Sikes v. Sree Hotels, LLC

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF NORTH CAROLINA CHARLOTTE DIVISION CIVIL ACTION NO. 3:24-CV-00679-KDB-DCK

BENJAMIN SIKES,

Plaintiff,

v. ORDER

SREE HOTELS, LLC,

Defendant.

Plaintiff Benjamin Sikes, a former employee of Defendant Sree Hotels, LLC (“Sree”), seeks in this action to recover monetary damages and injunctive relief for himself and a class of thousands of employees and customers whose personal information was allegedly exposed during a “data breach” of Sree’s computer systems in February 2024. Now before the Court is Sree’s Motion to Dismiss First Amended Complaint, (Doc. No. 19), which argues that Sikes lacks standing to assert his claims. Having carefully reviewed the Amended Complaint, the parties’ arguments and the relevant authorities, the Court finds that it is a close question whether Plaintiff has sufficiently pled an actual or imminent misuse of his personal data traceable to the Sree data breach, as is required to establish standing to pursue his claims. However, even if the Court accepts Plaintiff’s standing argument, Plaintiff has not plausibly alleged facts from which the Court can conclude that it has diversity jurisdiction over this matter under 28 U.S.C. § 1332(d). Specifically, it is at least uncertain (and likely improbable) that a properly limited class represented by Plaintiff would involve an aggregate amount in controversy exceeding $5 million. Therefore, the Court will defer ruling on this motion and require the Parties to file supplemental proof from which the Court can determine the threshold question of whether it has subject matter jurisdiction over this action. I. LEGAL STANDARDS A motion to dismiss based on Federal Rule of Civil Procedure 12(b)(1) addresses whether the court has subject-matter jurisdiction to hear the dispute, see Fed. R. Civ. P. 12(b)(1), and

Plaintiff bears the burden of proving that subject matter jurisdiction exists. Evans v. B. F. Perkins Co., 166 F.3d 642, 647 (4th Cir. 1999). “[F]ederal courts are courts of limited jurisdiction, constrained to exercise only the authority conferred by Article III of the Constitution and affirmatively granted by federal statute.” In re Bulldog Trucking, Inc., 147 F.3d 347, 352 (4th Cir. 1998) (quotation omitted); see Gunn v. Minton, 568 U.S. 251, 256 (2013); Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994). There is no presumption that a federal court has subject-matter jurisdiction. See Pinkley, Inc. v. City of Frederick, 191 F.3d 394, 399 (4th Cir. 1999). However, “when a defendant asserts that the complaint fails to allege sufficient facts to support subject matter jurisdiction, the trial court must apply a standard patterned on Rule 12(b)(6)

and assume the truthfulness of the facts alleged.” Kerns v. United States, 585 F.3d 187, 193 (4th Cir. 2009). To determine whether subject matter jurisdiction is proper, the Court may consider evidence beyond the pleadings. Evans, 166 F.3d at 647. A court cannot exercise subject-matter jurisdiction “over an individual who does not have standing.” Whipple v. Marcuse, No. 3:24-CV-00325, 2024 WL 3761276, at *1 (W.D.N.C. Aug. 12, 2024) (quoting AtlantiGas Corp. v. Columbia Gas Transmission Corp., 210 F. App'x 244, 247 (4th Cir. 2006)). Federal courts are limited by Article III of the United States Constitution to deciding actual “cases” or “controversies.” U.S. Const. art. III § 2. If a plaintiff lacks standing, then there is no case or controversy, and the court lacks subject-matter jurisdiction over his claims. Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (“Standing to sue is a doctrine rooted in the traditional understanding of a case or controversy.”). The “‘irreducible constitutional minimum’ of standing consists of three elements. The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, 578 U.S. 330 at 338. Indeed, “Article III

standing requires a concrete injury even in the context of a statutory violation.” Id. at 341; TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) (to establish injury in fact, plaintiff's allegations must be sufficient to show he suffered a concrete harm). TransUnion governs this Court’s consideration of how to apply “the Article III requirement that the plaintiff’s injury in fact be concrete” in the context of a class action. 594 U.S. at 424 (cleaned up). In TransUnion, the named plaintiff brought a class action, alleging that TransUnion, a credit reporting agency, had violated the Fair Credit Reporting Act by failing to use reasonable procedures before placing a misleading alert in his credit file that labeled him as a potential terrorist, drug trafficker, or serious criminal and sending him mailings with formatting errors. Id.

