PANIGHETTI v. INTELLIGENT BUSINESS SOLUTIONS, INC.

• Court: District Court, M.D. North Carolina
• Decided: June 30, 2025
• Docket: 1:23-cv-00209
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE MIDDLE DISTRICT OF NORTH CAROLINA

DANIEL PANIGHETTI, individually and ) on behalf of all others similarly situated, ) ) Plaintiff, ) ) 1:23CV209 v. ) ) INTELLIGENT BUSINESS ) SOLUTIONS, INC. ) ) Defendant. )

MEMORANDUM OPINION AND ORDER LORETTA C. BIGGS, District Judge. Daniel Panighetti, (“Plaintiff”), brought this action, individually and on behalf of all others similarly situated, against Intelligent Business Solutions, Inc., (“Defendant”). (ECF No. 1 at 1.) Plaintiff alleges 7 causes of action stemming from alleged injuries following a data breach. (Id. ¶ 5, 83–162.) Before the Court is Defendant’s Motion to Dismiss. (ECF No. 7). For the reasons stated herein, Defendant’s motion will be granted. I. BACKGROUND Defendant is a North Carolina corporation that collects and maintains personal identifiable information (“PII”) and protected health information (“PHI”) for its clients. (ECF No. 1 ¶ 1, 2.) Defendant’s clients are healthcare entities like Lankenau Medical Center and Southern Ohio Medical Center. (Id. ¶¶ 1, 13.) Plaintiff was a patient at a hospital that Defendant provides services for from January to March 2021. (Id. ¶ 32.) Around November 14, 2022, Defendant became aware that its network was hacked by an “unauthorized actor” The hack exposed the PII and PHI of current and former patients of Defendant’s clients. (Id. ¶ 21.) The compromised information included: names, social security numbers, dates of birth, health insurance information, medical treatment information., and medical procedure information. (Id. ¶ 20.) The number of impacted patients is estimated to be 11,595. (Id. ¶ 21.) Plaintiff alleges that Defendant notified impacted individuals 87 days after it gained

knowledge of the data breach. (Id. ¶ 23.) Plaintiff received a Notice of Data Breach in February 2023. (Id. ¶ 35.) Plaintiff alleges that in this notification Defendant “created a present, continuing, and significant risk of suffering identity theft.” (Id. ¶ 25.) Plaintiff further alleges that Defendant warned those effected to “remain vigilant for incidents of fraud and identity theft,” “review[] account statements and monitor[] free credit reports,” and “place an initial or extended ‘fraud

alert’ on a credit file.” (Id. (alterations in original)) Due to this data breach, on March 7, 2023, Plaintiff brought this suit alleging 7 causes of action. (See generally id.) Plaintiff alleges negligence, negligence per se, breach of implied contract, intrusion upon seclusion/invasion of privacy, unjust enrichment, and a violation of the North Carolina Unfair Trade Practices Act. (Id. ¶¶ 83–162.) Defendant filed the instant motion to dismiss arguing that Plaintiff lacks Article III standing to bring this case before the

Court, and that Plaintiff has failed to plead facts sufficient to state a claim for relief. (ECF No. 8 at 7.) The Court will address each argument in turn. II. STANDARD OF REVIEW A. Rule 12(b)(1) Under Rule 12(b)(1), a party may seek dismissal based on a court’s “lack of subject matter jurisdiction.” Fed. R. Civ. P. 12(b)(1). A motion under Rule 12(b)(1) raises the question has the power to hear and dispose of [the] claim.” Holloway v. Pagan River Dockside Seafood, Inc., 669 F.3d 448, 452 (4th Cir. 2012). A defendant may present a motion to dismiss for lack of subject matter jurisdiction either by contending that the complaint does not sufficiently allege jurisdiction, or by contending that the allegations in the complaint are not true. Adams v. Bain, 697 F.2d 1213, 1219 (4th Cir. 1982). Unless a defendant pursues the latter method and attacks

the truth of the allegations, a court takes them as true and “in effect, . . . afford[s] the same procedural protection as [the plaintiff] would receive under a Rule 12(b)(6) consideration.” Id. A court should grant a motion under Rule 12(b)(1) “only if the material jurisdictional facts are not in dispute and the moving party is entitled to prevail as a matter of law.” Richmond, Fredericksburg & Potomac R.R. Co. v. United States, 945 F.2d 765, 768 (4th Cir. 1991). B. Rule 12(b)(6)

A motion made under Rule 12(b)(6) challenges the legal sufficiency of the facts in the complaint, specifically whether the complaint satisfies the pleading standard under Rule 8(a)(2). Francis v. Giacomelli, 588 F.3d 186, 192 (4th Cir. 2009). Rule 8(a)(2) requires a “short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). “[A] complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting

