Stern v. Academy Mortgage Corporation

Opinion

THE UNITED STATES DISTRICT COURT DISTRICT OF UTAH

LAZARO STERN, CELESTE ALLEN, LISA MEMORANDUM DECISION AND KUCHERRY, PETER SMITH, SHARON ORDER GRANTING IN PART AND THOMPSON, and CHARLY BATES, DENYING IN PART [ECF NO. 75] individually and on behalf of others similarly DEFENDANT’S MOTION TO DISMISS situated, PLAINTIFFS’ SECOND AMENDED CONSOLIDATED CLASS ACTION Plaintiffs, COMPLAINT

v. Case No. 2:24-cv-00015-DBB-DAO

ACADEMY MORTGAGE CORPORATION, District Judge David Barlow

Defendant.

Before the court is Defendant Academy Mortgage Corporation’s Motion to Dismiss Plaintiffs’ Second Amended Consolidated Class Action Complaint,1 Plaintiffs’ response brief,2 and Defendant’s reply.3 Plaintiffs are former customers and employees of Defendant.4 Defendant asserts (1) Plaintiffs lack standing and (2) Plaintiffs failed to state a claim for relief.5 BACKGROUND6 As part of their mortgage-lending business, Academy collects and stores Personally Identifiable Information (“PII”) of its customers and employees, such as first and last names,

1 Mot. to Dismiss Pls.’ Second Am. Consolidated Class Action Compl. (“MTD”), ECF No. 75, filed June 27, 2025. 2 Mem. of Law in Opp’n to Def.’s Mot. to Dismiss Second Am. Consolidated Class Action Compl. (“Opp.”), ECF No. 76, filed July 24, 2025. 3 Reply in Supp. of Mot. to Dismiss Pls.’ Second Am. Consolidated Class Action Compl. (“Reply”), ECF No. 77, filed August 7, 2025. 4 See Second Am. Consolidated Class Action Compl. (“SAC”), ECF No. 74, filed June 27, 2025. 5 See MTD. 6 Because the court is deciding a motion to dismiss, the following factual allegations taken from the second amended complaint are treated as true. 1 dates of birth, and Social Security numbers.7 Academy may also require other sensitive

information, including credit scores, credit history, income, and savings.8 On or around March 21, 2023, Academy discovered that an unauthorized third party had accessed its computer network (the “Data Breach”).9 The Data Breach gave the third party access to approximately 284,443 individuals’ PII.10 Academy was hacked by ransomware gang BlackCat/Alphv (“BlackCat”).11 Plaintiffs provide a screenshot of BlackCat’s blog, where BlackCat takes credit for the Data Breach and issues a ransom demand to Academy in May 2023.12 The blog post also contains an update that Academy refused to pay the ransom demand and that “a big base of customer’s full data will be uploaded within 2-3 days here.”13 Further, on or around May 14, 2023, BlackCat published “a plethora” of the stolen PII on

the dark web.14 The documents “posted on the dark web from the Data Breach include completed mortgage applications, financial statements, signed and notarized mortgage documents, mortgage statements, fingerprints, signatures, driver’s licenses (including several from Utah and Texas), and passports.”15 Months later, on December 20, 2023, Academy publicly announced the Data Breach by sending letters notifying customers and employees that it had detected the presence of an unauthorized third party in its network.16

7 SAC at ¶¶ 2, 111–12. 8 Id. 9 Id. at ¶ 119. 10 Id. at ¶ 124. 11 Id. at ¶ 127. 12 Id. at ¶¶ 127–29. 13 Id. 14 Id. at ¶ 131. 15 Id. at ¶ 132. 16 Id. at ¶ 134. 2 Plaintiffs Lazaro Stern,17 Celeste Allen,18 Lisa Kucherry,19 Peter Smith,20 and Charly

Bates21 are former Academy customers who received the notice that their PII was exposed. Plaintiff Sharon Thompson is a former Academy employee whose PII was also reportedly exposed during the Data Breach.22 These Plaintiffs have spent time trying to mitigate the risk of identity theft due to the Data Breach.23 They also report an increase in spam calls and feeling anxiety due to the Data Breach.24 Mr. Smith further claims his identity was stolen after the Data Breach.25 Mr. Smith’s credit report indicates that a loan was taken out in his name on April 21, 2023, about a month after the Data Breach.26 Mr. Smith alleges that BlackCat was responsible for the fraudulent loan and used the information from the Data Breach to acquire it.27

Mr. Bates also claims his identity was stolen. Following the Data Breach, there were unauthorized charges on his credit card, and he received a phone call seeking to verify a credit card fraudulently opened in his name.28

17 Id. at ¶¶ 23–24. 18 Id. at ¶¶ 38–39. 19 Id. at ¶¶ 52–53. 20 Id. at ¶¶ 64–65. 21 Id. at ¶¶ 94–95. Defendant asserts that Plaintiff Bates is a former employee of Academy Mortgage, not a former customer as is alleged in the complaint. Compare MTD 3, 6–7 with SAC ¶ 94; See also Opp. 4 n.2, 8–9; Reply 2–3. Either way, the analysis is the same. 22 Id. at ¶¶ 78–79. 23 Id. at ¶¶ 32–33, 46–47, 58–59, 74–75, 88, 100–101. 24 Id. at ¶¶ 33, 35, 47, 49, 59, 61, 75, 89, 101, 103. 25 Id. at ¶ 72. 26 Id. 27 Id. at ¶ 73. 28 Id. at ¶ 103. 3 STANDARD I. Article III Standing Dismissal is appropriate under Federal Rule of Civil Procedure 12(b)(1) when the court lacks subject matter jurisdiction over the claims for relief asserted in the complaint. “The burden of establishing subject matter jurisdiction is on the party asserting jurisdiction.”29 That said, at the motion to dismiss stage, a court must accept as true all well-pleaded facts and construe the fact allegations in the light most favorable to the plaintiff.30 Standing is “an element of subject matter jurisdiction.”31 To meet the standing requirements, plaintiffs must show that they suffered (1) an injury in fact (2) that is fairly traceable to the challenged conduct of the defendant and (3) that it is likely that the injury will be redressed by a favorable decision.32

