Travelers Excess and Surplus Lines Company as subrogee of Mills Enterprise Holdings, LLC d/b/a Mills Auto Center, Inc. d/b/a Mills Motor, Inc. d/b/a Mills Auto Enterprises, Inc. d/b/a Willmar Motors, LLC d/b/a Brainerd Lively Auto, LLC v. CDK Global, LLC

• Court: District Court, N.D. Illinois
• Decided: October 15, 2025
• Docket: 1:25-cv-06701
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

TRAVELERS EXCESS AND SURPLUS LINES COMPANY as subrogee of MILLS ENTERPRISE HOLDINGS, No. 25 CV 6701 LLC d/b/a MILLS AUTO CENTER, INC. d/b/a MILLS MOTOR, INC. d/b/a Judge Jeremy C. Daniel MILLS AUTO ENTERPRISES, INC. d/b/a WILLMAR MOTORS, LLC d/b/a BRAINERD LIVELY AUTO, LLC, Plaintiff

v.

CDK GLOBAL, LLC, Defendant

MEMORANDUM OPINION AND ORDER This matter is before the Court on Defendant CDK Global, LLC’s (“CDK”) motion to dismiss the amended complaint. (R. 17.) Plaintiff Travelers Excess and Surplus Lines Company1 (“Travelers”), an insurer acting as subrogee and assignee to Mills Enterprise Holdings, LLC (“Mills”), alleges in the amended complaint that CDK halted Mills’ access to vital business management software following a data breach. As a result, Mills could not operate its business, and Traveler’s indemnified Mills and assumed Mills’ claims against CDK. For the reasons stated in this order, CDK’s motion is granted in part and denied in part.

1 The plaintiff, acting as subrogee of a different company, filed another, substantially similar case against the defendant. See Travelers Excess & Surplus Lines Co. v. CDK Global, LLC, No. 25 C 6699 (N.D. Ill.). The Court treats these two cases as related because they involve the same issues of fact and law. See L.R. 40.4(a)(2). BACKGROUND CDK provides “Dealer Management Systems” (DMS), which are software systems that auto-dealers use to manage their businesses.2 (R. 5 ¶ 2.)3 The DMS,

among other things, compiles “dealer-specific data” used for “essential functions such as sales, parts, service, repairs, and warranties.” (Id. ¶¶ 2, 7.) Mills, an auto- dealership group, uses the defendant’s DMS software and entered into a written agreement with the defendant to that effect. (Id. ¶¶ 7, 19.) On June 19, 2024, the defendant cut off Mills’ access to the DMS software. (Id. ¶ 9.) This was due to “a catastrophic-level cyberattack on [the defendant’s] own computer systems.” (Id. ¶ 10.) Because of this, Mills had “no ability to operate its

business for an extended period of time[,] . . . no way to access dealership-specific data and information upon which it had to rely to fashion an alternative business setup[,] . . . [and] customers sought out competitor dealerships.” (Id. ¶ 63.) The defendant did not restore Mills’ access until July 2024. (Id. ¶ 23.) After gaining access, Mills had “to update necessary data within the software system.” (Id.) The plaintiff alleges the defendant “promoted and emphasized the benefits of its technology business and the

software system, as well as CDK’s accompanying security and safety,” but

2 This description of the events underlying the plaintiff’s claims is drawn from the amended complaint and is presumed true for the purpose of resolving the pending motion. Virnich v. Vorwald, 664 F.3d 206, 212 (7th Cir. 2011). 3 For ECF filings, the Court cites to the page number(s) set forth in the document’s ECF header unless citing to a particular paragraph or other page designation is more appropriate. For documents filed under seal, the Court cites the sealed version of the documents while attempting not to reveal any information that could be reasonably deemed confidential. Confidential information is discussed to the extent necessary to explain the path of the Court’s reasoning. See In re Specht, 622 F.3d 697, 701 (7th Cir. 2010); Union Oil Co. of Cal. v. Leavell, 220 F.3d 562, 568 (7th Cir. 2000). nonetheless “fail[ed] to implement reasonable security.” (Id. ¶¶ 13, 16.) The plaintiff paid $329,126.00 in indemnity payments to Mills under its insurance policy as a result of Mills’ damages. (Id. ¶ 2.)

