Renee Marie Brooks, Mia Foti, Cynthia Kehr, Barbara Sillimanguyer, and John Weltz, individually and on behalf of all others similarly situated v. Allegheny Health Network and IntraSystems, LLC

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF PENNSYLVANIA RENEE MARIE BROOKS, MIA ) FOTI, CYNTHIA KEHR, BARBARA ) ) 2:25-CV-125 SILLIMANGUYER, and JOHN ) WELTZ, individually and on behalf of ) all others similarly situated, ) ) Plaintiffs, ) ) v. ) ) ALLEGHENY HEALTH NETWORK ) ) and INTRASYSTEMS, LLC, ) ) Defendants. )

MEMORANDUM ORDER In 2024, a hacker accessed the data of 294,000 Allegheny Health Network patients. The hacker then posted the data for ransom on the so-called “dark web,” where the personal and confidential information of these AHN patients is still for sale. Plaintiffs—current and former AHN patients—have brought this putative class action against AHN and AHN’s IT vendor, IntraSystems, LLC, because of the data breach. AHN and IntraSystems move to dismiss. ECF 54; ECF 56. Both argue that Plaintiffs lack Article III standing and that Plaintiffs fail to otherwise state viable state-law claims. After careful review, the Court finds that Plaintiffs have standing. But not all of Plaintiffs’ claims are legally appropriate, so the Court grants in part and denies in part the motions to dismiss. For the reasons below, Plaintiffs’ claims for negligence (Count I), breach of fiduciary duty (Count II), breach of implied contract (Count III), unjust enrichment against AHN (Count V), and declaratory judgment (Count VI) survive with some modification. The Court dismisses Plaintiffs’ claims for breach of contracts to which Plaintiffs were third-party beneficiaries (Count IV), and unjust enrichment against IntraSystems (Count V). BACKGROUND AHN is a health network local to Pittsburgh that has 14 hospitals, over 200 primary and specialty care practices, over 300 clinical locations, and employs about 2,600 physicians. ECF 44 at ¶ 4. Patients must provide their health network with personal information for effective treatment, so AHN collects and stores information like patients’ names, dates of birth, addresses, SSNs, financial account numbers, and health insurance identification numbers. Id. at ¶ 1. Plaintiffs refer to this type of information as personally identifiable information (“PII”) and protected health information (“PHI”), and the Court does the same. AHN uses IntraSystems to secure and protect its patients’ PII and PHI. Id. at ¶ 6. On January 17, 2025, AHN announced in a press release that “IntraSystems experienced a cybersecurity incident that led to the unauthorized access to computer systems” which stored AHN’s patients’ PII and PHI. Id. at ¶ 58. According to that press release, the hack started on October 11, 2024, and AHN learned of the event on November 19, 2024. Id. at ¶ 61. The hack affected the PII and PHI of 294,000 AHN patients, including all named Plaintiffs. Id. at ¶¶ 9, 64. The hacker then took the stolen information and advertised it on the dark web. Id. at ¶ 11. A hacker called “LockBit3.0” ransomed Plaintiffs’ PII and PHI on February 27, 2025, where Plaintiffs’ information is still available as of the filing of this action. Id. at ¶¶ 79–80. All five named Plaintiffs share similar allegations. Each allege that their data was intentionally accessed, downloaded, and published for ransom to the dark web by a known hacker. ECF 62 at 5; see ECF 44 at ¶ 80 (“Anyone who can access the dark web can download Plaintiffs’ and Class Members’ PII and