at 419–21. The district court certified a class of more than 8,000 people who had the same misleading alert added to their credit files and had also received similar mailings. A jury then awarded each class member statutory and punitive damages. The Supreme Court reversed the awards, holding that only class members whose credit reports had been provided to third-party businesses had suffered sufficient “concrete harm” to support standing. Id. at 417. The Court rejected the argument that the other class members had “suffered a concrete injury for Article III purposes because the existence of misleading . . . alerts in their internal credit files exposed them to a material risk that the information would be disseminated in the future to third parties and thereby cause them harm.” Id. at 435. With respect to the claims based on the formatting errors, only the named plaintiff had demonstrated any concrete harm, precluding the remainder of the putative class from establishing standing to recover on those claims. Id. at 418. The Court concluded that none of the other class members had “demonstrated that the format of TransUnion’s mailings” — even if not in compliance with the statute — caused them “any harm at all.” Id. at 440.

In its opinion, the Supreme Court emphasized that, put simply, “[n]o concrete harm, no standing.” Id. at 417. It explained that while “[t]he most obvious” concrete injuries are “tangible harms, such as physical harms and monetary harms,” “[v]arious intangible harms can also be concrete,” depending on whether they have “a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts.” Id. at 425. Then, most important here, the Court applied those principles to class actions, observing that “standing is not dispensed in gross.” Id. at 431. It stated that federal courts lack “the power to order relief to any uninjured plaintiff, class action or not,” id. (quoting Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442, 466 (2016) (Roberts, C.J., concurring)), and that, as a result, “[e]very class member must have Article III

standing in order to recover individual damages,” id. Moreover, “plaintiffs must demonstrate standing for each claim that they press and for each form of relief that they seek.” Id. Finally, the Court also made clear that the form of relief sought matters when assessing the sufficiency of the alleged harm. While “a person exposed to a risk of future harm may pursue forward-looking, injunctive relief to prevent the harm from occurring,” id. at 435, “the risk of future harm on its own does not support Article III standing for [a] damages claim,” id. at 441. Therefore, following TransUnion, it is clear that to recover damages from the defendants, “[e]very class member must have Article III standing” “for each claim that they press,” requiring proof that the challenged conduct caused each of them a concrete harm. 594 U.S. at 431. It is equally clear that, to establish their standing to recover damages, the plaintiffs cannot rely on a “mere risk of future harm.” Id. at 437. That is, TransUnion requires a sufficient factual showing for each class member to claim damages. See id. at 431 (explaining that standing must be demonstrated for every class member with “specific facts”). Consistent with TransUnion, courts in the Fourth Circuit have concluded that in the context

of class actions alleging claims arising from a “data breach,” plaintiffs must allege facts that show “actual misuse of [their] [personal information] disclosed by the data breach.” Capiau v. Ascendum Mach., Inc., No. 3:24-CV-00142-MOC-SCR, 2024 WL 3747191, at *4 (W.D.N.C. Aug. 9, 2024) (emphasis in original) (citing Beck v. McDonald, 848 F.3d 262, 272 (4th Cir. 2017)) (“Actual misuse is the keystone of Article III injury in Fourth Circuit data breach case law.”). Therefore, “being subjected to a data breach isn't in and of itself sufficient to establish Article III standing without a nonspeculative, increased risk of identity theft.” O'Leary v. TrustedID, Inc., 60 F.4th 240, 244 (4th Cir. 2023). One way for a data breach plaintiff to establish actual misuse—and thus Article III injury—

is to credibly plead “that their data [has] been used in a fraudulent manner” as a consequence of the breach. Stamat v. Grandizio Wilkins Little & Matthews, LLP, No. CV SAG-22-00747, 2022 WL 3919685, at *5 (D. Md. Aug. 31, 2022) (citing Hutton v. Nat'l Bd. of Examiners in Optometry, Inc., 892 F.3d 613, 622 (4th Cir. 2018)); Capiau, 2024 WL 3747191, at *3. For example, depending on the specific allegations in a particular case, the use of or attempt to use a plaintiff’s personal information to open a credit card account without their authorization, or receipt of spam communications related to the data breach may be sufficient to establish data misuse and standing. See Hutton, 892 F.3d at 621–23; Capiau, 2024 WL 3747191, at *3. Krottner v. Starbucks Corp., 628 F.3d 1139, 1141 (9th Cir. 2010) (two months after theft of Plaintiff’s laptop someone attempted to open a new account using his social security number); See also In re Marriott Int'l, Inc., Customer Data Sec. Breach Litig., 440 F. Supp. 3d 447, 459 (D. Md. 2020) (complaint “contains allegations of actual misuse by some of the plaintiffs”); Bank of Louisiana v. Marriott Int'l, Inc., 438 F. Supp. 3d 433, 440 (D. Md. 2020) (complaint alleges that “payment card information actually has been accessed, and used in a fraudulent manner”); McCreary v. Filters