The plaintiff filed this suit bringing three claims: negligence and gross negligence (Count I), negligent training and supervising (Count II), and breach of contract (Count III).4 (Id. ¶¶ 34–68.)

LEGAL STANDARD “[A] motion to dismiss for failure to state a claim tests the sufficiency of the complaint . . . .” McReynolds v. Merrill Lynch & Co., Inc., 694 F.3d 873, 879 n.4 (7th Cir. 2012). “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). The Court “constru[es] the complaint in the light most favorable

to the plaintiffs, accepting as true all well-pleaded facts, and drawing reasonable inferences in the plaintiffs’ favor.” McReynolds, 694 F.3d at 879. ANALYSIS I. NEGLIGENCE CLAIMS (COUNTS I & II)

The defendant argues that Counts I and II should be dismissed because they are barred by the economic loss doctrine, and because they fail to plausibly allege

4 Jurisdiction is proper under 28 U.S.C. § 1332. “Federal courts hearing state law claims under diversity or supplemental jurisdiction apply the forum state’s choice of law rules to select the applicable state substantive law. . . . When no party raises the choice of law issue, the federal court may simply apply the forum state’s substantive law.” McCoy v. Iberdrola Renewables, Inc., 760 F.3d 674, 684 (7th Cir. 2014). those claims’ elements. (R. 17 at 1–2.) The Court agrees with the defendant’s first argument and therefore does not address the second. The economic loss doctrine, referred to under Illinois law as the Moorman

doctrine, “bars tort recovery for purely economic losses based on failure to perform contractual obligations.” Catalan v. GMAC Mortg. Corp., 629 F.3d 676, 692–93 (citing Moorman Mfg. Co. v. Nat’l Tank Co., 435 N.E.2d 443, 448–49 (Ill. 1982)). “Illinois applies Moorman to services as well as the sale of goods because both business contexts provide ‘the ability to comprehensively define a relationship’ by contract.” Cmty. Bank of Trenton v. Schnuck Mkts., Inc., 887 F.3d 803, 813 (7th Cir. 2018)

(quoting Congregation of the Passion, Holy Cross Province v. Touche Ross & Co., 636 N.E.2d 503, 514 (Ill. 1994)). “The Moorman court reiterated that ‘economic loss’ is defined as ‘damages for inadequate value, costs of repair and replacement of the defective product, or consequent loss of profits—without any claim of personal injury or damage to other property.’” Hecktman v. Pac. Indem. Co., 59 N.E.3d 868, 872 (Ill. App. Ct. 2016) (quoting Moorman Mfg. Co., 435 N.E.2d at 449). There are three exceptions to the Moorman doctrine:

(1) where the plaintiff sustained damage, i.e., personal injury or property damage, resulting from a sudden or dangerous occurrence; (2) where the plaintiff's damages are proximately caused by a defendant’s intentional false representation (i.e., fraud); and (3) where the plaintiff’s damages are proximately caused by a negligent misrepresentation by a defendant in the business of supplying information for the guidance of others in their business transactions. Id. at 873. “The doctrine reflects the principle that there are varying degrees of quality, all commercially acceptable, that parties to a commercial transaction are free to bargain over if they choose,” and “[d]isputes later arising from the character of the materials used should be determined under principles of contract law, and should be controlled by the requirements imposed by the parties’ own undertaking.” Sienna Ct.

