-238 (160 SE2d 260) (1968) (citations and
punctuation omitted). Notably, in an opinion decided after the enactment of the Civil
Practice Act, our Supreme Court reversed the dismissal for failure to state a claim a
petition for quo warranto, even though the petitioner’s crucial allegation that a judge
did not satisfy a residency requirement for holding office was made “on information
and belief.” Anderson v. Flake, 267 Ga. 498, 500 (480 SE2d 10) (1997). The court
applied the standard that we apply here and reversed the dismissal because it could not
“be said that, within the framework of the [p]etition, no evidence could be introduced
5 that would support a finding that at the time the [p]etition was filed, [the judge] did
not satisfy the residency requirement for holding office. . . .” Id. at 501 (2).
(c) The plaintiffs’ amended complaint and the procedural background
Viewed with these principles in mind, the following facts reflect the
well-pleaded allegations set forth in the amended complaint. The named plaintiffs,
Michael Bland and Cathy Kreider, provided the defendant, Urology of Greater
Atlanta, LLC, with highly sensitive, protected health information and personally
identifiable information in order to obtain services from or employment with the
defendant. The information that they provided included names, addresses, dates of
birth, dates of service, patient account numbers, diagnoses, treatments, social security
numbers, bank account information, and credit card numbers.
Beginning on August 8, 2021, unauthorized cybercriminals accessed from the
defendant’s computer system the sensitive information of more than 79,000
individuals, including the named plaintiffs. The cybercriminals took the information
to engage in identity theft or to sell it to other criminals who will engage in identify
theft. The plaintiffs allege on information and belief that the cybercriminals have
6 placed the information, including social security numbers, for sale on the so-called
dark web.2
The defendant learned of the data breach on August 29, 2021. Named plaintiff
Bland received a notice dated November 29, 2022, that his information was involved
in the data breach. Named plaintiff Kreider received a notice dated February 17, 2023,
that her information was involved in the breach.
Since receiving notice of the breach, the plaintiffs have spent time verifying the
impact of the data breach, exploring credit-monitoring and identify-theft-insurance
options, and monitoring their accounts. They have suffered actual identify theft and
out-of-pocket expenses, among other damages. Further, the breach has diminished the
value of their protected health information and personally identifiable information.
They are at imminent risk of additional harms and damages.
The plaintiffs filed an amended complaint, alleging claims for negligence;
breach of implied contract; breach of the implied covenant of good faith and fair
2 The “dark web” is “the set of web pages on the World Wide Web that cannot be indexed by search engines, are not viewable in a standard Web browser, require specific means (such as specialized software or network configuration) in order to access, and use encryption to provide anonymity and privacy for users.” https://www.merriam-webster.com/dictionary/dark%20web (retrieved Sept. 24, 2025). 7 dealing; and unjust enrichment. They sought damages, injunctive relief, and attorney
fees. The defendant moved to dismiss the complaint under OCGA § 9-11-12 (b) (6)
on the ground that the plaintiffs failed to state a claim upon which relief can be
granted. The trial court granted the motion, and the plaintiffs filed this appeal.
2. Negligence
The plaintiffs argue that the trial court erred by dismissing their negligence
claim. We agree.
“[T]o recover for injuries caused by another’s negligence, a plaintiff must show
four elements: a duty, a breach of that duty, causation, and damages. In other words,
before an action for a tort will lie, the plaintiff must show he sustained injury or
damage as a result of the negligent act or omission to act in some duty owed to him.”
Collins, 307 Ga. at 557-558 (2) (citations and punctuation omitted). The trial court
dismissed the negligence claim on two grounds: that the plaintiffs failed to allege that
the defendant breached a duty of care and that they failed to allege a cognizable injury.
(a) Duty of care
A “duty can arise either from a valid legislative enactment, that is, by statute,
or be imposed by a common law principle recognized in the caselaw.” Rasnick v.
8 Krishna Hospitality, 289 Ga. 565, 566-567 (713 SE2d 835) (2011). The plaintiffs argue
that a duty arises from established negligence principles. See Collins, 307 Ga. at 563
n.7 (2) (noting that the court applied “traditional tort law” to a case involving a data
breach).
No Georgia appellate court has decided whether or not a duty arises under
traditional tort law principles in a data breach case involving employees and patients
of a medical practice, like this one. Cf. Collins, 307 Ga. at 563 (2) (“leav[ing] . . . for
another day” the issue of breach of duty in a data exposure case).
In the absence of Georgia authority we may consider persuasive federal court
decisions applying Georgia law in similar cases. Our Supreme Court did so in Collins.
