Springer v. Johnson and Wales University

• Court: District Court, D. Rhode Island
• Decided: April 30, 2025
• Docket: 1:24-cv-00399
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF RHODE ISLAND

) DANIELLA SPRINGER, WILLIAM ) MOORE, and ARIEL VOLQUEZ, ) Plaintiff, ) ) C.A. No. 24-cv-399-JJM-PAS v. ) Consolidated with C.A. No. 24-cv-409 ) JOHNSON & WALES UNIVERSITY, ) Defendant. ) )

ORDER Plaintiffs Daniella Springer, William Moore, and Ariel Volquez sued Defendant Johnson & Wales University (“JWU”) for damages resulting from a data breach that occurred when cybercriminals hacked JWU’s network. JWU moves to dismiss the Amended Complaint, arguing that Plaintiffs lack standing to bring their claims and, alternatively, that their claims fail to state a claim under Rule 12(b)(6) of the Federal Rules of Civil Procedure. ECF No. 16.1 I. BACKGROUND In July 2024, JWU discovered that a third-party criminal actor hacked its network. It immediately attempted to secure its network. One month later, JWU informed those whose PII, which included names and Social Security numbers, may have been accessed of the network breach. A month after that, JWU sent notice to

1 Mr. Moore filed a separate action, C.A. No. 24-cv-409, that was consolidated with this case and JWU filed a Motion to Dismiss that action as well. ECF No. 13. The Amended Complaint and briefing on JWU’s motion are identical in his case though the docket numbers vary. To ensure clarity in citation, the Court will cite to the docket numbers from the lead case throughout this Order. those individuals that there was no evidence that the data had been misused, but it identified the personal information that may have been accessed. Plaintiffs here are two former JWU students and a former JWU employee who,

as a condition of their enrollment or employment, provided JWU with their PII. They allege that they had an implied contract with JWU by which JWU agreed to safeguard and protect their PII, to keep such information secure and confidential, and to timely and accurately notify Plaintiffs if their data had been breached and compromised or stolen. Plaintiffs allege that JWU’s security measures were inadequate and, as a result, criminals obtained access to their PII. By failing to

prevent the disclosure of their PII to cybercriminals, JWU put Plaintiffs at a risk of identity theft, financial fraud, and other serious harms. Plaintiffs also assert that because of the exposure of their PII, they have incurred costs associated with protecting their credit and have suffered a loss of privacy. Plaintiffs allege that the cybercriminals may exploit the PII they obtained by selling the data on the dark web for hundreds of dollars per piece of data, thereby depriving Plaintiffs of the value of their PII.

Plaintiffs filed this four-count suit, seeking both injunctive relief and money damages for negligence (Count I), breach of implied contract (Count II), invasion of privacy (Count III), and unjust enrichment (Count IV). JWU moves to dismiss the entire Amended Complaint for lack of standing under Rule 12(b)(1) of the Federal Rules of Civil Procedure and, alternatively, Rule 12(b)(6) for failure to state a claim. II. STANDARD OF REVIEW When evaluating a motion to dismiss under Rule 12(b)(1), the Court must determine whether the facts alleged in the complaint, “taken at face value,” support

subject matter jurisdiction. , 873 F.3d 32, 35 (1st Cir. 2017). In addition, “the Court should apply a standard of review ‘similar to that accorded a dismissal for failure to state a claim’ under subsection 12(b)(6).” , 693 F. Supp. 3d 87, 94–95 (D. Mass. 2023) (quoting , No. 16-cv-11113, 2017 WL 706597, at *2 (D. Mass. Feb. 22, 2017); , 905 F. Supp. 2d 414, 416 (D.R.I. 2012)).

To survive a motion to dismiss for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6), a plaintiff must present facts that make her claim plausible on its face. , 550 U.S. 544, 570 (2007). To decide plausibility, the Court must first review the complaint and separate conclusory legal allegations from allegations of fact. , 711 F.3d 49, 53 (1st Cir. 2013) (citation omitted). When reviewing the complaint, the Court must draw all inferences in favor of the plaintiffs. ,

752 F.3d 114, 117 (1st Cir. 2014). Next, the Court must consider whether the remaining factual allegations give rise to a plausible claim of relief. To state a plausible claim, a complaint need not detail factual allegations but must recite facts sufficient at least to “raise a right to relief above the speculative level.” , 550 U.S. at 555 (citation omitted). A pleading that offers “labels and conclusions” or “a formulaic recitation of the elements of a cause of action” cannot suffice. , 556 U.S. 662, 678 (2009) (internal quotation marks omitted) (quoting , 550 U.S. at 555). “Nor does a complaint suffice if it tenders naked assertion[s] devoid of further factual

enhancement.” (alteration in original) (internal quotation marks omitted) (quoting , 550 U.S. at 557); , 654 F.3d 153, 159 (1st Cir. 2011) (internal quotation marks omitted) (citation omitted) (“[C]ombined allegations, taken as true, must state a plausible, not a merely conceivable, case for relief.”). III. DISCUSSION