“To establish injury in fact, a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’”33 “A ‘concrete’ injury must be ‘de facto’; that is, it must actually exist.”34 A particularized interest “must affect the plaintiff in a personal and individual way.”35 Generally, “threatened injury must be certainly impending to constitute injury in fact,” although

29 Port City Properties v. Union Pac. R. Co., 518 F.3d 1186, 1189 (10th Cir. 2008) (citing Basso v. Utah Power & Light Co., 495 F.2d 906, 909 (10th Cir. 1974)). 30 Thomas v. Kaven, 765 F.3d 1183, 1190 (10th Cir. 2014). 31 Hill v. Vanderbilt Cap. Advisors, LLC, 702 F.3d 1220, 1224 (10th Cir. 2012) (citations omitted). 32 Lujan v. Defenders of Wildlife, 504 U.S. 555, 559–61 (1992). 33 Spokeo, Inc. v. Robins, 578 U.S. 330, 339 (2016), as revised (May 24, 2016) (quoting Lujan, 504 U.S. at 560). 34 Id. at 340. 35 Id. at 339. 4 the Supreme Court has noted that in some cases it has “found standing based on a ‘substantial risk’ that the harm will occur.”36 The traceability element of standing “requires a plaintiff to ‘allege a substantial likelihood that the defendant’s conduct caused [the] plaintiff’s injury in fact.’”37 “The injury must not be ‘the result of the independent action of some third party not before the court’” nor can a plaintiff rely on a “speculative chain of possibilities.”38 II. Failure to State a Claim for Relief Dismissal is appropriate under Federal Rule of Civil Procedure 12(b)(6) when the complaint, standing alone, is legally insufficient to state a claim on which relief may be granted. Each cause of action must be supported by sufficient, well-pled facts to be plausible on its face.39

In reviewing a complaint on a Rule 12(b)(6) motion to dismiss, factual allegations are accepted as true and reasonable inferences are drawn in a light most favorable to the plaintiff.40 But the court disregards “assertions devoid of factual allegations” that are nothing more than “conclusory” or “formulaic recitation[s]” of the law.41 DISCUSSION Defendant challenges the Plaintiffs’ standing and whether they have stated a plausible claim for relief. The court considers each in turn.

36 Clapper v. Amnesty Intern. USA, 568 U.S. 398, 410, 414 n.5 (2013). 37 Masterson v. IMA Fin. Grp., Inc., No. 2:23-cv-02223, 2023 WL 8647157, at *3 (D. Kan. Dec. 14, 2023) (quoting Santa Fe All. for Pub. Health & Safety v. Santa Fe, 993 F.3d 802, 814 (10th Cir. 2021)). 38 Blood v. Labette Cnty. Med. Ctr., No. 5:22-cv-04036, 2022 WL 11745549, at *4 (D. Kan. Oct. 20, 2022) (quoting Clapper, 568 U.S. at 414)). 39 Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). 40 Thomas v. Kaven, 765 F.3d 1183, 1190 (10th Cir. 2014). 41 Ashcroft v. Iqbal, 556 U.S. 662, 678, 681 (2009). 5 I. Article III Standing Data breach cases raise distinct challenges under Article III standing, particularly regarding whether plaintiffs have adequately alleged a concrete injury in fact.42 The Tenth Circuit “has not yet addressed Article III standing in a data breach case” but “almost all other circuits have.”43 This court previously undertook a survey of decisions from other circuits addressing the issue and relevant Supreme Court precedent.44 In sum, two majority rules have emerged.45 First, the plaintiffs must allege actual misuse of the PII traceable to the data breach, such as fraud, identity theft, or posting the PII on the dark web.46 An unauthorized third-party merely accessing the PII, without further misuse, is not a concrete, imminent injury.47

Second, allegations of misuse by some plaintiffs may plausibly show that other plaintiffs face imminent harm because “actual misuse of a portion of the stolen dataset increases the risk

42 Defendant, for the first time in its reply brief, also raised a challenge to Plaintiffs’ standing to seek injunctive relief. Reply 4–5. Because Defendant did not address this issue in their initial motion to dismiss, Plaintiffs were deprived of an opportunity to respond. Accordingly, the court declines to consider Defendants’ challenge to injunctive relief at this time. 43 In re Progressive Leasing Breach Litig., No. 2:23-cv-00783, 2025 WL 213744, at *3 (D. Utah Jan. 16, 2025) (quoting Maser v. Commonspirit Health, No. 1:23-cv-01073, 2024 WL 2863579, at *4 (D. Colo. Apr. 16, 2024)). 44 Id. at *3–9. 45 Id. (Collecting cases and concluding: “In summary, although the pre- and post-TransUnion district and circuit court cases are not entirely uniform, common trends appear. The majority of courts both pre- and post-TransUnion require some evidence of misuse of PII, such as posting PII on the dark web, identity theft, or fraud, to find an imminent injury—the Second Circuit . . . being a notable exception. Further, many courts have generally allowed all plaintiffs to demonstrate standing at the motion to dismiss stage following an allegation that other plaintiffs’ data has been misused, based on the premise that actual misuse of a portion of the stolen dataset increases the risk that other information in the same dataset will be misused in the future.”) (internal citations omitted). 46 Id. 47 Id. Contra Bohnak v. Marsh & McLennan Companies, 79 F.4th 276 (2d Cir. 2023) (finding standing solely based on unauthorized third-party access of PII). 6 that other information in the same dataset will be misused in the future.”48 And “[o]nce the

