Richard Herrera, et al. v. Fyzical Acquisition Holdings, LLC

Opinion

UNITED STATES DISTRICT COURT MIDDLE DISTRICT OF FLORIDA TAMPA DIVISION

RICHARD HERRERA, et al., individually, and on behalf of all others similarly situated,

Plaintiffs,

v. Case No. 8:25-cv-3551-TPB-SPF

FYZICAL ACQUISITION HOLDINGS, LLC,

Defendant. ____________________________________/

ORDER GRANTING IN PART AND DENYING IN PART “DEFENDANT’S MOTION TO DISMISS PLAINTIFFS’ CONSOLIDATED CLASS ACTION COMPLAINT”

This matter is before the Court on “Defendant’s Motion to Dismiss Plaintiffs’ Consolidated Class Action Complaint,” filed on March 23, 2026. (Doc. 24). Plaintiffs Richard Herrera, Kathy Luro, and Sharon Kunsman, individually and on behalf of all others similarly situated, filed a response in opposition on May 7, 2026. (Doc. 31). Based on the motion, response, the court file, and the record, the Court finds as follows: Background1 This dispute arises from a data breach. Defendant Fyzical Acquisition Holdings, LLC is a franchisor of a chain of physical and occupational therapy clinics

that provide therapy for orthopedic, neurologic, and geriatric conditions. Plaintiffs Richard Herrera, Kathy Luro, Sharon Kunsman, and purported class members are Defendant’s current and former patients. To receive services, Plaintiffs were required to provide Defendant with an array of their personal information, including their credit card and health insurance information. The privacy policy indicated that Defendant would safeguard Plaintiffs’ private information, maintain

confidentiality, and use the private information for authorized purposes only. On or about December 9, 2024, Defendant noticed unusual activity within its internal system. On November 25, 2025, following a review, Defendant determined that the following patient information was breached by a criminal actor: names, dates of birth, social security numbers, driver’s license or state identification numbers, financial account information, credit card information, health insurance information, and medical health information. On December 19, 2025, Defendant

began notifying Plaintiffs and purported class members that their information had been breached.

1 The Court accepts as true the facts alleged in Plaintiffs’ complaint for purposes of ruling on the pending motion to dismiss. See Erickson v. Pardus, 551 U.S. 89, 94 (2007) (“[W]hen ruling on a defendant’s motion to dismiss, a judge must accept as true all of the factual allegations contained in the complaint.”). The Court is not required to accept as true any legal conclusions couched as factual allegations. See Papasan v. Allain, 478 U.S. 265, 286 (1986). On March 2, 2026, Plaintiffs filed their consolidated class action complaint asserting claims for: negligence and negligence per se (Count I); breach of implied contract (Count II); and unjust enrichment (Count III). Defendant moves to dismiss

for lack of subject matter jurisdiction on grounds that Plaintiffs have not established Article III standing and for failure to state a claim. Legal Standard Federal Rule of Civil Procedure 8(a) requires that a complaint contain “a short and plain statement of the claim showing the [plaintiff] is entitled to relief.” Fed. R. Civ. P. 8(a). While Rule 8(a) does not demand “detailed factual

allegations,” it does require “more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). In order to survive a motion to dismiss, factual allegations must be sufficient “to state a claim to relief that is plausible on its face.” Id. at 570. When deciding a Rule 12(b)(6) motion, review is generally limited to the four corners of the complaint. Rickman v. Precisionaire, Inc., 902 F. Supp. 232, 233 (M.D. Fla. 1995). Furthermore, when reviewing a complaint for facial

sufficiency, a court “must accept [a] [p]laintiff’s well pleaded facts as true, and construe the [c]omplaint in the light most favorable to the [p]laintiff.” Id. (citing Scheuer v. Rhodes, 416 U.S. 232, 236 (1974)). “[A] motion to dismiss should concern only the complaint’s legal sufficiency, and is not a procedure for resolving factual questions or addressing the merits of the case.” Am. Int’l Specialty Lines Ins. Co. v. Mosaic Fertilizer, LLC, 8:09-cv-1264-T-26TGW, 2009 WL 10671157, at *2 (M.D. Fla. Oct. 9, 2009) (Lazzara, J.). Analysis