Fast LLC, No. 3:20-CV-595-FDW-DCK, 2021 WL 3044228, at *5 (W.D.N.C. July 19, 2021) (complaint alleged the misuse of plaintiff’s credit cards through fraudulent charges and publication of the information on the Dark Web). However, in other circumstances involving data exposure, courts have dismissed claims based on a lack of standing. See Beck, 848 F.3d at 274-75 (Theft of laptop containing personal information insufficient to establish actual harm or substantial risk of imminent harm); Kimbriel v. ABB, Inc., No. 5:19-CV-215-BO, 2019 WL 4861168, at *3 (E.D.N.C. Oct. 1, 2019) (plaintiffs merely alleged their information was used to conduct a credit inquiry); Krohm v. Epic Games, Inc., 408 F. Supp. 3d 717, 720 (E.D.N.C. 2019) (“plaintiff's complaint contains no facts showing, or even suggesting, that his personal data has been used as a result of

the cyber vulnerability”); Stamat, 2022 WL 3919685, at *5–6 (finding Plaintiff alleged no actual misuse of his personal data and that “all potential harms and misuses of his data remain hypothetical”). Further, with respect to a plaintiff’s claims of future harm and pursuit of forward-looking, injunctive relief, standing may be found even if harm has not already occurred so long as the risk of harm is “sufficiently imminent and substantial.” TransUnion, 594 U.S. at 435-36 (citing Clapper v. Amnesty Int'l USA, 568 U.S. 398, 414 n.5 (2013)). See DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 345 (2006) (an asserted injury is “imminent” when it is “certainly impending”); Lujan v. Defenders of Wildlife, 504 U.S. 555, 564–65, n.2 (1992) (same); Whitmore v. Arkansas, 495 U.S. 149, 158 (1990) (“A threatened injury must be ‘certainly impending’ to constitute injury in fact.”); Beck, 848 F.3d at 277–78 (“The most that can be reasonably inferred from the Plaintiffs’ allegations regarding the likelihood of another data breach . . . is that the Plaintiffs could be victimized by a future data breach. That alone is not enough.). Put another way, “a material risk of future harm can satisfy the concrete harm requirement,” “but only as to injunctive relief, not

damages.” Id.; Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365, 372 (1st Cir. 2023). Also, “to have standing to pursue damages based on a risk of future harm, plaintiffs must demonstrate a separate concrete harm ‘caused by their exposure to the risk itself.’” Webb, 72 F.4th at 372 (quoting TransUnion, 594 U.S. at 436). Relatedly, in the Fourth Circuit, a plaintiff’s claim that “emotional upset” and “fear [of] identity theft and financial fraud” resulting from the data breaches are not “adverse effects” sufficient to confer Article III standing. Beck, 848 F.3d at 271–73. Pursuant to Federal Rule of Civil Procedure Rule 12(h)(3), the Court may sua sponte consider the issue of subject matter jurisdiction at any time. See Fed.R.Civ.P. 12(h)(3). Where the Court determines “that it lacks subject-matter jurisdiction, the court must dismiss the action.” Id.;

see also Arbaugh v. Y&H Corp., 546 U.S. 500, 506 (2006) (“[t]he objection that a federal court lacks subject-matter jurisdiction [ ] may be raised by a party, or by a court on its own initiative, at any stage in the litigation”). Jurisdiction refers to “the courts’ statutory or constitutional power to adjudicate the case.” United States v. Cotton, 535 U.S. 625, 630 (2002) (quoting Steel Co. v. Citizens for a Better Env't, 523 U.S. 83, 89 (1998)). “Without jurisdiction the court cannot proceed at all in any cause. Jurisdiction is power to declare the law, and when it ceases to exist, the only function remaining to the court is that of announcing the fact and dismissing the cause.” Steel Co., 523 U.S. at 94. Few, if any, precepts are more fundamental than that “‘federal courts are courts of limited jurisdiction,’ constrained to exercise only the authority [1] conferred by Article III of the Constitution and [2] affirmatively granted by federal statute.” In re Bulldog Trucking, Inc., 147 F.3d 347, 352 (4th Cir. 1998) (quoting Owen Equip. & Erection Co. v. Kroger, 437 U.S. 365 (1978)). “A court is to presume, therefore, that a case lies outside its limited jurisdiction unless