PHI. . . .”). And each allege that since learning of the hack, they have suffered from “stress, anxiety, worry, and fear.” ECF 44 at ¶¶ 98 (Brooks), 108 (Foti), 116 (Kehr), 124 (Silliman-Guyer), 132 (Weltz). With these facts, Plaintiffs are suing AHN and IntraSystems. Against both Defendants, Plaintiffs have claims for negligence (Count I), breach of contracts to which Plaintiffs were the third-party beneficiaries (Count IV), unjust enrichment (Count V), and declaratory judgment (Count VI). Against only AHN, Plaintiffs have claims for breach of fiduciary duty (Count II) and breach of implied contract (Count III). Both Defendants move to dismiss. ECF 54; ECF 56. The Court received full briefing on the motion (ECF 55; ECF 57; ECF 62; ECF 63; ECF 66; ECF 67), so both motions are ready for disposition. STANDARD OF REVIEW “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (cleaned up). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. Any reasonable inferences should be considered in the light most favorable to the plaintiff. See Lula v. Network Appliance, 255 F. App’x 610, 611 (3d Cir. 2007) (citing Rocks v. City of Phila., 868 F.2d 644, 645 (3d Cir. 1989)). DISCUSSION & ANALYSIS I. Plaintiffs have Article III standing. To establish standing under Article III, a plaintiff must have “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). “The plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing these elements.” Id. In a class action, each named plaintiff must have standing. See Lewis v. Gov’t Emps. Ins. Co., 98 F.4th 452, 459 (3d Cir. 2024). AHN and IntraSystems contend that this Court thus must separate out each of the five named Plaintiffs and analyze standing one by one. ECF 55 at 3; ECF 57 at 1. Sort of. When each plaintiff alleges roughly the same facts, a plaintiff-by-plaintiff analysis isn’t needed. See Tignor v. Dollar Energy Fund, Inc., 745 F. Supp. 3d 189, 200 (W.D. Pa. 2024) (Stickman, J.) (evaluating each plaintiff’s standing separately only where the factual allegations “diverge”). Because the five named Plaintiffs here all share roughly the same allegations, the Court does just one standing analysis.1 At the outset, the Court notes that it has already written on the standing issues that arise in data-breach cases in Zimmerman v. Highmark, Inc., 780 F. Supp. 3d 588 (W.D. Pa. 2025) (Ranjan, J.). The Court finds that the framework laid out in Zimmerman—based on the Third Circuit’s decision in Clemens v. ExecuPharm Inc., 48 F.4th 146 (3d Cir. 2022)—represents the appropriate legal framework for this case, too. So the Court writes with reference to Zimmerman as it proceeds through the standing analysis here. A. Plaintiffs have pled an injury in fact. An injury in fact must be: (1) either actual or imminent; and (2) concrete.2 Spokeo, 578 U.S. at 339. Here, Plaintiffs base their standing argument on “the threat

1 Were this Court to proceed plaintiff-by-plaintiff, the outcome would remain the same: Plaintiffs have standing. But the Court’s reasoning would differ slightly. For example, the Court below assesses whether Plaintiffs have alleged a sufficiently imminent injury. But as AHN and IntraSystems acknowledge, under a plaintiff-by- plaintiff approach, Ms. Foti and Ms. Brooks have suffered an actual injury. See ECF 55 at 6 n.2; ECF 57 at 14–15. So a plaintiff-by-plaintiff analysis would only strengthen certain Plaintiffs’ standing arguments. In this way, the shared facts that the Court considers act as the least common denominator for standing.