Standing In its motion, Defendant argues that the Court lacks subject matter jurisdiction over this action because Plaintiffs cannot establish Article III standing. To establish standing, Plaintiffs “must have (1) suffered an injury in fact, (2) that is traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” See Spokeo, Inc. v. Robins, 578 U.S. 330,

338 (2016) (citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61 (1992)). First, Defendant argues that Plaintiffs have not stated a cognizable injury in fact because they rely merely on self-imposed injury or the risk of a hypothetical, nonconcrete, future harm. An injury in fact must involve the “invasion of a legally protected interest” that is “concrete and particularized,” and the injury must be “actual or imminent, not conjectural or hypothetical.” Id. at 339 (citing Lujan, 504 U.S. at 560). Here, Plaintiffs have alleged that their private information was

compromised in the data breach and that their information has already been misused on the dark web, resulting in an uptick in spam calls, texts, and emails. See In re Mednax Servs., Inc. Customer Data Sec. Breach Litig., 603 F. Supp. 3d 1183, 1202-03 (S.D. Fla. 2022) (finding allegations of actual misuse of personal data, including increased spam, sufficient to confer Article III standing as to claim for injunctive relief); see also In re Forta File Transfer Software Data Sec. Breach Litig., 749 F. Supp. 3d 1240, 1258-59 (S.D. Fla. 2024) (concluding that allegations of increased risk of identity theft along with allegations of actual misuse of data is sufficient to confer Article III standing). In addition, Plaintiff Richard Herrera’s

private information was allegedly already used to commit identity theft and fraud. See In re Equifax Inc. Customer Data Sec. Breach Litig., 999 F.3d 1247, 1262 (11th Cir. 2021). Plaintiffs also claim they have suffered mitigation costs and lost time, loss of privacy, emotional distress, and diminished value of private information. See Mednax, 603 F. Supp. 3d at 1203-04 (recognizing that emotional distress and cost of increased time spent reviewing their financial information, coupled with a

substantial risk of future harm, are sufficient to state an injury in fact as to damages claim); see also Equifax, 999 F.3d at 1262 (“[W]hen a plaintiff faces a sufficient risk of harm, the time, money, and effort spent mitigating that risk are also concrete injuries.”). These allegations are sufficient to state cognizable injuries-in-fact for the named Plaintiffs. See Green-Cooper v. Brinker Int’l, Inc., 73 F.4th 883, 889-90 (11th Cir. 2023) (recognizing that some misuse of a plaintiff’s data is sufficient to establish both present injury and the threat of future injury for the

purposes of Article III standing); see also Mednax, 603 F. Supp. 3d at 1202-03 (explaining that the alleged misuse of personal information obtained in a data breach may establish a “substantial risk of future injury” and “concrete harm”). The motion is denied as to this ground. Next, Defendant argues that Plaintiffs cannot establish traceability because they have not offered an explanation as to how Plaintiffs’ injuries are related to Defendant’s conduct, especially when there are other possible causes for the injury. To show traceability, Plaintiffs’ injuries “must be ‘fairly traceable to the challenged action’ and ‘redressable by a favorable ruling.’” See Ariz. State Legis. v. Ariz. Indep.

Redistricting Comm’n, 576 U.S. 787, 800 (2015) (quoting Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013)). “Fairly traceable” does not mean “certainly traceable” – in other words, Plaintiffs may show harms that flow indirectly from the injury in question for standing purposes. See Wilding v. DNC Servs. Corp., 941 F.3d 1116, 1125-26 (11th Cir. 2019) (citing Focus on the Family v. Pinellas Suncoast Transit Auth., 344 F.3d 1263, 1273 (11th Cir. 2003)). Here, Plaintiffs allege that

their information was compromised in the data breach and was misused. A potential speculative other cause for the suffered harms does not mean that Plaintiffs have not established traceability for the purpose of standing here. The motion is denied as to this ground. Failure to State a Claim Negligence and Negligence Per Se (Count I) As to Count I, Defendants argue that Plaintiffs allege no facts beyond

conclusions to show that Defendant breached a duty to Plaintiffs. Further, Defendant argues that Plaintiffs’ negligence per se claim fails because there is no private cause of action under the Federal Trade Commission (“FTC”) Act. Plaintiffs have sufficiently alleged that Defendant had a duty to safeguard their information, and that it breached that duty by failing to exercise reasonable care in safeguarding and protecting the private information. See Mednax, 603 F. Supp. 3d at 1222-23 (explaining that “[f]ederal courts in Florida have well established that entities which collect sensitive, private data from consumers and store such data on their networks have a duty to protect the information,” and

concluding that plaintiffs sufficiently alleged a negligence claim based on a data breach incident); see also In re Brinker Data Incident Litig., No. 3:18-cv-686-J-32- MCR, 2020 WL 691848, at *8 (M.D. Fla. Jan. 27, 2020) (finding that plaintiffs sufficiently alleged that the defendant breached a duty to use reasonable care in protecting the personal information of customers). The motion is denied as to this ground.