Bell Atl. Corp. v. Twombly, 550 U.S 544, 570 (2007)). A claim is plausible when the complaint alleges sufficient facts to allow “the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Johnson v. Am. Towers, LLC, 781 F.3d 693, 709 (4th Cir. 2015) (quoting Iqbal, 556 U.S. at 678). The court “view[s] the complaint in a light most favorable to the plaintiff.” Mylan Lab’ys, Inc. v. Matkari, 7 F.3d 1130, 1134 (4th Cir. 1993). When considering a motion to dismiss, “a [district] court evaluates the complaint in its entirety, as well as documents attached [to] or incorporated into the complaint.” E.I. du Pont de Nemours & Co. v. Kolon Indus., Inc., 637 F.3d 435, 448 (4th Cir. 2011). Generally, on a Rule 12(b)(6) motion to dismiss, a court cannot consider documents beyond the complaint without converting the motion into a motion for summary judgment. See Occupy Columbia v. Haley, 738

F.3d 107, 116 (4th Cir. 2013). The court can, however, properly consider documents attached to or referenced in the complaint, as well as those attached to the motion to dismiss, so long as those documents are “integral to and explicitly relied on in the complaint.” Am. Chiropractic Ass’n v. Trigon Healthcare, Inc., 367 F.3d 212, 234 (4th Cir. 2004) (quoting Phillips v. LCI Int’l, Inc., 190 F.3d 609, 618 (4th Cir. 1999)). III. DISCUSSION

Defendant argues that Plaintiff lacks Article III standing to bring this case because he is not able to “plead facts that show there was actual misuse of data that resulted in identity theft, fraud, or another concrete injury-in-fact.” (ECF No. 8 at 7.) Plaintiff counters that he has standing to sue because the data breach “harmed him, will harm him again, and requires him to expend resources mitigating that harm.” (ECF No. 9 at 9.) Plaintiff states that these harms “confer standing under Fourth Circuit standing.” (Id.)

Article III of the Constitution “limits the jurisdiction of federal courts to ‘Cases’ and ‘Controversies,’” Beck v. McDonald, 848 F.3d 262, 269 (4th Cir. 2017) (quoting U.S. Const. art. III, § 2), and the doctrine of standing derives from that limitation, White Tail Park, Inc. v. Stroube, 413 F.3d 451, 458 (4th Cir. 2005). Standing ensures that a plaintiff has “a personal stake in the outcome of the controversy” that is sufficient to warrant the “invocation of federal-court jurisdiction.” Summers v. Earth Island Inst., 555 U.S. 488, 493 (2009) (citation and internal quotation marks omitted). To establish Article III standing, a plaintiff must demonstrate (1) an injury in fact; (2) causation; and (3) redressability. David v. Alphin, 704 F.3d 327, 333 (4th Cir. 2013) (citations omitted). When evaluating a class action complaint, the court must “analyze standing based

on the allegations of personal injury made by the named plaintiffs.” Beck, 848 F.3d at 269. “At the pleading stage, general factual allegations of injury resulting from the defendant’s conduct may suffice, for on a motion to dismiss we presume that general allegations embrace those specific facts that are necessary to support the claim.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 561 (1992) (internal quotation marks omitted) (citation omitted). Therefore, Plaintiff’s allegations for which there is sufficient “factual matter” to render them “plausible on [their]

face” are accepted as true. Beck, 848 F.3d at 270 (quoting Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)). To establish injury in fact, a plaintiff must show that he or she suffered an invasion of a legally protected interest which is concrete, particularized, and actual or imminent. Lujan, 504 U.S. at 560 (quoting Whitmore v. Arkansas, 495 U.S. 149, 155 (1990) (additional citations omitted). “A ‘concrete’ injury must be ‘de facto’; that is, it must actually exist.” Spokeo, Inc. v.

Robins, 578 U.S. 330, 340 (2016) (citation omitted). Here, Plaintiff argues that injury in fact exists because the breach: (1) “exposed his medical records, thus invading his privacy”; (2) “exposed . . . information criminals can use to commit fraud and steal his identity”; (3) required him to “spend resources to mitigate [the] risk”; and (4) caused him to “suffer from anxiety, sleep disruption, stress, fear, and frustration.”

(ECF No. 9 at 10–11.) There are two Fourth Circuit cases that outline the type of injury needed to confer standing in a data breach case. In the first case, Beck v. McDonald, the court considered two consolidated appeals brought by plaintiffs who experienced a data breach at the medical center from which they received treatment. 848 F.3d at 266. Plaintiffs in Beck sought to establish Article III standing based on alleged harm from the increased risk of future identity theft and

the cost of measures to protect against it. Id. at 266–67. In the first of the consolidated cases in Beck, a laptop containing unencrypted personal information of thousands of patients was misplaced or stolen and the district court granted defendant’s motion for summary judgment. Id. at 267–68. In the second consolidated case, four boxes, containing identifying information of patients, had been misplaced or stolen and the district court granted defendant’s motion to dismiss. Id. at 268–69. The Fourth Circuit

affirmed the district court’s findings that standing was not present in either case. Id. at 278. The Fourth Circuit found that the plaintiffs “theory is too speculative to constitute injury in fact.” Id. at 274. Plaintiffs failed to show that the information was accessed or misused, that they suffered from identity theft, or that the thief stole the laptop or boxes with the intent to steal their private information. Id. 274–75. “[M]ere theft of these items, without more, cannot confer Article III standing.” Id. at 275.