2 Injuries also must be particularized. Spokeo, 578 U.S. at 339. Plaintiffs meet this requirement because the pled allegations aren’t generalized grievances, they are particular to each Plaintiff. See id. of identity theft and fraud.” ECF 63 at 6. As with many data-breach cases, the Court must decide whether the alleged injuries are sufficiently imminent and concrete. See Zimmerman, 780 F. Supp. 3d at 598; ECF 63 at 6. Three main factors guide this Court in determining whether the threat of identity theft and fraud is imminent. See Clemens, 48 F.4th at 153–54. Though the factors are non-exhaustive, courts should ask: (1) “whether the data breach was intentional”; (2) “whether data was misused”; and (3) “whether the nature of the information accessed through the data breach could subject a plaintiff to a risk of identity theft.” Id. All three factors favor imminence here. Plaintiffs allege that their data was intentionally accessed, downloaded, and published for ransom to the dark web by a known hacker, LockBit3.0. ECF 62 at 5; see ECF 44 at ¶¶ 79–80. Plaintiffs have shown intentionality and misuse because they’ve alleged that a known hacker “launched a sophisticated phishing attack,” held the data for ransom, and then published it. See Clemens, 48 F.4th at 157. And the data on the dark web are Plaintiffs’ PII and PHI. ECF 44 at ¶¶ 79–80. “Social security numbers, dates of birth, full names, home addresses” and financial account numbers represent “the type of data that could be used to perpetuate identity theft or fraud.” Clemens, 48 F.4th at 157. Plaintiffs’ injury is imminent. Imminence isn’t enough; the injury must also be concrete. A concrete injury means that it’s “real, and not abstract.” Spokeo, 578 U.S. at 340 (cleaned up). Because Plaintiffs’ injury is imminent and not yet realized, whether their injury is concrete depends on what type of relief they seek. Clemens, 48 F.4th at 154–55. For Plaintiffs’ injunctive relief sought, they have alleged a concrete harm because “unauthorized exposure of personally identifying information that results in an increased risk of identity theft or fraud” is a concrete harm. Id. at 155. But for Plaintiffs’ damages claims, they must establish that “the exposure to the risk of future harm itself cause[d] a separate concrete harm.” Id. at 155 (cleaned up). Plaintiffs here establish a separate concrete harm by pleading that each has suffered from “stress, anxiety, worry, and fear” since learning of their exposed risk to identity theft and fraud. See id. at 156 (holding that in the data breach context, presently experiencing emotional distress after learning of exposed data qualifies as a separate, concrete harm); ECF 44 at ¶¶ 98 (Brooks), 108 (Foti), 116 (Kehr), 124 (Silliman- Guyer), 132 (Weltz). Defendants contend that Plaintiffs’ allegations of their PII and PHI being on the dark web are, at best, vague and, at worst, inconsistent with other parts of their complaint. ECF 55 at 9; ECF 57 at 3. True, the complaint isn’t perfectly pled. In parts, it reads that “Plaintiffs have determined that their PII and PHI have already been advertised on the dark web.” ECF 44 at ¶ 79. That’s clear: the named Plaintiffs have had their data misused. But then later, the complaint reads that “knowing that hackers accessed and possibly exfiltrated her PII and PHI, and that this information likely has been or will be used in the future for identity theft, fraud, and other nefarious purposes has caused Ms. Brooks to experience stress, anxiety, worry, and fear.” E.g., ECF 44 at ¶ 98 (emphasis added). Plaintiffs seemingly back away from their previous surety. Still, this isn’t enough to defeat standing. Read in the light most favorable to Plaintiffs, the complaint can be read in harmony. See Lula, 255 F. App’x at 611. For example, when Plaintiffs found out about the data breach in January 2025, they began worrying about possible misuse of their data, and then they later learned that their data was actually misused when the hacker ransomed it and published it on the dark web.3