307 Ga. at 564-565 (4).
In Ramirez v. The Paradies Shops, 69 F4th 1213 (11th Cir. 2023), the United
States Court of Appeals for the Eleventh Circuit determined that under principles of
Georgia tort law, an employer had a duty to protect its employees’ sensitive,
personally identifiable information from cybercriminals during a data breach, given the
allegations that the risk of a data breach was reasonably foreseeable. Id. at 1219-1221
(II) (A) (i), (ii) (“Without clear guidance from Georgia courts on the asserted duty to
9 safeguard [personally identifiable information], we must apply traditional tort law to
[the plaintiff’s] alleged injury to determine whether [the defendant] owed him a duty
of care.”) (citation and punctuation omitted).
We find the Eleventh Circuit’s analysis to be persuasive. That court held that
under Georgia law,
[a] person is under no duty to rescue another from a situation of peril which the former has not caused. But, if the defendant’s own negligence has been responsible for the plaintiff’s situation, a relation has arisen which imposes a duty to make a reasonable effort to give assistance, and avoid any further harm. In other words, traditional negligence principles provide that the creator of a potentially dangerous situation has a duty to do something about it so as to prevent injury to others[;] that is, the creator has a duty to eliminate the danger or give warning to others of its presence.
Ramirez, 69 F4th at 1219 (II) (A) (i) (citations, punctuation, and emphasis omitted).
The court held that “the scope of the duty owed by a defendant is generally
limited to reasonably foreseeable risks of harm.” Ramirez, 69 F4th at 1219 (II) (A) (i)
(citation and punctuation omitted). The court added that “while the intervening
criminal act of a third person will often insulate a defendant from liability for an
original act of negligence, that rule does not apply when the defendant had reason to
10 anticipate the criminal act.” Id. The court noted that while the defendant did not owe
a duty to all the world, it owed a duty of care to those with whom it had a special
relationship, such as the employer-employee relationship at issue there. Id. at 1220 (II)
(A) (ii) .
Applying these principles to the plaintiffs’ amended complaint, we hold that the
plaintiffs sufficiently allege that the defendant had a legal duty to protect their
personal information on the basis of the foreseeable risk of a data breach. The plaintiffs
allege that millions of healthcare records were unlawfully disclosed in hundreds of
data breaches in 2019 alone, and that such data breaches are increasingly common,
especially in healthcare entities. The plaintiffs allege that medical identity theft is a
growing crime. They allege that the defendant knew of the importance of safeguarding
their private information and the foreseeable consequences of a data breach. They
allege that the defendant could have prevented the data breach by properly securing
and encrypting its servers, but it failed to do so in spite of the repeated warnings and
alerts about protecting sensitive data and the prevalence of public announcements
about data breaches.
[D]ata breach cases present unique challenges for plaintiffs at the pleading stage [and w]e cannot expect a plaintiff in [these plaintiffs’]
11 position to plead with exacting detail every aspect of [the defendant’s] security history and procedures that might make a data breach foreseeable, particularly where the question of reasonable foreseeability of a criminal attack is generally for a jury’s determination rather than summary adjudication by the courts.
Ramirez, 69 F4th at 1220 (II) (A) (ii) (citation and punctuation omitted).
Viewing the allegations in the light most favorable to the plaintiffs, it cannot be
said that the plaintiffs would “not be able to introduce sufficient evidence [to support
a finding of duty] within the framework of the complaint.” Collins, at 563 (3). The
plaintiffs have sufficiently alleged a duty so as to survive the motion to dismiss.
(b) Cognizable injury
The plaintiffs argue that the trial court erred in dismissing their negligence
claim on the ground that they failed to allege a cognizable injury. We agree.
In Collins, our Supreme Court held that the plaintiffs’ allegations that
“criminals are now able to assume their identities fraudulently and that the risk of
such identity theft is imminent and substantial” were factual allegations that must be
accepted as true. 307 Ga. at 561 (2) (a) (punctuation omitted). And viewing those
12 allegations in the light most favorable to the plaintiffs, the court held, it could not be
said that the plaintiffs would “not be able to introduce sufficient evidence of injury
within the framework of the complaint.” Id. at 563 (3). See Tracy v. Elekta, Inc., 667
FSupp3d 1276, 1283 (III) (A) (1) (N.D. Ga. 2023) (“Collins [holds] that an injury
exists where, at the very least, criminals have hacked into a data system and exfiltrated
personally identifiable information and protected health information”).
Like the plaintiffs in Collins, the plaintiffs here allege that cybercriminals stole
a large amount of their personal data by infiltrating the defendant’s network; ; that the
cybercriminals offered at least some of the data for sale; that unauthorized individuals
can now access the plaintiffs’ information; and that the plaintiffs are at risk of
“imminent and impending injury arising from the substantially increased risk of fraud,
identity theft and misuse [because their protected information was] placed in the
hands of unauthorized third parties/criminals.” The plaintiffs sufficiently alleged a
cognizable injury. See Collins, 307 Ga. at 562 (2) (b).