However, it appears that Defendant’s arguments concerning Plaintiffs’ negligence per se claims are well-taken. Plaintiffs may not premise their negligence per se claim on a breach of the FTC Act because there is no private cause of action implied under the Act. See Lingo v. City of Albany Dep’t of Cmty. & Econ. Dev., 195 F. App’x 891, 894 (11th Cir. 2006) (“There is no private cause of action implied under the Federal Trade Commission Act.”); Brinker, 2020 WL 691848, at *9 (dismissing a negligence per se claim premised on an alleged violation of the FTC

Act); Forta, 749 F. Supp. 3d at 1264 (dismissing a negligence per se claim premised on, among other things, alleged violations of the FTC Act and the Health Insurance Portability and Accountability Act (“HIPAA”)). The motion is therefore granted to the extent Defendant argues Plaintiffs fail to state negligence per se claims. In an abundance of caution, the Court will grant leave to amend so that Plaintiffs may assert another basis for their negligence per se claims, if they may do so in good faith. If Plaintiffs intend to pursue a negligence per se theory, they should include negligence per se as a separate count and not as part of the same basic negligence count to avoid shotgun pleading issues.

Breach of Implied Contract (Count II) Next, Defendant argues that Plaintiffs’ breach of implied contract claim fails because they do not allege that Defendant agreed to protect their personal information in exchange for payment. Here, Plaintiffs allege they were required to submit their personal information to obtain services, and that Defendant impliedly promised to maintain safeguards to protect the private information. Further,

Plaintiffs allege that Defendant failed to safeguard the information, and that Plaintiffs would have not entrusted their information and paid Defendant for its services if Defendant had not implicitly promised to safeguard the information. See Famer v. Humana, Inc., 582 F. Supp. 3d 1176, 1187 (M.D. Fla. 2022) (holding that a plaintiff sufficiently states a breach of implied contract claim where he was required to hand over sensitive information to receive a service because he “presumably expect[s] to receive an implicit assurance that the information will be protected”).

The motion is denied as to this ground. Unjust Enrichment (Count III) Last, Defendant argues that Plaintiffs fail to state a claim as to unjust enrichment. Here, Plaintiffs allege generally that they conferred a monetary benefit upon Defendant for Defendant’s services, that Defendant appreciated or had knowledge of the benefits, and that Defendant benefitted from the receipt of Plaintiffs’ and members of the class’s personal and private information because it was specifically used to facilitate payment and services. Fatal to their claim, however, Plaintiffs do not allege that they paid Defendant specifically to safeguard their private information, so no benefit was conferred on Defendant for that purpose. See Stephens v. Availity, L.L.C., No. 5:19-ev-236-Oc-30PRL, 2019 WL 13041330, at *6 (M.D. Fla. Oct. 1, 2019) (dismissing an unjust enrichment claim because without an allegation that the plaintiff paid for data security services, no benefit was conferred). The motion is granted as to this ground. In an abundance of caution, the Court will grant leave to amend, if Plaintiffs may do so in good faith. Accordingly, it is ORDERED, ADJUDGED, and DECREED: 1. “Defendant’s Motion to Dismiss Plaintiffs’ Consolidated Class Action Complaint” (Doc. 24) is hereby GRANTED to the extent that Counts I (in part) and III are DISMISSED WITHOUT PREJUDICE, with leave to amend. 2. The motion is otherwise DENIED. 3. Plaintiffs are directed to file an amended complaint on or before July 13, 2026. Failure to do so will result in this Order becoming a final judgment. DONE and ORDERED in Chambers, in Tampa, Florida, this 29th day of June, 2026. NAP. GA. TOMBARBER sss—s—S UNITED STATES DISTRICT JUDGE

Page 9 of 9