injury is deemed imminent, plaintiffs can potentially allege a concrete injury based on lost money and time spent on mitigating the imminent harm, and perhaps the emotional distress occasioned by the imminent misuse.”49 The court adopts those majority rules here.50 In the case at hand, Plaintiffs allege three actual misuses of the stolen PII traceable to the Data Breach: (1) certain PII being published on the dark web; (2) Mr. Smith’s identity fraud when a loan was fraudulently taken out in his name; and (3) Mr. Bates’ identity fraud with unauthorized charges on his credit card and an unauthorized credit card taken out in his name. First, Plaintiffs allege that BlackCat published “a plethora” of the stolen PII on the dark

web.51 To support this allegation, Plaintiffs included a blog post from BlackCat saying that it planned to publish the PII, as well as third-party reports confirming the publication.52 Plaintiffs further allege that the “[d]ocuments posted on the dark web from the Data Breach include completed mortgage applications, financial statements, signed and notarized mortgage documents, mortgage statements, fingerprints, signatures, driver’s licenses (including several from Utah and Texas), and passports.”53

48 Id. at *9 (citing Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365, 375 (1st Cir. 2023); Bohnak, 79 F.4th at 288; Krant v. UnitedLex Corp., No. 23-2443, 2024 WL 3511300, at *2 n.2 (D. Kan. July 23, 2024); Maser, 2024 WL 2863579, at *6.). 49 Id. 50 See In re Progressive, 2025 WL 213744 at *9 (adopting the same majority rules). 51 SAC ¶ 131. 52 Id. ¶¶ 129, 131. 53 Id. ¶ 132. 7 This is enough to plead actual misuse of the PII. “[A]llegations that the plaintiffs’ PII was available for sale on the Dark Web following a data breach—and could therefore be purchased by cybercriminals at any moment to commit identity theft or fraud—provide[s] strong support for the conclusion that those plaintiffs had established an Article III injury in fact.”54 “Moreover, the publication of Plaintiffs’ PII on the dark web is akin to disclosure of private information, which the Supreme Court specifically recognized as a concrete intangible harm [in TransUnion LLC v. Ramirez].”55 Defendant argues that Plaintiffs have not specifically alleged that any named Plaintiffs’ PII was included in the published data, citing to this court’s decision in In Re Progressive Leasing Breach Litigation. There, this court found the plaintiffs’ allegations that a “sample” of

the PII was published to the dark web was not sufficient—though the court ultimately found standing based on specific plaintiffs’ allegations that their data was published.56 But here, Plaintiffs allege that a “plethora” of the stolen PII was published, not only a sample. Plaintiffs plead that BlackCat published “completed mortgage applications, financial statements, signed and notarized mortgage documents, mortgage statements, fingerprints, signatures, driver’s licenses (including several from Utah and Texas), and passports” on the Dark

54 McMorris v. Carlos Lopez & Associates, 995 F.3d 295, 302 (2d Cir. 2021); see also Green-Cooper v. Brinker Int'l, Inc., 73 F.4th 883, 889–90 (11th Cir. 2023) (“The fact that hackers took credit card data and corresponding personal information . . . and affirmatively posted that information for sale on [the dark web] is the misuse for standing purposes that we said was missing in Tsao.”); Clemens v. ExecuPharm Inc., 48 F.4th 146, 157 (3d Cir. 2022) (“Because we can reasonably assume that many of those who visit the Dark Web, and especially those who seek out and access [the hacking group’s] posts, do so with nefarious intent, it follows that Clemens faces a substantial risk of identity theft or fraud by virtue of her personal information being made available on underground websites.”). 55 In re Progressive, 2025 WL 213744, at *11 & n.151 (citing TransUnion LLC v. Ramirez, 594 U.S. 413, 425 (2021)). 56 Id. at *10–12. 8 Web.57 BlackCat’s blog post also declares its intent to publish “a big base of customer data[,]”

which Plaintiffs allege was carried out as threatened.58 Plaintiffs also plead that the Plaintiffs’ and Class members’ data was published on the dark web, even if they do not identify whose data was published by name.59 Given the presence of the named Plaintiffs’ PII in the Data Breach, it is likely that their PII is included in the “plethora” of stolen data published on the dark web. Plus, Ms. Allen specifically pleads that her “PII is now available on the Dark Web, where it has been exposed to the public and is now accessible to cybercriminals and identity thieves.”60 At the pleadings stage, where the court applies all reasonable inferences in Plaintiffs’ favor, the alleged disclosure of the stolen PII on the dark web is enough to plead actual misuse. Second, Plaintiffs allege actual misuse based on Mr. Smith’s identity fraud. Plaintiffs

allege that cybercriminals took out a loan using Mr. Smith’s identity just 31 days after the Data Breach61 and that “ALPHV BlackCat was responsible for this fraudulent loan—and used the PII that ALPHV BlackCat had exfiltrated from Academy during the Data Breach . . . .”62 There is a clear temporal link between the Data Breach and the alleged fraud (31 days), plus the stolen PII63 would enable someone to take out a fraudulent loan.64 While the PII was not published to the

