William Colley, individually and on behalf of all others similarly situated v. Neighbors Credit Union

• Court: District Court, E.D. Missouri
• Decided: March 30, 2026
• Docket: 4:25-cv-00687
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT EASTERN DISTRICT OF MISSOURI EASTERN DIVISION

WILLIAM COLLEY, individually and ) on behalf of all others similarly situated, ) ) Plaintiffs, ) ) v. ) Case No. 4:25-cv-00687-SRC ) NEIGHBORS CREDIT UNION, ) ) Defendant. )

Memorandum and Order William Colley asserts—individually, and on behalf of a putative class—that his personal identifying information sits for sale on the dark web, because hackers breached Neighbors’ data. In response, Neighbors filed a motion to dismiss along with a motion to compel arbitration. Having reviewed the parties’ briefing, the Court rules on Neighbors’ Motion. I. Factual Background The Court accepts the following well-pleaded facts as true for purposes of deciding Neighbors’ Motion to Dismiss. Neighbors is a “full service” credit union based in St. Louis, Missouri, with nine branches spread across the state. Doc. 21 at ¶ 2. Neighbors “offers a variety of financial services and products” to its customers. Id. at ¶ 27. But its relationship with each plaintiff in this case varies. Plaintiffs Johnson and Beinart are current Neighbors customers, doc. 21 at ¶¶ 181, 201, while Colley, Hollis, and Short-Shumate are former Neighbors customers, id. at ¶¶ 104, 159, 238. Putney and Beatty Jr. state that Neighbors obtained their personal identifying information, or PII, through its business and banking activities Id. at ¶¶ 123, 223. Putney had a line of credit maintained by Neighbors. Id. at ¶ 122. Beatty Jr.’s exact relationship with Neighbors goes unexplained in Plaintiffs’ Complaint. See id. at ¶¶ 222–37. In addition to Putney and Beatty Jr., Colley and Wilbur also state that Neighbors obtained their PII through its business and banking activities. Id. at ¶¶ 105, 142. However, in exhibits attached in support of its Motion, Neighbors clarified Colley and Wilbur’s specific relationship to it. See doc. 25. Colley purchased a vehicle on credit from “Mercedes Benz of Long at

Chattanooga.” Doc. 25-7 at 2 (The Court cites to page numbers as assigned by CM/ECF.). In his secured-vehicle-loan contract, the creditor assigned its interest in the loan to Credit Union Loan Source. Id. Similarly, Wilbur purchased a vehicle on credit from “U-J Chevrolet Co., Incorporated.” Doc. 25-9 at 2, 4. In Wilbur’s secured-vehicle-loan contract, the creditor also assigned its interest to Credit Union Loan Source. Id. Credit Union Loan Source then sold its interests in these secured-vehicle-loan contracts to National Cooperative Bank. Doc. 25-6 at ¶ A. National Cooperative Bank then sold its interests in these secured-vehicle-loan contracts to Neighbors pursuant to a master Purchase and Sale Agreement. Id. at ¶ D; doc. 25-1 at ¶ 12. The Purchase and Sale Agreement between National Bank Cooperative and Neighbors

stated that “the rights assigned by [National Cooperative Bank] to [Neighbors] . . . include the right to,” among other things, “pursue all remedies at law or otherwise that [National Cooperative Bank] may have with respect to the [secured-vehicle-loan contracts].” Doc. 25-6 at 4–5. And in Exhibit B to the Purchase and Sale Agreement, National Cooperative Bank assigned its interests in these loans to Neighbors. Doc. 25-6 at 13. Neighbors’ Chief Finance Officer— Janice Bennett—signed a declaration stating that “[t]he loan in which [Neighbors] ultimately purchased an ownership interest pursuant to the Purchase and Sale Agreement included auto loans for vehicle purchases made by Plaintiffs Colley and Wilbur.” Doc. 25-1 at ¶¶ 11–12. The Court does not consider these matters outside the pleadings in deciding Neighbors’ 12(b)(6) motion to dismiss, instead only considering them to decide (i) Neighbors’ challenge to the Court’s jurisdiction and (ii) Neighbors’ Motion to Compel Arbitration. Osborn v. United States, 918 F.2d 724, 728 n.4 (8th Cir. 1990); City of Benkelman v. Baseline Eng’g Corp., 867 F.3d 875, 882 (8th Cir. 2017).