3 Discovery will, no doubt, sort some of this out, including whether there was actual misuse. So, this is without prejudice to AHN raising standing at summary judgment on a more developed record. AHN also complains over “the Complaint’s repetition of the same generic allegation” that Plaintiffs suffered from “stress, anxiety, worry, and fear.” ECF 55 at 12 (cleaned up). These aren’t generic allegations; they are specific. Just because they are shared by all Plaintiffs doesn’t mean that they aren’t well pled, or that the Court should not accept them as true. Plaintiffs have sufficiently pled an injury in fact necessary for standing. B. Plaintiffs have shown traceability and redressability. Plaintiffs must also show that “the injury was caused by the challenged action of the [defendants]” (traceability), and that “the requested judicial relief” would redress the injury (redressability). Clemens, 48 F.4th at 158 (cleaned up). At the pleading stage, it’s sufficient that Plaintiffs have alleged that Defendants’ failures to implement the correct protocols resulted in the breach and increased risk of fraud and identity theft. Id.; ECF 44 at ¶¶ 66, 155. A monetary award redresses that injury, so Plaintiffs’ damages remedy is appropriate. See Clemens, 48 F.4th at 158. Plaintiffs also seek injunctive relief “requiring Defendants to employ adequate security protocols consistent with law and industry standards to protect Plaintiffs’ and Class Members’ PII and PHI.” ECF 44 at ¶ 210. Plaintiffs need standing “‘for each form of relief sought,’” so it must be that the injunctive relief would remedy the future harm that Plaintiffs face of another data breach. See TransUnion LLC v. Ramirez, 594 U.S. 413, 435–36 (2021) (quoting Friends of the Earth, Inc. v. Laidlaw Env’t Servs. (TOC), Inc., 528 U.S. 167, 185 (2000)). Plaintiffs have pled enough to proceed with their claim for injunctive relief— for now. They allege that AHN and IntraSystems “continue to breach these legal duties by failing to employ reasonable measures to secure patients’ PII and PHI.” ECF 44 at ¶ 209. Some discovery is needed for this claim, “as it will turn on what measures have been put in place by [Defendants] since the data breach occurred.” Zimmerman, 780 F. Supp. 3d at 601; Miller v. Syracuse Univ., 662 F. Supp. 3d 338, 357 (N.D.N.Y. 2023). Should discovery not show a substantial risk of another data breach, Defendants are free to re-raise their standing arguments. II. Plaintiffs have plausibly alleged some claims (Count V against AHN and Counts I, II, III, VI,), but not others (Count V against IntraSystems or Count IV).4

A. Plaintiffs have a plausible claim for negligence (Count I), though Plaintiffs cannot invoke Section 5 of the FTC Act. To plead a claim for negligence under Pennsylvania law, Plaintiffs must allege: “(1) a duty or obligation recognized by the law, requiring the actor to conform to a certain standard of conduct for the protection of others against unreasonable risks; (2) a failure to conform to the standard required; (3) a causal connection between the conduct and the resulting injury; and (4) actual loss or damage resulting in harm to the interests of another.” N.W. Mut. Life Ins. Co. v. Babayan, 430 F.3d 121, 139 (3d Cir. 2005). Plaintiffs have properly brought a claim for negligence. They allege that Defendants “owed a non-delegable duty under common law . . . to exercise reasonable care in obtaining, retaining, securing, safeguarding, deleting, and protecting [their] PII and PHI.” ECF 44 at ¶ 147. Pennsylvania recognizes this common-law duty. Dittman v. UPMC, 196 A.3d 1036, 1038 (Pa. 2018). And because of this duty, the economic-loss doctrine doesn’t prevent Plaintiffs from recovering purely pecuniary damages as Defendants contend. Id.; ECF 55 at 18; ECF 57 at 17. Plaintiffs then allege that Defendants breached their duty by failing to protect against “foreseeable threats” to their data, and that in doing so, Plaintiffs suffered harm. ECF 44 at ¶¶ 150, 154–56. AHN contends that Plaintiffs’ negligence claim is only premised on IntraSystems’s negligence, not AHN’s. ECF 55 at 18. That construes Plaintiffs’