57 SAC at ¶ 132. 58 Id. at ¶¶ 128–29, 131. 59 Id. at ¶¶ 6, 13, 15, 17. 60 Id. at ¶ 45. 61 Id. at ¶ 72. 62 Id. at ¶ 73. 63 See id. at ¶ 132 (“Documents posted on the dark web from the Data Breach include completed mortgage applications, financial statements, signed and notarized mortgage documents, mortgage statements, fingerprints, signatures, driver’s licenses (including several from Utah and Texas), and passports.”) 64 See Blood, 2022 WL 11745549 at *5 (Plaintiffs’ allegations were not traceable to the data breach when plaintiff did “not plead any facts suggesting how the mere possession of their Social Security numbers and names would enable someone to make unauthorized charges on an existing account (instead of, for example, opening a new account).”). 9 dark web until after the fraudulent loan was taken out,65 Plaintiffs allege that BlackCat was

responsible for the fraudulent loan.66 It is reasonable to infer that a criminal hacking group would use the PII for their own fraudulent activities, or sell it to associated groups, in the time between gaining the data and publishing it on the dark web for all other cybercriminals to use. Thus, Mr. Smith’s fraudulent loan, considering all reasonable inferences in Plaintiffs’ favor, pleads actual misuse that is sufficiently traceable to the Data Breach.67 Third, Plaintiffs allege that Mr. Bates also experienced identity theft. They claim that he had unauthorized charges on an existing credit card and another card fraudulently opened in his name.68 But it is unclear how the data in the breach could have been used to place charges on an existing card.69 And the Plaintiffs only allege in the complaint that Mr. Bates received a phone

call requesting verification of a fraudulently opened credit card.70 Whether a card was actually opened, whether any money was spent on the fraudulent card, and the timing of the call is all unaddressed. Without more, this is insufficient to plead actual misuse of the PII traceable to the Data Breach.

65 See SAC ¶¶ 72, 131 (alleging PII was published on the dark web on or around May 14, 2023, while alleging the fraudulent loan was taken out on April 21, 2023). 66 Id. at ¶ 73. 67 In its previous order, the court determined that Plaintiffs failed to plead sufficient facts that Mr. Smith’s alleged fraudulent loan was traceable to the Data Breach. Mem. Decision and Order Granting Def.’s Mot. to Dismiss at 8–9, ECF No. 62, filed January 17, 2025. Where Plaintiffs did not claim the PII was published on the Dark Web and provided no other “allegation about how the Data Breach caused Mr. Smith’s identity to be stolen[,]” there was an insufficient “causal link” between the Data Breach and Mr. Smith’s alleged fraudulent loan. Id. But now, as explained above, Plaintiffs plead and argue a sufficient causal link—adding allegations that BlackCat was responsible for the fraudulent loan, as well as emphasizing the temporal connection between the fraudulent loan and the Data Breach. 68 SAC ¶ 103. 69 See Blood, 2022 WL 11745549 at *5 (Plaintiffs’ allegations were not traceable to the data breach when plaintiff did “not plead any facts suggesting how the mere possession of their Social Security numbers and names would enable someone to make unauthorized charges on an existing account (instead of, for example, opening a new account).”). 70 SAC ¶ 103. 10 All that said, Plaintiffs have sufficiently alleged actual misuse of the stolen PII when it was published on the dark web and through Mr. Smith’s fraudulent loan. This plausibly suggests that harm is imminent for the other Plaintiffs. This is because actual misuse for some Plaintiffs “increases the risk that other information in the same dataset will be misused in the future.”71 And reasonable steps taken to mitigate an imminent injury are sufficiently concrete for Article III standing.72 Here, all the other Plaintiffs allege a substantial risk of impending harm, lost time trying to mitigate the harm, and emotional harm, among other injuries.73 This is sufficient for Article III standing. Therefore, the named Plaintiffs and the putative class have Article III standing to seek damages resulting from the Data Breach.

II. Failure to State a Plausible Claim for Relief Next, Defendant argues that Plaintiffs failed to state a plausible claim for relief under 12(b)(6). The court considers each of Plaintiffs’ claims in turn. A. Negligence (Count I) Defendant challenges Plaintiffs’ negligence count on two bases: First, Plaintiffs have not alleged present damages; and second, Plaintiffs’ claims are barred by the economic loss rule. Defendant’s argument that Plaintiffs have not alleged present damages simply repackages the standing argument that Plaintiffs have not suffered a concrete injury.74 But, as fully

71 In re Progressive, 2025 WL 213744, at *9 (citing Webb, LLC, 72 F.4th at 375; Bohnak, 79 F.4th at 288; Krant, 2024 WL 3511300, at *2 n.2; Maser, 2024 WL 2863579, at *6.). 72 Id. 73 SAC ¶¶ 32, 33, 46, 47, 58, 59, 74, 75, 88, 89, 100, 101. 74 See, e.g., Zimmerman v. Highmark, Inc., 780 F. Supp. 3d 588, 603 (W.D. Pa. 2025) (“[Defendant’s] second argument—lack of a cognizable injury—is just a variation of its standing argument. For the same reasons that Plaintiffs’ injuries are concrete, they satisfy the injury element for a negligence claim.”). 11 considered above, Plaintiffs sufficiently alleged present injury. Plaintiffs allege their PII has been published on the dark web, Mr. Smith alleges identity fraud, and all other Plaintiffs allege present harm from steps taken to mitigate imminent injuries. These are present harms, not future harms, and are sufficient to support a negligence claim at the motion to dismiss stage.75 Defendant next argues that the economic loss rule bars Plaintiffs’ negligence claims. “In general, the economic loss rule places limits on tort claims for purely economic losses.”76 “It is a ‘judicially created doctrine that marks the fundamental boundary between contract law, which protects expectancy interests created through agreement between the parties, and tort law, which protects individuals and their property from physical harm by imposing a duty of reasonable care.’”77 Plaintiffs respond that they fit within the independent duty exception. This exception

allows recovery for economic losses when “the defendant owes the plaintiff a duty independent of any contractual relationship between the parties.”78 Defendant does not respond to Plaintiffs’ arguments that they fit within the independent duty exception. Whether or not the economic loss rule applies to data breach questions is a complicated question of law, with significant difference across states.79 The Utah Supreme Court