In January 2025, Neighbors concluded that in September 2024 an unauthorized actor accessed files that contained Plaintiffs’ PII. Doc. 21 at ¶¶ 3, 33. According to Plaintiffs, the culprit behind the breach is the “notorious cybercriminal group” known as “Black Suit.” Id. at ¶¶ 40–41. Just a month after the hack, Black Suit started offering the stolen PII for sale on the “Dark Web.” Id. at ¶ 42. But Neighbors only started notifying individuals about the hack in early May 2025. Id. at ¶ 34. II. Procedural Background A few days after receiving notice of the hack, Colley sued Neighbors, individually, and on behalf of a putative class that currently includes seven other plaintiffs. See doc. 1; doc. 17 at 3 (consolidating Colley’s suit with seven identical putative class actions against Neighbors); doc.

21 (Plaintiffs’ operative complaint). Plaintiffs assert six common-law counts: (i) negligence, see doc. 21 at ¶¶ 274–306, (ii) negligence per se, see id. at ¶¶ 307–20, (iii) breach of implied contract, see id. at ¶¶ 321–32, (iv) unjust enrichment, see id. at ¶¶ 333–43, (v) breach of confidence, see id. at ¶¶ 344–55, and (vi) invasion of privacy, see id. at ¶¶ 356–73. A month later, Neighbors moved to dismiss Plaintiffs’ putative class action for lack of Article III standing, see Fed. R. Civ. P. 12(b)(1), or for failure to state a claim upon which the Court can grant relief, see Fed. R. Civ. P. 12(b)(6). Doc. 24. It also moved to compel arbitration for Plaintiffs Johnson, Beinart, Colley, and Wilbur. Id. Plaintiffs filed their response a month later, doc. 30, and a month after that, Neighbors filed its reply, doc. 31. Now with the issues fully briefed, the Court addresses Neighbors’ challenge to the Court’s jurisdiction. III. Art. III Standing To resolve any case on the merits, a court must have jurisdiction to do so. That includes

ensuring that the plaintiff satisfies the requirements of Article III standing. Pucket v. Hot Springs Sch. Dist. No. 23-2, 526 F.3d 1151, 1156–57 (8th Cir. 2008). Article III of the United States Constitution, by its own terms, limits the jurisdiction of the federal courts to “Cases” and “Controversies.” U.S. Const. art. III, § 2; Lujan v. Defs. of Wildlife, 504 U.S. 555, 559 (1992). That limitation, along with the corpus of federal constitutional standing caselaw that it animates, rests on a “single basic idea—the idea of separation of powers.” TransUnion LLC v. Ramirez, 594 U.S. 413, 422 (2021) (citation omitted). The separation-of-powers function performed by constitutional standing doctrine is simple: it “serv[es] to identify those disputes which are appropriately resolved through the judicial process.” Lujan, 504 U.S. at 560 (cleaned up). And because standing doctrine performs this critical function, it constitutes “an essential and

unchanging part of the case-or-controversy requirement of Article III.” Id. Federal courts are powerless to adjudicate disputes that do not qualify as “Cases” or “Controversies.” See id. at 559–60; DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 340–42 (2006). Standing doctrine enforces that case-or-controversy requirement: it aims to ascertain that before a federal court adjudicates a dispute, a bona fide case or controversy exists. See DaimlerChrysler Corp., 547 U.S. at 342. At the heart of standing doctrine is a core question: whether plaintiffs have a “personal stake” in the matter at hand. TransUnion LLC, 594 U.S. at 423. To put it in layman’s terms, “plaintiffs must be able to sufficiently answer the question: ‘What’s it to you?’” Id. (quoting Antonin Scalia, The Doctrine of Standing as an Essential Element of the Separation of Powers, 17 Suffolk U. L. Rev. 881, 882 (1983)). Sufficiently answering that question requires plaintiffs to show that they satisfy three specific conditions: (i) that they have alleged a cognizable injury, (ii) that the injury is “fairly