of Condo. Ass’n v. Champion Aluminum Corp., 129 N.E.3d 1116, 1119 (Ill. 2018) (quoting Collins v. Reynard, 607 N.E.2d 1185, 1188 (Ill. 1992) (Miller, C.J., concurring)). According to the plaintiff, the Moorman doctrine is inapplicable because the negligence claims here are predicated on duties the defendant owed to Mills outside of the contract. (R. 24 at 23–25.) Specifically, the plaintiff argues the defendant owed

extra-contractual duties because it provided “professional services.” (Id. at 24–25.) The plaintiff relies on Congregation of the Passion, Holy Cross Province v. Touche Ross & Co. (Congregation), 636 N.E.2d 503, where the Illinois Supreme Court addressed whether the Moorman doctrine “bar[red] recovery in tort for accountant malpractice.” Id. at 512. Though recognizing that the “doctrine is applicable to the service industry . . . where the duty of the party performing the service is defined by the contract that he executes with his client,” it held that certain service professionals

such as accountants have additional duties outside of the contract. Id. at 514. The Moorman doctrine does not bar claims based on these extra-contractual duties. Id. The court explained, While a client contracts with an accountant regarding some general matters, an accountant must make his own decisions regarding many significant matters, and the final decision he makes is not necessarily contingent on the contract he executes with his client. An accountant may offer different levels of service, such as audited or unaudited preparation of financial statements, but within these levels of service, the client is not required or expected to be able to direct the conduct of the accountant through contractual provisions. A client should know that an accountant must make certain decisions independently, and the client had the right to rely on the accountant's knowledge and expertise when those decisions are made by the accountant. This knowledge and expertise cannot be memorialized in contract terms, but is expected independent of the accountant's contractual obligations. Id. at 514–15. In summary, the Congregation court held, “Application of the Moorman doctrine limiting recovery of purely economic losses to contract, therefore, is inappropriate where a relationship results in something intangible.” Id. at 515. That is not the case here. Key to Congregation’s analysis was what the plaintiff contracted for. See id. Here, Mills did not contract with the defendant for intangible professional services like those accountants or lawyers offer. “At the end of the day, [the defendant] provides software, and software is a product.” See Five-Star AudioVisual, Inc. v. Unique Bus. Sys. Corp., 769 F. Supp. 3d 840, 857 (N.D. Ill. 2025). Indeed, this is how it is described in the amended complaint: “CDK’s software system is a unique type of good or product.” (R. 5 ¶53.) “[S]elling software [is not] the same thing as selling knowledge, advice, expertise, or other information to guide someone else.” See Five-Star AudioVisual, Inc., 769 F. Supp. at 858. To be sure, the negligence claims are based on cybersecurity-related services the defendant provides. (See, e.g., R. 5 ¶ 15.) But the core issue remains the same: the defendant’s alleged negligence damaged only the software product it provided. See Turner v. GAC Quality, LLC, 671 F. Supp. 3d 897, 905 (N.D. Ill. 2023) (rejecting the argument that the economic loss doctrine did not apply “because [the plaintiff] pleaded that [the defendant’s] negligent repairs damaged” the product). The plaintiff’s additional authorities, though specific to data breaches, are no

more persuasive. In re Mondelez Data Breach Litigation, Nos. 23 C 3999, 23 C 4249, 2024 WL 2817489 (N.D. Ill. June 3, 2024), involved the theft of employees’ personal identifying information (“PII”) from their employer, not damage to any product or service the defendant in that case provided. Id. at *1. Similarly, the Illinois Court of Appeals concluded in Flores v. Aon Corp., 242 N.E.3d 340 (Ill. App. Ct. 2023), that the doctrine did not apply because the negligence claim concerning PII stolen in the

context of “insurance services plaintiffs were receiving through their employers,” not a product, as this case involves. Id. at 361. Finally, this Court’s ruling denying a motion to dismiss in Wittmeyer v. Heartland Alliance for Human Needs & Rights, No. 23 C 1108, 2024 WL 182211 (N.D. Ill. Jan. 17, 2024), was based on the lack of any contract at all between the parties, id. at *3, which is not the case here, (R. 5 ¶ 19). The Court is more persuaded by Perdue v. Hy-Vee, Inc., 455 F. Supp. 3d 749 (C.D. Ill. 2020). In that case, due to a data breach that exposed payment information,