As the plaintiffs’ have pled a legally cognizable injury so as to survive a motion
to dismiss, we do not address the correctness of the trial court’s specific reasoning
regarding the potential categories of damages the plaintiffs have alleged.
13 In sum, under our de novo review, “we cannot say that the plaintiffs will not be
able to introduce sufficient evidence of [duty and] injury within the framework of the
complaint. . . . [Their] allegations are sufficient to survive a motion to dismiss the . .
. negligence claims.” Collins, 307 Ga. at 563 (3).
3. Breach of an implied contract
The plaintiffs argue that the trial court erred by dismissing their claim for
breach of an implied contract for data security. We agree.
“A contract is an agreement between two or more parties for the doing or not
doing of some specified thing.” OCGA § 13-1-1. “To constitute a valid contract, there
must be parties able to contract, a consideration moving to the contract, the assent of
the parties to the terms of the contract, and a subject matter upon which the contract
can operate.” OCGA § 13-3-1. “[C]ontracts implied in fact depend upon the will of
the parties to be bound, indicated . . . by circumstances from which assent may be
inferred as a conclusion of fact.” Butts County v. Jackson Banking Co., 129 Ga. 801,
808 (60 SE 149) (1908).
The trial court held that the plaintiffs failed to establish the existence of an
implied contract, because they failed to identify any facts that show that the defendant
14 assented to an obligation to safeguard their information. We hold that plaintiffs have
alleged circumstances under which they could introduce evidence within the
framework of the complaint from which a factfinder could infer the defendant’s
assent.
The plaintiffs allege that they and the defendant entered into implied contracts
for the provision of medical services, as well as implied contracts for the defendant to
implement data security adequate to safeguard and protect the privacy of the
plaintiffs’ personal information. The plaintiffs allege that they paid money and gave
their private information in exchange for the defendant’s services or as a condition of
their employment.
They allege that they relied on the defendant’s privacy notice, which included
promises that the defendant would implement reasonable and adequate data security
safeguards and would not disclose their private information to anyone, outside of
certain, specific circumstances.3
3 The plaintiffs’ allegations in support of the breach-of-implied-contract claim largely focus on their providing personal information in order to seek medical services rather than employment, even though they also assert that the representative plaintiffs provided their personal information “as required to obtain services and/or employment” from the defendant. But the defendant does not argue on appeal any distinction between plaintiffs who sought medical services and plaintiffs who sought 15 Our role at this stage is not to decide whether the privacy notice alone
demonstrates the defendant’s assent to a contractual obligation to protect the
plaintiffs’ personal information. We simply must decide whether the plaintiffs could
possibly introduce evidence “within the framework of the complaint sufficient to
warrant a grant of the relief sought.” Collins, 307 Ga. at 560 (2) (a) (citation and
punctuation omitted). We cannot say that, within the framework of the complaint, the
plaintiffs could not possibly introduce evidence of “circumstances from which assent
may be inferred as a conclusion of fact.” Butts County, 129 Ga. at 808. See Hummel
v. Teijin Auto. Techs., 23-CV-10341, 2023 U.S. Dist. LEXIS 167438, 2023 WL
6149059, at *11 (IV) (B) (ii) (E.D. Mich. Sept. 20, 2023) (“it is incredibly difficult to
imagine, how, in our day and age of data and identity theft, the mandatory receipt of
(personal information) would not imply the recipient’s assent to protect the
information sufficiently”) (citation and punctuation omitted).
employment. So we do not make such a distinction at this stage of the proceedings. Additionally, in two paragraphs of this count of the complaint the plaintiffs refer to the defendant as “BMC” instead of Urology of Greater Atlanta or “UGA,” as they do elsewhere. But the trial court did not dismiss for this reason, and the defendant does not argue any issue related to the defendant’s name. 16 To the extent the trial court dismissed the breach-of-implied-contract claim on
the ground that the plaintiffs failed to allege a cognizable injury, the trial court erred
as discussed in Division 2 (b), supra.
4. Breach of the implied duty of good faith and fair dealing
The plaintiffs argue that the trial court erred by dismissing their claim for
breach of the implied duty of good faith and fair dealing. We agree.
The trial court dismissed this claim because it is derivative of the dismissed
breach-of-an-implied contract claim. Because we reverse the dismissal of the breach-
of-an-implied-contract claim, we also reverse the dismissal of this claim. See TechBios
v. Champagne, 301 Ga. App. 592, 595 (1) (c) (688 SE2d 378) (2009).
5. Unjust enrichment
The plaintiffs argue that the trial court erred in dismissing their claim for unjust
enrichment.4 We disagree.