traceable to the defendant’s allegedly unlawful conduct,” (iii) and that the injury is likely to be redressed by the requested relief. California v. Texas, 593 U.S. 659, 668–69 (2021) (cleaned up). “[S]tanding is not dispensed in gross; rather, [a] plaintiff[] must demonstrate standing for each claim that [he] press[es] and for each form of relief that [he] seek[s].” TransUnion LLC, 594 U.S. at 431 (citations omitted). But in the context of a putative class action, the suit may proceed as long as one named plaintiff has standing. In re SuperValu, Inc., 870 F.3d 763, 768 (8th Cir. 2017). And “[a]t the pleadings stage, general factual allegations suffice to support standing.” Rydholm v. Equifax Info. Servs. LLC, 44 F.4th 1105, 1108 (8th Cir. 2022). A. Injury “To establish an injury in fact, a plaintiff must show an injury that is ‘concrete and

particularized’ and ‘actual or imminent, not conjectural or hypothetical.” Auer v. Trans Union, LLC, 902 F.3d 873, 877 (8th Cir. 2018) (quoting Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016)) (cleaned up). And when a plaintiff alleges an intangible harm, the Court must consider whether the alleged harm “has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Spokeo, 578 U.S. at 341. Though a plaintiff need not allege “an exact duplicate in American history and tradition,” one cannot judge an injury’s concreteness “based on contemporary, evolving beliefs about what kind of suits should be heard in federal courts.” TransUnion LLC, 594 U.S. at 424–25; see also Jones v. Bloomingdales.com, LLC, 124 F.4th 535, 540 (8th Cir. 2024) (“Breezy declarations of an intangible yet concrete injury without support won’t suffice.”) (cleaned up). Plaintiffs’ alleged concrete harms include: (i) invasion of privacy, (ii) theft of private information, (iii) diminished value of PII (iv) mitigation and lost opportunity costs, (v) actual

misuse of the compromised data resulting in an increase of spam and attempts to open fraudulent accounts, (vi) loss of the benefit of their bargain, and (vii) emotional harm. Doc. 21 at ¶ 8. In sum, they allege various intangible harms resulting from having their PII in the hands of bad actors. And as the Court noted above, in a putative class action only one plaintiff needs standing for the suit to proceed. SuperValu, 870 F.3d at 768. So because each Plaintiff alleges similar injuries to those of Colley, see doc. 25 at 22–23; see also doc. 21, the Court analyzes Colley’s alleged injuries. For the following reasons, the Court finds that Colley, and Plaintiffs more generally, have sufficiently pleaded an injury in fact. 1. Invasion of privacy First consider Colley’s alleged invasion of privacy. See TransUnion, 594 U.S. at 425

(stating that the intangible harm of disclosure of private information can constitute a concrete injury). Colley, a former Neighbors customer, states that he received a “personalized Data Breach letter” from Neighbors. Doc. 21 at ¶ 104. The letter stated that “his name and Social Security Number, had been exposed in the breach.” Id.; see also doc. 21-1 at 2 (a copy of Wilbur’s letter). And that his PII “has already been published—or will be published imminently” on the dark web. Doc. 21 at ¶ 111; see also id. at ¶ 114; id. at ¶¶ 41–42 (stating that “Black Suit appears to have already leaked the stolen Private Information on the Dark Web . . . . around October 18, 2024”). In response, Neighbors argues that Plaintiffs’ harm is entirely speculative and therefore not concrete. Doc. 25 at 22 (citing Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013) (stating that the “threatened injury must be certainly impending to constitute injury in fact . . . allegations of possible future injury are not sufficient”) (cleaned up)). After all, though