75 See, e.g., In re Am. Med. Collection Agency, Inc. Customer Data Sec. Breach Litig., No. cv-19-2904, 2021 WL 5937742, at *16 (D.N.J. Dec. 16, 2021) (“Each of the Plaintiffs in Groups I and II adequately alleged that the hackers accessed their Personal Information, which has resulted in either tangible or intangible harm. These allegations are sufficient to satisfy the damages prong of Plaintiffs’ negligence claim at this stage.”); Sackin v. Transperfect Glob., Inc., 278 F. Supp. 3d 739, 749 (S.D.N.Y. 2017) (“[T]he Complaint adequately alleges that Plaintiffs face an imminent threat of identity theft and have purchased preventive services to mitigate the threat. These mitigation expenses satisfy the injury requirements of negligence.”); Zimmerman, 780 F. Supp. 3d at 603 (Plaintiff satisfied the damages prong of their negligence claim “[b]y alleging that they have taken mitigation efforts . . . .”). 76 Hayes v. Intermountain Geoenv’t Sercs., 2021 UT 62, ¶ 16. 77 Id. 78 Id. ¶ 34. 79 See, e.g., In re Target Corp. Customer Data Security Breach Litigation, 66 F. Supp. 3d 1154, 1171–76 (D. Minn. 2014) (considering eleven different states economic-loss rules as applied to data breach litigation and determining 12 has not clearly ruled on the issue. And the court will not make Defendant’s arguments for it.80

Thus, Defendant has not shown that the economic loss rule applies. B. Breach of Implied Contract (Count II) Defendant next challenges Plaintiffs’ claims for Breach of Implied Contract. “In Utah, an implied contract ‘results when there is a manifestation of mutual assent, by words or actions or both, which reasonably are interpretable as indicating an intention to make a bargain with certain terms or terms which reasonably may be made certain.’”81 Neither the Utah Courts nor the Tenth Circuit has addressed whether an implied contract may be found in a data breach litigation context. Elsewhere, some courts have found that merely providing PII to another party is sufficient to create an implied contract, while others require the

plaintiff to allege additional conduct by the defendant showing mutual assent.82

that some states allowed the negligence claim to continue, while others bared the claim.); Catherine M. Sharkey, Can Data Breach Claims Survive the Economic Loss Rule?, 66 DePaul L. Rev. 339, 362 (2017). 80 See United States v. Vontress, No. 22-3119, 2024 WL 5074634, at *4 (10th Cir. 2024) (“[Plaintiff’s] cursory statements, without supporting analysis and case law, fail to constitute the kind of briefing needed for us to address his arguments. We decline to make his arguments for him.”) (internal citations omitted); Mitchell v. City of Moore, 218 F.3d 1190, 1199 (10th Cir. 2000); Northington v. Jackson, 973 F.2d 1518, 1521 (10th Cir. 1992) (“[T]he court should not assume the role of advocate.”). 81 Lopez v. Admin. Off. of Cts., 719 F.3d 1178, 1182 (10th Cir. 2013) (quoting Heideman v. Washington City, 155 P.3d 900, 908 (Utah App. 2007)). 82 Compare In re Am. Fin. Res., Inc. Data Breach Litig., No. 2:22-cv-01757, 2023 WL 3963804, at *8 (D.N.J. Mar. 29, 2023) (“In the data-breach context, the fact that a defendant required plaintiffs to provide personal information does not alone support the inference that the parties agreed for the defendant to secure this information. Instead, Plaintiff must allege some other conduct by the Defendant from which mutual assent for AFR safeguard Plaintiff's PII arose.”) (internal citations omitted), and In re Am. Med. Collection Agency, Inc., 2021 WL 5937742 at *19 (same), and Enslin v. The Coca-Cola Co., 136 F. Supp. 3d 654, 675 (E.D. Pa. 2015) (“claims that the []Defendants, through privacy policies, codes of conduct, company security practices, and other conduct, implicitly promised to safeguard his PII in exchange for his employment” were sufficient to sustain a breach of implied contract claim.), and Brush v. Miami Beach Healthcare Group Ltd., 238 F. Supp. 3d 1359, 1365 (S.D. Fla. 2017) (providing PII to company was not enough to create an implied contract on its own), and Longenecker-Wells v. Benecard Servs. Inc, 658 F. App’x 659, 662 (3d Cir. 2016) (“Plaintiffs have failed to plead any facts supporting their contention that an implied contract arose between the parties other than that [Defendant] required Plaintiffs’ personal information as a prerequisite to employment. This requirement alone did not create a contractual promise to safeguard that information, especially from third party hackers. . . . Plaintiffs here do not plead any company-specific documents or policies from which one could infer an implied contractual duty to protect Plaintiffs’ information.”) with Anderson 13 In the case at hand, an implied contract plausibly exists under either approach. Plaintiffs allege that, in addition to providing their PII to Defendant, Defendant’s Privacy Policy also shows mutual assent to an implied contract to care for the data. Plaintiffs allege: Academy’s Privacy Policy ensures customers and other related persons that it is “committed to ensuring that your information is secure” and it “use[s] commercially reasonable efforts to protect your personal information collected, used, stored, shared, or transferred as part of [its] Services from access, loss, misuse, alteration, or destruction by any unauthorized party.” It further states, “Academy protects data using administrative, technical, and physical safeguards” and that “when [it] use[s] third-party service providers, [it] ask[s] those providers to implement similar safeguards.”83 These statements from Defendant coupled with the alleged exchange of PII plausibly demonstrate mutual assent and an implied contract. Thus, Defendant’s motion to dismiss Count II is denied. C. Unjust Enrichment (Count III) Defendant next challenges Plaintiffs’ unjust enrichment claim. Under Utah law, unjust enrichment requires “(1) a benefit conferred . . . ; (2) an appreciation or knowledge by the conferee of the benefit; and (3) the acceptance or retention [of the benefit] by the conferee . . . under such circumstances as to make it inequitable for the conferee to retain the benefit without