“Unjust enrichment is an equitable concept and applies when as a matter of fact
there is no legal contract but when the party sought to be charged has been conferred
4 In this count, too, the plaintiffs’ allegations focus on their paying for medical services rather than their employment, although they asserted the unjust enrichment claim on behalf of the entire proposed class. 17 a benefit by the party contending an unjust enrichment which the benefitted party
equitably ought to return or compensate for.” St. Paul Mercury Ins. Co. v. Meeks, 270
Ga. 136, 137 (1) (508 SE2d 646) (1998) (citation and punctuation omitted).
In this count of the complaint, the plaintiffs allege that the defendant “obtained
a benefit by unduly taking advantage of” the plaintiffs. Although they allege that they
entrusted their information to the defendant, they do not allege that this benefitted the
defendant. “For example, [they] do not allege that [the defendant] used or sold [the
information] for a profit.” Brooks v. Peoples Bank, 732 FSupp3d 765, 782 (III) (B) (6)
(S.D. Ohio 2024).
Instead, the plaintiffs allege that they reasonably believed the defendant would
keep their information safe; that the defendant was aware of this belief; that the
defendant failed to disclose the vulnerabilities of its data security; and so that the
defendant denied the plaintiffs the ability to make an informed purchasing decision.
These allegations do not allege a benefit conferred upon the defendant and thus do not
state a claim for unjust enrichment. The trial court did not err in dismissing this claim.
6. Injunctive relief
18 The plaintiffs argue that the trial court erred by dismissing their prayer for
injunctive relief. We agree.
OCGA § 9-5-1 provides, “Equity, by a writ of injunction, may restrain
proceedings in another or the same court, a threatened or existing tort, or any other
act of a private individual or corporation which is illegal or contrary to equity and good
conscience and for which no adequate remedy is provided at law.” “[A] person
exposed to a risk of future harm may pursue forward-looking, injunctive relief to
prevent the harm from occurring, at least so long as the risk of harm is sufficiently
imminent and substantial.” TransUnion v. Ramirez, 594 U.S. 413, 435 (III) (A) (2)
(141 SCt 2190, 210 LE2d 568) (2021).
The trial court dismissed the prayer for injunctive relief for three reasons: 1)
given the dismissal of the plaintiffs’ claims, the prayer for injunctive relief was
untethered to any valid cause of action; 2) the plaintiffs failed to allege how the
injunctive relief they sought would prevent the harm they sought to prevent; and 3)
the plaintiffs have an adequate remedy of law, given their allegations of monetary
damages.
19 Because we reverse the dismissal of the plaintiffs’ claims for negligence, breach
of an implied contract, and breach of the duty of good faith, we reject the trial court’s
first reason for dismissing the prayer for injunctive relief.
As for the second reason, the plaintiffs allege that their information remains in
the defendant’s possession and that its computer systems and networks are
inadequately protected. They allege that their information is subject to further
unauthorized disclosures as long as the defendant does not undertake appropriate
protective measures. They allege that further unauthorized access by more
cybercriminals is imminent. We hold that these allegations — taken as true — are
sufficient to survive the defendant’s motion to dismiss. See In re Equifax, Inc.,
Customer Data Sec. Breach Litig., 371 FSupp3d 1150, 1184 (I) (I) (N.D. Ga. 2019)
(applying Georgia law and denying motion to dismiss claim for injunctive relief
because plaintiffs’ allegations that defendant’s “cybersecurity systems remain
inadequate, and another breach is imminent” were “sufficient at this stage”).
As for the trial court’s third reason, given the prospective nature of the harm,
the fact that damages could be available should another data breach occur may not
amount to an adequate remedy of law. “[T]his matter is at the pleading stage and the
20 . . . plaintiffs are permitted to seek alternative remedies at this time.” Miller v.
NextGen Healthcare, 742 FSupp3d 1304, 1325 (III) (I) (iii) (N.D. Ga. 2024).
7. Dismissal with prejudice
The plaintiffs argue that the trial court erred by dismissing their complaint with
prejudice instead of allowing them to amend. “Under Georgia law, dismissals on the
merits, including dismissals for failure to state a claim, are typically with prejudice.”
Azizan v. Hajianbarzi, 372 Ga. App. 396, 398 n.5 (1) (903 SE2d 677) (2024). See also
OCGA § 9-11-41 (b). The plaintiffs have not shown that the trial court erred in
dismissing their unjust enrichment claim with prejudice. (Given our reversal of the
dismissal of the claims for negligence, breach of an implied contract, and breach of the
duty of good faith and fair dealing as well as the prayer for injunctive relief, this
argument pertains only to the claim for unjust enrichment.)
Judgment affirmed in part and reversed in part. Hodges and Pipkin, JJ., concur.