and until jurisdiction has been shown to be proper.” United States v. Poole, 531 F.3d 263, 274 (4th Cir. 2008) (citing Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994)); Aalaam v. Conley, No. 5:24-CV-00225-KDB-DCK, 2024 WL 4536476, at *2 (W.D.N.C. Oct. 21, 2024). Indeed, district courts “have an independent obligation to determine whether subject-matter jurisdiction exists, even in the absence of a challenge from any party.” Arbaugh, 546 U.S. at 501; accord Hertz Corp. v. Friend, 559 U.S. 77, 94 (2010); see McCulloch v. Vélez, 364 F.3d 1, 5 (1st Cir. 2004) (“It is blackletter law that a federal court has an obligation to inquire sua sponte into its own subject matter jurisdiction.”). A district court has subject matter jurisdiction over a case only where the matter involves

a federal question arising “under the Constitution, laws or treaties of the United States,” 28 U.S.C. § 1331, or if, as alleged here, the Court has “diversity jurisdiction” under 28 U.S.C. § 1332. More specifically, Plaintiff alleges this Court has jurisdiction under 28 U.S.C. § 1332(d) because this is a class action where the amount in controversy exceeds the sum or value of $5 million, exclusive of interest and costs, there are more than 100 members in the proposed class, and at least one class member is a citizen of a state different from Defendant. See Doc. No. 17 at ¶ 11; 28 U.S.C. § 1332(d) (Diversity jurisdiction provision added by the Class Action Fairness Act of 2005 (“CAFA”), Pub.L. No. 109–2, 119 Stat. 4). When a plaintiff invokes a federal court’s diversity jurisdiction, the plaintiff's amount-in- controversy allegation is accepted if made in good faith. See, e.g., Mt. Healthy City Bd. of Ed. v. Doyle, 429 U.S. 274, 276 (1977) (“‘[T]he sum claimed by the plaintiff controls if the claim is apparently made in good faith.”’). However, “where a defendant or the court challenges the plaintiff's allegations regarding the amount in question, the plaintiff who seeks the assistance of

the federal courts must produce sufficient evidence to justify its claims.” Columbia Gas Transmission Corp. v. Tarbuck, 62 F.3d 538, 541 (3d Cir. 1995); see Dart Cherokee Basin Operating Co., LLC v. Owens, 574 U.S. 81, 87 (2014). If there is doubt “regarding a defendant's asserted amount in controversy, ‘both sides submit proof and the court decides, by a preponderance of the evidence, whether the amount-in-controversy requirement has been satisfied.’” Scott v. Cricket Commc'ns, LLC, 865 F.3d 189, 192 (4th Cir. 2017) (quoting Dart Cherokee, 574 U.S. at 88). In identifying the amount in controversy, a defendant may “rely to some extent on reasonable estimates, inferences, and deductions.” Id. at 196. The question is “not what the plaintiff

will actually recover,” but rather “the amount that will be put at issue in the course of the litigation”— that is, whether “‘a fact finder might legally conclude that’ damages will exceed the jurisdictional amount.” Id. However, “[t]o meet its burden, [a defendant] must provide enough facts to allow a court to determine—not speculate—that it is more likely than not that the class action belongs in federal court.” Id. at 197; see also Brennan v. Stevenson, No. JKB-15-2931, 2015 WL 7454109, at *6 (D. Md. Nov. 24, 2015) (“Courts may not engage in conjecture, speculation, or judicial star gazing to determine jurisdiction.”); Osia v. Rent-a-Center, Inc., No. DKC-15-1200, 2015 WL 3932416, at *5 (D. Md. June 25, 2015) (“To allow removal of this case based on Defendant's speculation as to a possible final damage award would eviscerate the amount in controversy requirement.”); Ayers v. CIOX Health, LLC, No. CV DLB-23-3079, 2024 WL 2783787, at *2 (D. Md. May 29, 2024) (declining CAFA jurisdiction where Plaintiff’s evidence of the amount in controversy was too speculative). II. FACTS AND PROCEDURAL HISTORY Defendant Sree is a hotel ownership and management company operating twenty-five