the plaintiff alleged that she “went weeks without access to her account while awaiting a replacement [payment] card.” Id. at 761. The court concluded that the “lost time and an inability to use or access funds due to a data breach are economic losses.” Id.; cf. Constantinou v. Global Fin. Credit, LLC, 190 N.E.3d 859, 864, 870–71 (Ill. App. Ct. 2021) (affirming that lost time value of money is an economic loss). Similar here, all of Mills’ alleged damages flow from its loss of access to the defendant’s product. (See R. 5 ¶¶ 22–24, 44.) And there is no allegation of personal injury or damage to other property, only damage from Mills’ inability to conduct its business. (Id.) “One of the policies behind the economic loss rule is the recognition that the

economic consequences of any single accident are virtually limitless.” In re Chi. Flood Litig., 680 N.E.2d 265, 274 (Ill. 1997). The proper guard against such consequences is to contract for that protection, not tort actions. Finally, the plaintiff argues generally that “[t]he facts supporting two of [the exceptions to Moorman] are alleged in the case, and the development of these issues and legal arguments that may follow will occur after [the defendant] answers the

[amended c]omplaint.” (R. 24 at 26.) First, the plaintiff seems to invoke the “property damage” exception, pointing to the allegations of “non-economic damage” and “damage to Mills’ property (data held by [the defendant] and damaged by [the defendant]’s conduct).” (Id. (citing R. 5 ¶¶ 21–24).) The general allegation of “non- economic damage” is conclusory. The remaining argument that the plaintiff alleges “damage to Mills’ property” is inconsistent with what the amended complaint says. It alleges Mills needed “to update necessary data.” (R. 5 ¶ 23.) Setting aside whether

the data is “other property”—also necessary for this exception to apply—the plaintiff does not allege that it was damaged, only that Mills lost access to the data and later needed to update it. (See id.) As discussed above, the Moorman doctrine bars this type of tort recovery. Second, the plaintiff seems to invoke the “negligent misrepresentation” exception. (R. 24 at 26.) “[W]here the plaintiff’s damages are proximately caused by a negligent misrepresentation by a defendant in the business of supplying information for the guidance of others in their business transactions,” Hecktman, 59 N.E.3d at 873. This exception applies where “the end product [was] the ideas, not the

documents or other objects into which the ideas [were] incorporate.” First Midwest Bank, N.A. v. Stewart Title Guar. Co., 823 N.E.2d 168, 169 (Ill. App. Ct. 2005) (alterations in original). “In contrast, when the information offered by the defendant relates to the defendant’s tangible goods and/or noninformational goods or services, the information is considered merely ancillary or incidental . . . .” Id. That is the case here. The plaintiff alleges the defendant is a “technology and software company,” (R.

5 ¶ 8); the alleged misrepresentations all relate to how the defendant provided and serviced its software product, making those services ancillary to a noninformational good, (see id. ¶¶ 52–42). See, e.g., Publ’ns Int’l Ltd. v. Mindtree Ltd., No. 13 C 5532, 2014 WL 3687316, at *5 (N.D. Ill. July 24, 2014) (“[A]ny information that [the defendant] provided to [the plaintiff] while building the website was purely ancillary to the ultimate product and service—the website and the management of it.”). Accordingly, the negligent misrepresentation exception is inapplicable.