v. Hannaford Bros., 659 F.3d 151, 153–54 (1st Cir. 2011), and In re Michaels Stores Pin Pad Litig., 830 F. Supp. 2d 518, 531 (N.D. Ill. 2011), and Castillo v. Seagate Tech., LLC, No. 16-cv-01958, 2016 WL 9280242, at *9 (N.D. Cal. Sept. 14, 2016) (“It is difficult to imagine how, in our day and age of data and identity theft, the mandatory receipt of . . . sensitive personal information would not imply the recipient’s assent to protect [the] information sufficiently.”) and In re Ambry Genetics Data Breach Litig., 567 F. Supp. 3d 1130, 1143–44 (C.D. Cal. 2021) (finding that plaintiffs adequately stated a breach of implied contract despite defendants not expressly agreeing to protect their PII where “[p]laintiffs allege[d] that they gave their [PII] to defendants for purposes of obtaining genetic testing, with the understanding that defendants would take adequate measures to protect the information”), and In re Target, 66 F. Supp. 3d at 1171 (concluding that the plaintiffs had sufficiently pleaded “an implied contract in which plaintiffs agreed to use their credit or debit cards to purchase goods at Target and Target agreed to safeguard plaintiffs’ personal and financial information”), and Gordon v. Chipotle Mexican Grill, Inc., 344 F. Supp. 3d 1231, 1247–48 (D. Col. 2018) (same). 83 SAC ¶ 114. 14 payment of its value.”84 Further, “[a] defendant is liable under the unjust enrichment prong of

quantum meruit only if he or she received a direct benefit from the plaintiff.”85 Neither Utah state courts nor the Tenth Circuit has addressed unjust enrichment claims in a data breach case. And the circuits and federal district courts that have addressed it are split on whether these claims can survive a motion to dismiss.86 That said, Utah state law governs the claim. Plaintiffs allege they conferred a monetary benefit upon Defendant either through the money paid for mortgage services or through labor provided as part of employment.87 And in exchange, Plaintiffs “should have received from Academy the services that were the subject of the transaction and should have had their PII protected with adequate data security.”88 Plaintiffs

further allege that Defendant “profited from Plaintiffs’ and Class members’ collected and retained data and used Plaintiffs’ and Class members’ PII for business purposes.”89

84 U.S. Fid. v. U.S. Sports Specialty, 2012 UT 3, ¶ 12 (quoting Rawlings v. Rawlings, 2010 UT 52, ¶ 29). 85 Jones v. Mackey Price Thompson & Ostler, 2015 UT 60, ¶ 65 (emphasis added). 86 The Eighth Circuit and many district courts have found that unjust enrichment claims are not sustainable in data breach cases, while the Eleventh Circuit and other district courts have conversely found that the unjust enrichment claims can survive the motion to dismiss stage. Compare Carlsen v. GameStop, Inc., 833 F.3d 903, 912 (8th Cir. 2016), and In re SuperValu, Inc., 925 F.3d 955, 966 (8th Cir. 2019), and Irwin v. Jimmy John’s Franchise, LLC, 175 F. Supp. 3d 1064, 1071–72 (C.D. Ill. 2016), and Lochridge v. Quality Temp. Servs., Inc., No. 22-cv-12086, 2023 WL 4303577 at *6–7 (E.D. Mich. June 30, 2023), and Haney v. Charter Foods N., LLC, 747 F. Supp. 3d 1093, 1113–14 (E.D. Tenn. 2024), and Cahill v. Mem’l Heart Inst., LLC, No. 1:23-cv-168, 2024 WL 4311648, at *21 (E.D. Tenn. Sept. 26, 2024), and Gordon, 344 F. Supp. 3d at 1249, and Webb v. Injured Workers Pharmacy, LLC, No. 22-cv-10797, 2023 WL 5938606 at *4 (D. Mass. Sept. 12, 2023), and Tate v. EyeMed Vision Care, LLC, No. 1:21-cv-36, 2023 WL 6383467 at *8 (S.D. Ohio Sept. 29, 2023), with Resnick v. AvMed, Inc., 693 F.3d 1317, 1328 (11th Cir. 2012), and In re Premera Blue Cross Customer Data Sec. Breach Litig., 198 F. Supp. 3d 1183, 1201 (D. Or. 2016), and Fox v. Iowa Health Sys., 399 F. Supp. 3d 780, 802–03 (W.D. Wis. 2019), and In re Target, 66 F. Supp. 3d at 1177–78, and In re Cap. One Consumer Data Sec. Breach Litig., 488 F. Supp. 3d 374, 412–13 (E.D. Va. 2020). 87 SAC ¶ 291. 88 Id. 89 Id. at ¶ 293. 15 These allegations do not state an unjust enrichment claim under Utah law. First, Plaintiffs do not allege facts suggesting that Defendant has received some benefit from retaining the PII. Plaintiffs do not allege that Defendant is selling the PII to third parties, using the PII for targeted marketing, or is in any way receiving ongoing benefits from holding the information.90 Second, insofar as Defendant used the PII for “business purposes,” this does not plausibly amount to unjust enrichment because Defendant provided the mortgage services or employment in exchange for the PII and payment.91 Third, insofar as Defendant allegedly benefitted from reduced costs by providing inadequate data security, that would not be a benefit directly conferred by the Plaintiffs, as required by Utah law.92 In short, Plaintiffs gave Defendant their PII and either money or labor in exchange for