hotels, as well as several restaurants, throughout North Carolina, South Carolina, and Ohio. Doc. No. 17 (First Amended Class Action Complaint (“FAC”) at ¶ 1. Plaintiff alleges that in the course of its business, Sree acquired, collected, and stored Plaintiff’s and the putative class members’ “private information,” which he defines to mean “names and Social Security numbers.” See FAC at ¶¶ 2, 7. On February 29, 2024, unauthorized third-party criminals gained access to this private information through a cyber-attack (the “Data Breach”). Id. at ¶ 4. The FAC alleges that Defendant’s Data Breach harms and threatens to harm Plaintiff and the class in the future by requiring them to spend time and resources mitigating the risk that their personal information will be used for criminal purposes and financial gain. Id. at ¶ 46. With respect

to actual misuse of his information, Plaintiff alleges: [I have] experienced at least two hard inquiries on [my] credit that [I] did not authorize. As hard inquiries generally require submission of an applicant’s Social Security number, this correlation to the disclosure of [my] Social Security Number in the breach is deeply concerning.

Id. at ¶ 25. In addition, Plaintiff claims that he has experienced “significant anxiety, fear, and distress” regarding the safety of his personal information and risk of identity theft. Id. With respect to future harm, Plaintiff alleges “imminent and impending injury arising from the substantially increased risk of fraud, identity theft, and misuse resulting from [his personal information] being placed in the hands of unauthorized third parties/criminals.” Id. at ¶ 26. However, the FAC provides no specific allegations related to the Data Breach or its aftermath, alleging instead only that “Plaintiff and Class Members are . . . left to speculate as to where their PII ended up, who has used it, and for what potentially nefarious purposes, and are left to further speculate as to the full impact of the Data Breach.” FAC at ¶ 51. Plaintiff filed this action in July 2024, asserting that this Court has subject matter and diversity jurisdiction “under 28 U.S.C. § 1332(d) because this is a class action where the amount

in controversy exceeds the sum or value of $5 million, exclusive of interest and costs, there are more than 100 members in the proposed class, and at least one class member is a citizen of a state different from Defendant.” FAC at ¶ 11. Plaintiff defines the putative classes he seeks to certify under Rules 23(a), (b)(2), and (b)(3) of the Federal Rules of Civil Procedure to include: “All individuals within the United States of America whose PII and/or financial information was exposed to unauthorized third-parties as a result of the data breach experienced by Defendant on February 29, 2024.” Defendant timely filed a motion to dismiss “for lack of standing,” which in turn led to the filing of the FAC on September 27, 2024, and Defendant’s renewed motion to dismiss on the same grounds. See Doc. Nos. 6, 17 and 19. Briefing on the motion concluded on

December 2, 2024, and the motion is ripe for the Court’s decision. III. DISCUSSION As explained above, the Court must determine if it has subject matter jurisdiction over this action based on the class as a whole under TransUnion and CAFA. So, even if the Court accepts (without deciding) that Plaintiff has standing to assert his personal claims1 for purposes of this order, his FAC claims must be analyzed more broadly.

1 As noted above, it is a close question whether Plaintiff has sufficiently alleged actual misuse of his personal information traceable to the Data Breach. While unauthorized attempts to obtain credit (“hard credit inquiries”) following within 6-7 months of a data breach could well be evidence of actual misuse sufficient to support standing, see Hutton, 892 F.3d 613, a credit inquiry standing Section 1332(d) grants the District Courts original jurisdiction over class actions in which the number of members of the proposed plaintiff classes is at least 100; the aggregate amount in controversy exceeds $5,000,000, exclusive of interest and costs; and there is a minimal diversity of citizenship. While Plaintiff has alleged that each of these requirements is satisfied, those allegations (other than with respect to diversity of citizenship which is not at issue) are based on

his interpretation of his claims and the proposed class, which appear to be inconsistent with the legal limitations related to standing discussed above. Therefore, further information is needed before the Court can conclude Plaintiff has satisfied 1332(d). With respect to the size of the proposed classes, Plaintiff alleges that the “total number of individuals who have had their data exposed” is “estimated to be in the tens/hundreds of thousands based on Defendant’s clientele.” FAC at ¶ 5. However, Plaintiff is not one of Defendant’s customers. Rather, he is a former employee of the Defendant, which “employs more than 443 people.” Id. at ¶ 1. The distinction between employees and customers is critical because while the Court can plausibly infer that a company has the Social Security number of all its employees, the