4 All parties cite to Pennsylvania law, so the Court assumes that Pennsylvania law controls and applies it here. complaint too narrowly. Plaintiffs allege that “Defendants breached the duties owed to Plaintiffs.” ECF 44 at ¶ 154. The fact that AHN contracted out data security to IntraSystems doesn’t absolve AHN of potential negligence liability. See In re Am. Med. Collection Agency, Inc. Customer Data Sec. Breach Litig., No. CV 19-MD-2904, 2021 WL 5937742, at *15 (D.N.J. Dec. 16, 2021). For example, AHN still had to ensure that IntraSystems had adequate security measures in place when AHN chose IntraSystems as its IT security vendor. See id. Plaintiffs also base their negligence claim on an alternative theory: Defendants violated Section 5 of the FTC Act and that constitutes negligence per se. See ECF 44 at ¶ 162. This theory doesn’t work. “Pennsylvania does not recognize a claim for negligence per se based on statutes without a private right of action,” and Section 5 of the FTC Act doesn’t create a private right of action. Zimmerman, 780 F. Supp. 3d at 603; Gresham v. Ocwen Loan Servicing, LLC, No. CV 17-203 (MN), 2018 WL 6599901, at *4 (D. Del. Dec. 17, 2018). Plaintiffs’ negligence claim survives, but their alternative theory of negligence per se based on Section 5 does not. B. Plaintiffs have a plausible claim for breach of fiduciary duty against AHN (Count II). In Pennsylvania, a breach-of-fiduciary-duty claim essentially has four elements. A plaintiff must prove: (1) “that the defendant negligently or intentionally failed to act in good faith and solely for the benefit of plaintiff in all matters”; (2) “that the plaintiff suffered injury”; (3) “that the agent’s failure to act solely for the plaintiff’s benefit was a real factor in bringing about plaintiff’s injuries”; and (4) that the confidential relationship between the plaintiff and defendant created a fiduciary relationship. Zimmerman, 780 F. Supp. 3d at 604 (cleaned up); Opris v. Sincera Reprod. Med., No. CV 21-3072, 2022 WL 1639417, at *10 (E.D. Pa. May 24, 2022). The first three elements largely track Plaintiffs’ negligence theory, and so are plausibly pled. The fourth element—existence of a fiduciary relationship—is sufficiently pled here. For there to be a fiduciary relationship between a plaintiff and defendant, it must go “beyond mere reliance on superior skill, and [be] a relationship characterized by overmastering influence on one side or weakness, dependence, or trust, justifiably reposed on the other side, which results in the effective ceding of control over decision- making by the party whose property is being taken.” Yenchi v. Ameriprise Fin., Inc., 161 A.3d 811, 823 (Pa. 2017) (cleaned up). As a matter of law, fiduciary relationships include “doctor and patient, principal and agent, trustee and cestui que trust, attorney and client, guardian and ward, and partners.” Zimmerman, 780 F. Supp. 3d at 604. As pled, AHN is Plaintiffs’ fiduciary. AHN is Plaintiffs’ healthcare provider. ECF 44 at ¶ 167. The complaint alleges that Plaintiffs shared their PII and PHI for the same reason patients share information with doctors: to facilitate treatment. See id. at ¶ 7. The same way that patients cede control over their information when they share it with doctors, so too here. Indeed, AHN never contests the fiduciary nature of its relationship with Plaintiffs, ECF 55 at 19–20. So, for these reasons, the complaint plausibly alleges a claim for breach of fiduciary duty. C. Plaintiffs have a claim for breach of implied contract against AHN (Count III). A breach of implied contract mirrors a breach-of-express-contract claim, other than the contract being implied by the parties’ conduct as opposed to words. Zimmerman, 780 F. Supp. 3d at 605. Plaintiffs’ claim is that AHN promised Plaintiffs that it would use industry best practices to protect their PII and PHI, Plaintiffs paid AHN money (in part) for AHN to protect their data, and AHN then breached its promise by failing to use industry best practices. ECF 44 at ¶¶ 33, 182–85. That’s enough at the pleading stage to proceed. See, e.g., Zimmerman, 780 F. Supp. 3d at 605–06. D. Plaintiffs fail to state a claim for breach of contracts to which Plaintiffs were intended third-party beneficiaries (Count IV). Plaintiffs claim that when AHN and IntraSystems contracted together, Plaintiffs “were third party beneficiaries of that agreement.” ECF 44 at ¶ 189. Not so. Under Pennsylvania law, parties to a contract can “expressly disclaim the existence of intended third-party beneficiaries.” In re NCB Mgmt. Servs., Inc. Data Breach