either mortgage services or employment. Plaintiffs do not allege that Defendant failed to provide the mortgage services or employment, nor was unjustly enriched in any alternative way by their retention of the PII. Therefore, Plaintiffs’ unjust enrichment claim is dismissed. D. Invasion of Privacy (Count IV) Defendant next challenges Plaintiffs’ invasion of privacy claim because there was no intentional intrusion by the Defendant—but intentional intrusion is not a requirement for the type of invasion of privacy claim at issue here. The Utah Supreme Court has identified four separate

90 See In re Am. Med. Collection Agency, 2021 WL 5937742 at *18 (acknowledging that holding PII can be a benefit “in situations where businesses commoditize or receive an independent pecuniary benefit from holding the Personal Information.”). 91 See Gordon, 344 F. Supp. 3d at 1249 (“Plaintiffs paid for burritos; Plaintiffs received burritos.”). 92 See Concrete Prods. Co. v. Salt Lake Cnty., 734 P.2d 910, 912 (Utah 1987) (“We do not think that Salt Lake County was unjustly enriched by Concrete Products’ delivery of concrete for curbs and gutters to a third party. . . . The County will raise no revenue from the curbs and gutters, nor will it acquire a building with intrinsic value. Instead, it will incur the expenses of cleaning and maintaining curbs and gutters with no resale value or intrinsic economic worth.”); Lochridge, 2023 WL 4303577 at *6–7. 16 privacy claims, each with their own legal requirements.93 While a claim for intrusion upon

seclusion requires “an intentional substantial intrusion,” a claim for publicity given to private facts does not.94 Plaintiffs clearly cite the rule for public disclosure of private facts in the complaint.95 Thus, because Defendant’s sole argument concerns intentional intrusion—a requirement not applicable to a claim for public disclosure of embarrassing private facts— Defendant’s motion to dismiss this claim is denied. E. Violation of the California Customer Records Act (Count V) Plaintiffs’ complaint alleges violations of two sections of the California Customer Records Act (“CCRA”): Section 1798.82 and Section 1798.81.5. Plaintiffs concede in their briefing that Defendant is immune to any claim under Section 1798.81.5, leaving only the

Section 1798.82 claims.96 Section 1798.82 requires companies to disclose data breaches of PII to California residents “in the most expedient time possible and without unreasonable delay.”97 Further, “[t]o allege a ‘cognizable injury’ arising from Defendant’s alleged failure to timely notify Plaintiffs of the Data Breach, Plaintiffs must allege ‘incremental harm suffered as a result of the alleged delay in notification,’ as opposed to harm from the Data Breach itself.”98 For example, in In Re Solara Med Supplies, LLC, allegations that the defendant “waited nearly five months after discovering

93 Shattuck-Owen v. Snowbird Corp., 2000 UT 94, ¶ 11 (citing Stien v. Marriott Ownership Resorts, Inc., 944 P.2d 374, 380 (Utah Ct. App. 1997)). 94 Stein, 944 P.2d at 378, 380. 95 SAC at ¶ 299. 96 Opp. 18, n.11. 97 Cal. Civ. Code § 1798.82. 98 In re Solara Med. Supplies, LLC Customer Data Sec. Breach Litig., 613 F. Supp. 3d 1284, 1300 (S.D. Cal. 2020) (quoting Dugas v. Starwood Hotels & Resorts Worldwide, Inc., 2016 WL 6523428, at *7 (S.D. Cal. Nov. 3, 2016)). 17 the breach to notify them and that this delay prevented Plaintiffs from taking steps to protect their personal information from identify theft” was sufficient to allege incremental harm.99 Similarly, in In Re Arthur J. Gallagher, allegations of a nine-month delay and “that the delayed notice prevented them from timely mitigating, preventing, and repairing identity theft and the fraudulent use of their PII” was also sufficient to survive a motion to dismiss.100 Here, Plaintiffs allege that Defendant waited nine months to notify them of the breach, preventing them from timely mitigating any harm.101 This alleges incremental harm from the delay sufficient to survive Defendant’s motion to dismiss. F. Violation of the California Consumer Privacy Act (Count VI) Defendant next challenges Plaintiffs’ claim for violation of the California Consumer

Privacy Act (“CCPA”). First, Defendant argues that the “Plaintiffs simply restate the statutory requirements, providing conclusory allegations insufficient to state a claim under the CCPA.”102 Plaintiffs respond by citing to multiple paragraphs in the complaint that they allege provide factual assertions sufficient to support a claim under the CCPA.103 Defendant does not reply to Plaintiffs’ response, nor address Plaintiffs’ factual assertions at all.104 Defendant’s motion to dismiss on this ground is denied.105