Because it is a threshold jurisdictional issue, the Court will address Plaintiffs’ standing first. A. Standing–Rule 12(b)(1) “[P]laintiffs bear the burden of demonstrating that they have standing,” and must do so “‘with the manner and degree of evidence required at the successive stages of the litigation.’” , 594 U.S. 413, 430-31 (2021) (quoting , 504 U.S. 555, 561 (1992)). Plaintiffs “must demonstrate

standing for each claim that they press and for each form of relief that they seek.” (citing , 554 U.S. 724, 734 (2008)). “To establish standing, a plaintiff must show an injury in fact caused by the defendant and redressable by a court order.” , 599 U.S. 670, 676 (2023). An injury in fact involves the invasion of a legally protected interest that is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.” , 504 U.S. at 560 (citations omitted). Alleged future harm must be impending or substantially likely to occur; “it is not enough that the harm might occur at some future time.” , 672 F.3d 64, 71 (1st Cir. 2012).

First, the Court considers Plaintiffs’ standing to recover money damages. In this case, the Amended Complaint alleges that the breach has caused: (i) actual identity theft; (ii) the loss of the opportunity to control how their PII is used; (iii) the compromise, publication, and/or theft of their PII; (iv) out-of-pocket expenses associated with the prevention, detection, and recovery from identity theft, tax fraud, and/or unauthorized use of their PII for Plaintiffs’ and Class Members’ respective lifetimes; (v) lost opportunity costs associated with effort expended and the loss of productivity addressing and attempting to mitigate the present and future consequences of the Data Breach, including but not limited to efforts spent researching how to prevent, detect, contest, and recover from tax fraud and other identity theft; (vi) costs associated with placing freezes on credit reports; (vii) the continued risk to their PII, which remains in Defendant’s possession and is subject to further unauthorized disclosures so long as Defendant fails to undertake appropriate and adequate measures to protect the PII in their continued possession; and (viii) present and future costs in the form of time, effort, and money that will be expended to prevent, detect, contest, and repair the impact of the compromise of PII as a result of the Data Breach for the remainder of the lives of Plaintiffs and the Class Members. ECF No. 13 ¶¶ 149, 184. In this case, only Mr. Volquez alleges that he has experienced actual identity theft in the form of an increase in spam calls inquiring about his banking information.2 JWU argues that this allegation is not enough to plausibly allege a harm traceable to the data breach.

2 In considering the threat of future risk, the First Circuit also gave weight to the “high-risk” nature of the PII stolen, which included Social Security numbers. , 72 F.4th 365, 376 (1st Cir. 2023); Previously, the First Circuit had found in that an individual whose PII was implicated in a data breach did not have standing to sue for damages where she did not allege that her PII had been accessed by any unauthorized individual. at

79. But the First Circuit Court of Appeal’s recent decision in held that a plaintiff had standing to sue for damages even if her PII had not yet been misused, where a co-plaintiff’s PII stolen in the same breach had been used. 72 F.4th 365, 375-76 (1st Cir. 2023). The court reasoned that because one person’s data taken in the breach had been misused, it was “likely that other portions of the stolen data will be similarly misused.” at 376. “ makes pellucid that

both 1) actual identity theft of plaintiff’s PII and 2) risk of future identity theft, after actual identity theft of another individual affected by the same breach has occurred, combined with other indicia of risk, are independent bases to establish an Article III injury.” , 723 F. Supp. 3d 97, 102–03 (D. Mass. 2024). In light of Plaintiffs’ allegations, which the Court accepts as pled in accordance with the motion to dismiss standard of review, the Court finds that Plaintiffs have standing to bring their claims for money damages.

Next, Plaintiffs seek injunctive relief “enjoining Defendant from engaging in the wrongful conduct complained of herein pertaining to the misuse and/or disclosure of Plaintiffs’ and Class Members’ PII, and from refusing to issue prompt, complete

, 995 F.3d 295, 302 (2d Cir. 2021) (“the dissemination of high-risk information such as Social Security numbers and dates of birth–especially when accompanied by victims' names–makes it more likely that those victims will be subject to future identity theft or fraud.”) and accurate disclosures to Plaintiffs and Class Members;” “compelling Defendant to utilize appropriate methods and policies with respect to data collection, storage, and safety, and to disclose with specificity the type of PII compromised during the