For these reasons, the Moorman doctrine bars the plaintiffs’ tort actions, and Counts I and II are dismissed. II. BREACH OF CONTRACT CLAIM (COUNT III)

To successfully state a claim, Count III, the breach of contract claim, must allege “the existence of a valid and enforceable contract, performance by the plaintiff, breach of the contract by the defendant, and resultant damages or injury to the plaintiff.” Razor Cap. v. Antaal, 972 N.E.2d 1238, 1246 (Ill. App. Ct. 2012). The defendant makes two arguments for dismissing Count III: that the plaintiff “never pleads with required specificity what terms of the contract CDK breached,” and that

it fails to adequately plead damages.5 (R. 17 at 2.) Regarding the defendant’s first argument, it is true that “some courts in this district have required plaintiffs at the pleading stage to point to the specific contractual provision they claim was breached, [but] most do not.” See Burke Auto. Grp., Inc. v. FCA US, LLC, 780 F. Supp. 3d 765, 773 (N.D. Ill. 2025). Even without citation to a particular contract provision, “[t]he case can move forward so long as the

plaintiff has alleged enough facts to put the defendant on notice of the contractual duty that it breached.” See Souza v. Erie Ins. Co., No. 22 C 3744, 2023 WL 4762712, at *4 (N.D. Ill. July 25, 2023). The amended complaint achieves this. It includes allegations that the defendant and Mills entered into a written agreement, and that the agreement required the defendant to provide Mills with its product. (R. 5 ¶ 19.) The plaintiff also alleges that the defendant shut down access to the software “without advance notice and without adequate explanation” from June to July of

2024. (Id. ¶¶ 20, 23.) This sufficiently puts the defendant on notice of the alleged contractual obligation and breach. The defendant further argues that the plaintiff does nothing to address provisions in Mills’ written agreement with the defendant,

5 The defendant also argues the plaintiff fails to plausibly allege unconscionability. (R. 19 at 14–15.) It is unclear what the defendant requests the Court do with these allegations. Regardless, it appears from the amended complaint that the plaintiff alleges only the contract’s damages limitations are invalid under this theory. (See R. 5 ¶¶ 66–67.) Because this affects the amount of damages and not whether the complaint states a claim, the Court sees no reason to address this issue at the motion to dismiss stage. which “recognize[] the possibility of service interruptions or cyber incidents and contain[] specific obligations arising therefrom.” (R. 19 at 20.) But even so, the defendant does not argue these provisions prove that no contractual duty existed or

that no breach occurred; it argues only that the amended complaint does not address them. That is not a basis for dismissal.6 See Tamayo v. Blagojevich, 526 F.3d 1074, 1081 (7th Cir. 2008) (citation modified) (“A complaint need not allege all, or any, of the facts logically entailed by the claim.”). Moving to the damages issue, the defendant argues that the allegations going both to the damages’ existence and to causation are conclusory. (See R. 19 at 21–22.)

That is not true. The plaintiff alleges that, because Mills lost access to the software, it “was unable to conduct the regular business of its dealerships, including sales, parts, service, and warranty, and most other aspects of its business.” (R. 5 ¶ 24.) The amended complaint continues, “As a result of [the defendant’s] voluntary decisions and affirmative actions[ cutting off access to its software,] . . . Mills had no way to access dealership-specific data and information upon which it had to rely to fashion an alternative business setup,” and its “customers sought out competitor

dealerships.” (Id. ¶ 63.) These damages and causation allegations were sufficiently

6 The defendant points out that “certain parties named in the [amended] complaint . . . are seemingly not included in the” agreement. (R. 18 at 21 n.6.) Each of these “parties” are “doing business as” or “d/b/a” designations, and “[g]enerally, the designation ‘d/b/a’ or ‘doing business as’ is merely descriptive of the person or corporation doing business under some other name and does not create a distinct entity.” See Gen. Ins. Co. of Am. v. Clark Mall, Corp., 361 F. Supp. 2d 968, 973 (N.D. Ill. 2009). clear for the defendant to argue the economic loss doctrine bars tort recovery; they are surely clear enough to meet the low standards required for pleadings.

CONCLUSION The defendant’s motion to dismiss [17] is granted in part and denied in part. The motion is granted as to Counts I and II, and it is denied as to Count III. Any second amended complaint is due on or before October 23, 2025. The defendant shall answer the operative complaint on or before November 13, 2025.

Date: October 15, 2025 | é JEREMY C. DANIEL United States District Judge