99 Id. 100 In re Arthur J. Gallagher Data Breach Litig., 631 F. Supp. 3d 573, 589–90 (N.D. Ill. 2022). 101 SAC ¶ 6 (“Defendant’s failure to timely notify the victims of its Data Breach meant that Plaintiffs and Class members were unable to immediately take affirmative measures to prevent or mitigate the resulting harm.”). Plaintiffs acknowledge a scrivener’s error in paragraph 317 of the complaint stating the delay was only two months. Opp. 18 n.10. But the complaint makes sufficiently clear that the delay was nine months. SAC ¶¶ 6, 118, 134. 102 MTD 14. 103 Opp. 21–22. 104 Reply 9. 105 See Vontress, 2024 WL 5074634, at *4 (“[Plaintiff’s] cursory statements, without supporting analysis and case law, fail to constitute the kind of briefing needed for us to address his arguments. We decline to make his arguments 18 Second, Defendant summarily argues that Plaintiffs failed to comply with the notice requirement.106 Plaintiffs respond that the CCPA only requires written notice 30 days prior to the filing of the operative complaint.107 Plaintiffs assert that notice was provided more than 30 days prior to the operative second amended complaint at issue here when Mr. Bates filed his original complaint.108 Defendant does not respond to this argument or any of the cases cited by the Plaintiffs, merely asserting in conclusionary fashion that the claim should be dismissed for failure to comply with the notice requirement.109 Again, the court will not make Defendant’s arguments for it.110 Defendant has failed to show that the claim should be dismissed on this ground. G. Violation of the California Unfair Competition Law, the Washington Consumer Protection Act, and the Idaho Consumer Protection Act (Count VII, VIII, IX) Defendant also argues that claims under California’s Uniform Competition Law and Washington and Idaho’s Consumer Protection Acts should be dismissed. First, Defendant argues that Plaintiffs have not “lost money or property as a result of unfair competition” and therefore cannot state a claim for violation of the California Unfair Competition Law (“UCL”).111 Plaintiffs respond that lost time is considered an economic injury under California Law.112

for him.”) (internal citations omitted); Mitchell, 218 F.3d at 1199 (10th Cir. 2000); Northington, 973 F.2d at 1521 (“[T]he court should not assume the role of advocate.”). 106 MTD 14. 107 Opp. 20. 108 Id. 109 Reply 9. 110 See Vontress, 2024 WL 5074634, at *4 (“[Plaintiff’s] cursory statements, without supporting analysis and case law, fail to constitute the kind of briefing needed for us to address his arguments. We decline to make his arguments for him.”) (internal citations omitted); Mitchell, 218 F.3d at 1199 (10th Cir. 2000); Northington, 973 F.2d at 1521 (“[T]he court should not assume the role of advocate.”). 111 MTD 14. 112 Opp. 21–22 (citing In re Arthur Gallagher, 631 F. Supp. 3d at 588). 19 Defendant did not respond to or address this argument in any way. Thus, the court considers it conceded for this motion that lost time can support a UCL violation claim.113 Second, Defendant argues that Plaintiffs do not allege they suffered an injury to property, as required under the Washington Consumer Protection Act.114 Plaintiffs respond that Mr. Smith spending time responding to a fraudulent loan and Ms. Allen’s PII losing value due to being published on the dark web are injuries to property under Washington Law.115 Defendant does not respond to or address these arguments. Thus, the motion to dismiss this claim is denied. Third, Defendant argues that Plaintiffs have not alleged an ascertainable loss of money or property sufficient for a violation of the Idaho Consumer Protection Act.116 Plaintiffs respond that, under Idaho law, benefit of the bargain damages are an ascertainable loss of money.117

Plaintiffs allege they have not received the benefit of the bargain since Defendant failed to sufficiently fund data security measures.118 Once again, Defendant does not respond to or address Plaintiffs’ argument, instead repeating conclusory statements that Plaintiffs did not allege an ascertainable loss of money or property.119 As noted repeatedly, this approach is simply insufficient.120 Thus, the motion to dismiss this claim is also denied.

113 See Vontress, 2024 WL 5074634, at *4 (“[Plaintiff’s] cursory statements, without supporting analysis and case law, fail to constitute the kind of briefing needed for us to address his arguments. We decline to make his arguments for him.”) (internal citations omitted); Mitchell, 218 F.3d at 1199 (10th Cir. 2000); Northington, 973 F.2d at 1521 (“[T]he court should not assume the role of advocate.”). 114 MTD 15. 115 Opp. 22. 116 MTD 15. 117 Opp. 22–23 (citing Litster Frost Inj. Laws., PLLC v. Idaho INj. L. Grp., PLLC, 171 Idaho 1, 13 (2022)). 118 Id. 119 Reply 9. 120 See Vontress, 2024 WL 5074634, at *4 (“[Plaintiff’s] cursory statements, without supporting analysis and case law, fail to constitute the kind of briefing needed for us to address his arguments. We decline to make his arguments for him.”) (internal citations omitted); Mitchell, 218 F.3d at 1199 (10th Cir. 2000); Northington, 973 F.2d at 1521 (“[T]he court should not assume the role of advocate.”). 20 ORDER Defendant’s Motion to Dismiss Plaintiffs’ Second Amended Consolidated Class Action Complaint!?! is GRANTED in PART and DENIED in PART. Plaintiffs’ unjust enrichment claim is dismissed. Signed October 8, 2025. BY THE COURT Io David Barlow United States District Judge

1 ECF No. 75. 21