Litig., 748 F. Supp. 3d 262, 276 (E.D. Pa. 2024). That’s what happened here, where Defendants’ agreement “confers no rights upon any of the Parties’ . . . clients, or upon any other person or entity.” ECF 55-2 at 3; see Pension Ben. Guar. Corp. v. White Consol. Indus., Inc., 998 F.2d 1192, 1196 (3d Cir. 1993) (permitting courts to rely on “undisputedly authentic” documents attached by defendants when a plaintiff’s claim directly relies on the document in the complaint). Plaintiffs were not third- party beneficiaries to Defendants’ contract. E. Plaintiffs have a claim for unjust enrichment against AHN only (Count V). As an “alternative to Plaintiffs’ contract-based claims,” Plaintiffs bring a claim for unjust enrichment against AHN and IntraSystems. ECF 44 at ¶ 94. Where “the existence or applicability of a contract is in dispute,” a plaintiff can bring an unjust enrichment claim in the alternative. Hickey v. Univ. of Pittsburgh, 81 F.4th 301, 315– 16 (3d Cir. 2023). It’s a common practice at the pleading stage. See Zimmerman, 780 F. Supp. 3d at 606. Plaintiffs have a viable claim for unjust enrichment against AHN. Plaintiffs need to sufficiently plead three elements: “(1) the plaintiff conferred a benefit on the defendant; (2) the defendant appreciated that benefit; and (3) the defendant retained the benefit under circumstances where it would be inequitable to do so without payment of value.” Hickey, 81 F.4th at 316. Plaintiffs allege that AHN didn’t properly protect their data after they paid AHN money in exchange for health services and data protection. ECF 44 at ¶¶ 198–201. As pled, the benefit of data security wasn’t “merely incident” to Plaintiffs’ health-care purchases—it was part of the bargain. See Zimmerman, 780 F. Supp. 3d at 606 (cleaned up); but see Irwin v. Jimmy John’s Franchise, LLC, 175 F. Supp. 3d 1064, 1072 (C.D. Ill. 2016) (finding that data security “was merely incidental to” a Jimmy John’s purchase). There’s enough for the claim against AHN to survive. There’s not enough for the claim against IntraSystems, however. Plaintiffs never alleged that “plaintiff[s] conferred a benefit on the defendant.” See id. at 316 (emphasis added). AHN paid IntraSystems, not Plaintiffs. ECF 44 at ¶ 197. IntraSystems makes this point in its brief that it never received a benefit from Plaintiffs. ECF 57 at 19. In response, Plaintiffs only refer to the benefit that AHN received from Plaintiffs’ PII and PHI. See ECF 63 at 15. Neither in their pleadings nor briefs do Plaintiffs explain how they conferred a benefit onto IntraSystems. So Plaintiffs’ unjust-enrichment theory survives against AHN, but the Court dismisses the claim against IntraSystems. F. With one modifier, Plaintiffs have a claim for declaratory judgment (Count VI). Plaintiffs seek declaratory judgment from this Court that: (1) Defendants owed a common-law duty to Plaintiffs to protect Plaintiffs’ data; (2) Section 5 of the FTC Act also created a duty for Defendants to protect Plaintiffs’ data; and (3) “Defendants breached and continue to breach these legal duties.” ECF 44 at ¶¶ 207–09. Plaintiffs’ declaratory judgment claim overlaps with their substantive claims that aren’t fully developed yet, so the Court will deny Defendants’ motion to dismiss Count VI. See Zimmerman, 780 F. Supp. 3d at 607 (noting that courts “frequently” do this). The only exception is Plaintiffs’ second request related to Section 5 of the FTC Act. As the Court has addressed, Section 5 of the FTC Act doesn’t give Plaintiffs a negligence per se claim under Pennsylvania law. So the Court dismisses the “Section 5” part of Plaintiffs’ declaratory-judgment claim.

CONCLUSION After careful consideration, it is hereby ORDERED that Defendants’ motions to dismiss (ECF 54; ECF 56) are GRANTED in part and DENIED in part. Against AHN, Counts I, II, III, V, and VI survive. Against IntraSystems, Counts I and VI survive. Count IV against both Defendants and Count V against IntraSystems are dismissed. The dismissal is with prejudice, as the defects are legal in nature and further amendment would therefore be futile. See Grayson v. Mayview State Hosp., 293 F.3d 103, 108 (3d Cir. 2002). DATED this 5th day of August, 2026. BY THE COURT:

/s/ J. Nicholas Ranjan United States District Judge