The second Fourth Circuit case, Hutton v. Nat’l Bd. Of Exam’rs in Optometry, Inc., involved two consolidated appeals brought by plaintiffs whose personal information was allegedly stolen after the National Board of Examiners in Optometry (“NBEO”) suffered a data breach. 892 F.3d 613, 616. Plaintiffs in those cases submitted their personal information to the NBEO when registering to take a professional optometry licensure examination. Id. at 617, 618. Both

plaintiffs experienced fraudulent activity following the breach as they were notified that someone applied for credit cards using their personal information. Id. at 618. The district court dismissed the cases for lack of subject matter jurisdiction, based on failure to establish standing. Id. at 616. The Fourth Circuit vacated the district court’s opinion and found that plaintiffs sufficiently alleged an imminent threat of injury to satisfy standing. Id. at 622. The circuit

court distinguished Hutton from Beck because while in Beck the plaintiffs only alleged a threat of future injury, in Hutton the plaintiffs were concretely injured by the data breach. Id. 621– 22. The court also stated that plaintiffs in Hutton had standing to assert a claim of incurring costs to mitigate future theft because their injury was not speculative. Id. at 622. Here, Plaintiffs Complaint is more akin to Beck than Hutton. Unlike in Hutton, Plaintiff does not allege that he was the victim of identity theft or fraud, as nowhere in his Complaint

are there allegations that Plaintiff’s PII was used. See Krohm v. Epic Games, Inc., 408 F. Supp. 3d 717, 720 (E.D.N.C. Oct. 1, 2019) (“plaintiff's complaint contains no facts showing, or even suggesting, that his personal data has been used as a result of the cyber vulnerability.”). Further, Plaintiff’s argument that his alleged risk of future harm is sufficient injury to confer standing fails. Plaintiffs have a burden to “plausibly plead factual allegations . . . sufficient to show that the threatened harm of future identity theft was certainly impending.”

Beck, 848 F.3d at 275 (internal quotations omitted). Similar to the plaintiffs in Beck, Plaintiff failed to allege any actual misuse of his information. See id. at 272. Additionally, Plaintiff’s allegations that he spent resources to mitigate the risk the breach caused does not confer standing as his injury is only speculative. In Hutton the Fourth Circuit found that mitigating efforts by plaintiffs established injury in fact because the efforts

were in response to a substantial and sufficiently imminent risk of identity theft, “as evidenced by the existing misuse of their data.” 892 F.3d at 622. There are no allegations of misuse of data here, therefore Plaintiff’s injuries in mitigation were “manufacture[d] . . . by inflicting harm on [himself] based on [his] fears of hypothetical future harm that is not certainly impending.” Beck, 848 F.3d at 272 (internal quotations omitted) (citation omitted). Lastly, Plaintiff alleges that he has standing because the data breach caused him to

suffer emotional harm. (ECF No. 9 at 11.) “A plaintiff’s knowledge that he or she is exposed to a risk of future physical, monetary, or reputational harm could cause its own current emotional or psychological harm.” TransUnion LLC V. Ramirez, 594 U.S. 413, 436 n.7 (2021). The Supreme Court in TransUnion declined to take a position on how emotional harm could confer standing; however, the Fourth Circuit in Beck rejected Plaintiff’s claim that “emotional upset” and “fear of identity theft and financial fraud” are sufficient to confer standing. 848

F.3d at 272; TransUnion, 594 U.S. at 436 n.7 (“We take no position on whether or how . . . an emotional or psychological harm could suffice for Article III purposes.”) Here, Plaintiff’s allegations of emotional harm are nothing more than bare assertions of possible or potential harm that could be caused by the fata breach. Plaintiff merely alleges that he “fears for his personal financial security” and he has “suffered and will continue to suffer from anxiety, sleep disruption, stress, fear, and frustration.” (ECF No. 1 ¶¶ 38, 39, 45.)

Plaintiff has therefore failed to allege an actionable injury in fact. See e.g., Stamat v. Grandizio Wilkins Little & Mattews, LLP, SAG-22-00747, 2022 WL 3919685, *7 (D.Md Aug. 31, 2022) (finding no standing where plaintiff merely alleged “emotional distress” and “lost time, annoyance, interference, and inconvenience”); Stuart v. Kyocera AVX Components Corp., 6:23- cv-06087, 2025 WL 745903, *9 (D.Sc Mar. 7, 2025) (finding no standing where plaintiff alleged

“significant fear, anxiety, stress, as well as loss of sleep”). Accordingly, this Court concludes that Plaintiff has not sufficiently alleged that he suffered an injury in fact, the first element required for this Court to have standing. Thus, having determined that the Court lacks standing, it follows that the Court does not have the power to address Defendant’s Motion to Dismiss for Failure to State a Claim. For the reasons stated herein, the Court enters the following:

ORDER IT IS THEREFORE ORDERED that Defendant’s Motion to Dismiss, (ECF No. 7), is GRANTED and this case is DISMISSED. This, the 30th day of June 2025.

/s/ Loretta C. Biggs Senior United States District Judge