Breach;” and “requiring restitution and disgorgement of the revenues wrongfully retained as a result of Defendant’s wrongful conduct.” ECF No. 13 at p. 37. To have standing to prevent this future harm, Plaintiffs would have to allege they face “certainly impending or substantial risk that [their] PII will once again be exposed to hackers.” , 723 F. Supp. 3d at 102 (citing , 461 U.S. 95, 109 (1983) (explaining that plaintiff’s lack of standing rests on

the “speculative nature of his claim that he will again experience injury as the result of [defendant’s] practice even if [it] continued.”)). Plaintiffs fear future misuse of their PII, but an injunction would not protect Plaintiffs from future misuse. , 72 F.4th at 378 (too speculative to infer that a new hacker would gain access to PII). Their allegations on this front are not plausibly alleged, are too speculative to confer standing to enjoin JWU’s conduct going forward, and “would not redress the harm caused by the current or a future breach.” (citing , 72 F.4th at 378). Thus,

the Court finds that Plaintiffs have standing to bring their claims for money damages, but not injunctive relief. B. FAILURE TO STATE A CLAIM–RULE 12(b)(6) Now that standing for Plaintiffs’ damages claims have been established, the Court moves to JWU’s Motion to Dismiss for failure to state a claim. 1. Negligence–Count I “To maintain a cause of action for negligence, the plaintiff must establish four elements: (1) a legally cognizable duty owed by defendant to plaintiff; (2) breach of

that duty; (3) that the conduct proximately caused the injury; and (4) actual loss or damage.” , 984 A.2d 620, 625 (R.I. 2009). Plaintiffs allege that JWU had a duty to exercise reasonable care in safeguarding, securing, and protecting their PII from being compromised, lost, stolen, misused, and/or disclosed to unauthorized parties, breached that duty by failing to protect Plaintiffs’ PII and prevent the data breach, but for JWU’s breach, Plaintiffs’ PII would not have been

compromised, and they suffered damages such as anxiety, emotional distress, loss of privacy, and other economic and non-economic losses, and are at an increased risk of identity theft or fraud. ECF No. 13 ¶¶ 124-153. JWU argues that Plaintiffs have not properly alleged any of the elements of negligence, but the Court finds that these allegations are sufficient at this stage to satisfy the 12(b)(6) plausibility standard. That said, JWU argues that the economic loss doctrine precludes Plaintiffs’ recovery in tort because the Amended Complaint only seeks economic damages. This

doctrine dictates that a plaintiff seeking purely economic losses who has suffered no personal injury or property damage cannot recover them through a negligence claim. , 936 A.2d 1272, 1275-76 (R.I. 2007). After reviewing the Complaint, the Court finds that Plaintiffs allege emotional distress, increased stress, and anxiety because of the data breach because of the actions they have been forced to undertake, the loss of control over their PII, and the fact that they must remain vigilant for the rest of their lives. ECF No. 13 ¶¶ 81, 84, 106, 107, 150. The Complaint’s damages allegations, while general, are sufficient at the pleading stage to overcome the hurdle the economic loss doctrine might pose. Thus, the Court

concludes that Plaintiffs have stated a claim for negligence3 and denies JWU’s Motion to Dismiss it. 2. Breach of Implied Contract–Count II Plaintiffs alleged that they had an implied contact with JWU whereby they provided their PII to JWU as a condition of enrollment or employment and JWU agreed to safeguard their PII. JWU argues that this claim should be dismissed

because there was no implied contract or meeting of the minds about Plaintiffs’ PII. An implied contract “is a form of express contract wherein the elements of the contract are found in and determined from the relations of, and the communications between the parties, rather than from a single clearly expressed written document.” , 692 A.2d 665, 669 (R.I. 1997). An implied contract “‘must contain all the elements of an express contract.’” , 249 A.2d 414, 416 (R.I. 1969) (quoting 17 C.J.S. Contracts § 4 at pp. 557-560). The

“essential elements of contracts ‘implied in fact’ are mutual agreement, and intent to promise, but the agreement and the promise have not been made in words and are implied from the facts.”

3 JWU also seeks dismissal of a negligence per se claim. Plaintiffs did allege certain statutory violations in their Amended Complaint but concede that they do not plead this as a separate cause of action. Plaintiffs allege that there was a meeting of the minds and an understanding that JWU would safeguard their PII after Plaintiffs turned it over when JWU so required. Plaintiffs do not reference any document or conversation showing that

JWU made any promises or agreements about the safety or security of their PII, but that is not necessarily dispositive of their claim at this stage. Plaintiffs alleged several facts in support of a plausible claim for breach of an implied contract. ECF No. 13 ¶¶ 155-62. They allege that they “entrusted their PII to Defendant as a condition of enrolling as students and/or as a condition of employment.” ¶ 155. In return, JWU “agreed to safeguard and protect such information, to keep such

information secure and confidential, and to timely and accurately notify Plaintiffs and the Class if their data had been breached and compromised or stolen.” While Plaintiffs have not explicitly pled that JWU “explicitly promised to protect [Plaintiff’s Sensitive Information] from hackers in ... [express] contracts, ‘it is difficult to imagine how, in our day and age of data and identity theft, the mandatory receipt of Social Security numbers or other sensitive personal information would not imply the recipient’s assent to protect the information sufficiently.’”