Court cannot make that inference with respect to hotel customers, who may provide only their name, some contact details (possibly phone number and/or address) and payment information. Further, Plaintiff alleges that the personal information exposed was “names and Social Security numbers,” FAC at ¶ 7. Perhaps more importantly, the only allegation of actual misuse of data in the FAC involves his own Social Security number. See FAC at ¶ 25. Again, TransUnion requires

alone may not be. See Kimbriel, 2019 WL 4861168. Here, the FAC fails to identify the “hard credit inquiries” or make any factual allegations as to the timing or process for making those specific inquiries. The Court understands that Plaintiff may not have detailed information on exactly what happened, but the absence of any specific factual allegations related to the inquiries beyond the conclusory allegation of what “generally” happens in such circumstances leaves the record uncertain. that all class members have standing as to each claim, which in this context means they were the victims of actual misuse of personal data taken in the Data Breach or are subject to an imminent and substantial risk of such misuse. Yet, there are no factual allegations in the FAC from which the Court can plausibly conclude that any customer even provided Defendant with his or her Social Security number or that any of Defendant’s employees or former employees other than Plaintiff

was a victim of actual misuse of personal data. Moreover, the limited factual allegations in the FAC cannot support a plausible inference of an “imminent and substantial” risk of data misuse. (Indeed, Plaintiff candidly acknowledges that he and the class can only “speculate” as to the current circumstances and what might happen in the future). See Beck, 848 F.3d at 276, n.7 (allegations that data-breach victims are 9.5 times more likely than the average person to suffer identity theft “says nothing about the risk arising out of any particular incident, nor does it address the particular facts of this case.”). Therefore, the Court cannot conclude that the class, properly limited to those with standing to pursue a valid claim, has at least 100 members. Similarly, there are insufficient factual allegations from which the Court can conclude that

the amount in controversy exceeds $5,000,000. First, because the Court cannot determine the number of putative class members, it cannot calculate the amount in controversy with respect to the proposed classes. See Krivonyak v. Fifth Third Bank, No. CIV.A. 2:09-CV-00549, 2009 WL 2392092, at *6 (S.D.W. Va. Aug. 4, 2009) (“Without knowing how many people suffered injury, it is impossible to estimate the amount in controversy.”); Lanham v. Nationstar Mortg., LLC, 169 F. Supp. 3d 658, 662 (S.D.W. Va. 2016) (“[t]he mere possibility that the plaintiff and the proposed class could meet that requirement is not enough to give this court jurisdiction.”). Moreover, there are no factual allegations in the FAC that suggest how much in actual damages Plaintiff or the putative class members might be entitled to receive if their claims are successful (e.g., the cost of credit monitoring, etc.) So, even if the Court were to generously assume that 500 current and former employees were the victims of actual data misuse as a result of the Data Breach (which would be an unsupported assumption as explained above), there are no factual allegations from which the Court could find that they each have incurred or will incur an average of $10,000 in potential damages. This is particularly true because “emotional distress” damages for fear of

potential harm are not available to establish standing in this context. See Beck, 848 F.3d at 271– 73; Capiau, 2024 WL 3747191, at *7. Therefore, Plaintiff has not established the required amount in controversy to support diversity jurisdiction under 28 U.S.C. § 1332(d). Finally, even though the Court concludes that it appears that it lacks jurisdiction under 28 U.S.C. § 1332(d), because it has raised the issue sua sponte it will allow the Parties to file supplemental proof regarding whether the Court has or lacks diversity jurisdiction as ordered below. In the event that the preponderance of the evidence does not support the Court’s jurisdiction, this matter will be dismissed without prejudice. If the Court is convinced that it has jurisdiction then it will render a final decision on Defendant’s motion to dismiss for lack of

standing. IV. ORDER NOW THEREFORE IT IS ORDERED THAT: 1. A decision on Defendant’s Motion to Dismiss (Doc. No. 19) is DEFERRED; and 2. The Parties are each given an opportunity to file a memorandum of no more than 10 pages on or before thirty days from the date of this order submitting supplemental proof with respect to the issue of the Court’s diversity jurisdiction as discussed above; and 3. In the absence of such proof that establishes the Court’s jurisdiction, this action will be dismissed without prejudice by summary order without further proceedings. SO ORDERED ADJUDGED AND DECREED.

Signed: December 16, 2024

“tga Kenneth D. Bell ey, United States District Judge % ie of