, 278 F. Supp. 3d 739, 751 (S.D.N.Y. 2017) (quoting , No. 16-CV-1958, 2016 WL 9280242, at *9 (N.D. Cal. Sept. 14, 2016)); , 662 F. Supp. 3d 338, 366 (N.D.N.Y. 2023). When an individual is required to turn over sensitive information as a condition of employment or to be enrolled as a student, it only makes sense that the employer or university would accept that PII with the promise that it would keep it safe. Plaintiffs plausibly allege an implied contract and breach thereof; accordingly, the Court denies JWU’s motion with respect to Plaintiffs’ implied contract claim. 3. Invasion of Privacy–Count III

JWU moves to dismiss Plaintiffs’ invasion of privacy claim on two grounds: first, they argue that the claim fails under the and pleading standards because Plaintiffs did not specify that they were bringing the claim under R.I. Gen. Laws § 9-1-28.1 and second, they argue substantively that Plaintiffs fail to allege a vital element of an invasion of privacy claim. The Court agrees with JWU and finds that Plaintiffs’ invasion of privacy claim must be dismissed for the latter

reason.4 “If private information is not obtained through unlawful or improper means, there is no invasion of privacy under the statute.” , C.A. No. 18-341-JJM-PAS, 2018 WL 6523090, at *4 (D.R.I. Dec. 12, 2018) (citing , 699 A.2d 856, 863-64 (R.I. 1997). In this case, JWU required, and Plaintiffs willingly provided, PII as part of Plaintiffs’ employment or education. Plaintiffs argue in their opposition to the Motion to Dismiss that JWU deceived them

into revealing their PII, but do not allege that conduct in their Amended Complaint. The Amended Complaint does allege that cybercriminals hacked JWU’s system and took Plaintiffs’ PII. While those hackers may have invaded Plaintiffs’ privacy, JWU

4 Even though Plaintiffs failed to identify the specific statutory section in their Amended Complaint that they allege applies here, the Court declines to dismiss the claim on procedural grounds when there is a substantive ground for dismissal. did not. Thus, the Court finds that Plaintiffs’ invasion of privacy claim against JWU fails to state a claim. The Court dismisses Count III. 4. Unjust Enrichment–Count IV

“To recover for unjust enrichment, a claimant must prove: (1) that he or she conferred a benefit upon the party from whom relief is sought; (2) that the recipient appreciated the benefit; and (3) that the recipient accepted the benefit under such circumstances that it would be inequitable for [the recipient] to retain the benefit without paying the value thereof.” , 873 A.2d 101, 113 (R.I. 2005) (quoting , 694 A.2d 670, 673 (R.I. 1997)). JWU moves to

dismiss, arguing that Plaintiffs fail to allege they conferred any benefit on the university because Plaintiffs did not pay JWU for data security. Plaintiffs counter that they did confer benefits on JWU through their relationships with JWU as employees and students. This claim fails for several reasons. First, Plaintiffs allege that they conferred a benefit on JWU by giving it their PII, that JWU derived a benefit from that data, and enriched itself by saving its own money rather than spending it on methods to

secure the PII from cybercriminals. ECF No. 13 ¶¶ 177-186. But Plaintiffs do not allege that they paid for or provided any additional PII in exchange for data security that they were promised and never received. , No. 22-CV-10797, 2023 WL 5938606, at *4 (D. Mass. Sept. 12, 2023). Second, Plaintiffs argue that JWU profited because Plaintiffs paid tuition and provided services to JWU but that is not tantamount to inequitable unjust enrichment–in exchange for tuition, Ms. Springer and Mr. Moore received an education and in exchange for work, Ms. Volquez was paid a wage. Nor are there any allegations that JWU profited in any way from storing Plaintiffs’ PII. Third, Plaintiffs also fail to

allege that JWU gained any benefit from exposing Plaintiffs’ PII to cybercriminals. Because Plaintiffs’ allegations fail to plausibly plead unjust enrichment, the Court grants JWU’s Motion to Dismiss it. III. CONCLUSION Plaintiffs have standing to bring their Amended Complaint against JWU; their claims for invasion of privacy and unjust enrichment, however, fail to state a claim.

JWU’s Motion to Dismiss Count III and IV is GRANTED. ECF No. 16 (C.A. No. 24- cv-399); ECF No. 13 (C.A. No. 24-cv-409). Plaintiffs’ Counts I and II for negligence and breach of implied contract survive the motion.

IT IS SO ORDERED.

_________________________________ John J. McConnell, Jr. Chief United States District Judge

April 30, 2025