Neighbors’ notice-of-breach letter indicated that Social Security numbers were stolen, see doc. 21-1 at 2, the letter’s very next sentence states “[w]e have no evidence that your personal information has been misused for the purpose of committing fraud or identity theft.” Id. The Court finds Neighbors’ argument unconvincing. Common sense dictates that when hackers steal sensitive PII—like Social Security numbers—and post it for sale on the dark web, one’s PII has been misused. Cf. SuperValu, 870 F.3d at 770 (holding that stolen credit card information, which “does not include any personally identifying information, such as social security numbers,” presents little risk of fraudulent activity). Unlike a ransomware attack, where the hack is a means to an end—extorting payment from the hacked party—here, the hack is a means to a secondary harm: selling Colley’s PII to

bad actors. Cf. In re Practicefirst Data Breach Litig., No. 1:21-cv-00790-JLS/MJR, 2022 WL 354544 at *5 (W.D.N.Y. Feb. 2, 2022). Colley plausibly alleges that his sensitive PII—at the very least—sits on the Dark Web awaiting a willing and able buyer, doc. 21 at ¶¶ 41–42, 105; see also TransUnion, 594 U.S. at 440–42 (holding that class members whose incorrect credit reports were disseminated to a third-party business possessed a concrete injury). At this stage in the litigation, Colley need not show more. Rydholm, 44 F.4th at 1108 (“At the pleadings stage, general factual allegations suffice to support standing.”). While the Court reserves for the merits whether the pleaded facts plausibly fit the common-law elements, the Court finds that Colley sufficiently pleaded a clearly imminent injury. 2. Mitigation and opportunity costs Next consider Colley’s mitigation and opportunity costs arising from the hack. See doc. 21 at ¶¶ 8, 116–17. Neighbors argues, again citing to Clapper, that one “cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future

harm.” Doc. 25 at 26 (citing Clapper, 568 U.S. at 416). But Colley, and Plaintiffs in general, haven’t manufactured anything. Colley alleges that Black Suit stole sensitive PII, and so he took “necessary and appropriate action to prevent further damages.” Mackey v. Belden, Inc., No. 4:21-cv-00149-JAR, 2021 WL 3363174 at *5 (E.D. Mo. Aug. 3, 2021); cf. SuperValu, 870 F.3d at 771 (holding that mitigation costs cannot confer standing where plaintiffs only had a speculative risk of future identity theft). And while “time and effort” injuries alone may be insufficiently concrete, doc. 21 at ¶ 117; cf. Ojogwu v. Rodenburg L. Firm, 26 F.4th 457, 463 (8th Cir. 2022) (finding that a plaintiff lacked standing where he did not act to his detriment to protect his interests after receiving a copy of garnishment summons), here, Colley also alleged “out-of-pocket [mitigation] expenses,” doc. 21 at ¶ 8. The Court finds that Colley pleaded a

sufficiently concrete injury to confer standing. 3. Breach of implied contract In connection with their breach-of-implied-contract claim, see doc. 21 at ¶¶ 321–32, Plaintiffs allege harms from the lost benefit of their bargain with Neighbors. Id. at 3. Parties to a breached contract have “a judicially cognizable interest for standing purposes, regardless of the merits of the breach alleged.” Kuhns v. Scottrade, Inc., 868 F.3d 711, 716 (8th Cir. 2017) (holding that customers whose PII was stolen had standing to pursue contract-related claims). The Court finds that Plaintiffs have standing, at the pleadings stage, to assert their breach-of-implied-contract claim. 4. Diminished value of PII Plaintiffs also allege that the hack diminished the value of their PII, causing them an economic loss. Doc. 21 at ¶¶ 8, 99. Neighbors disagrees, see doc. 25 at 25, but neither party directs the Court to any binding precedent in support of its argument. Though not binding, the

Court finds the Pulliam court’s analysis persuasive. See Pulliam v. W. Tech. Grp., LLC, No. 8:23-cv-159, 2024 WL 356777 at *8 (D. Neb. Jan. 19, 2024). While the Court agrees that Plaintiffs’ PII has value, the Court doubts whether any diminution in value is sufficiently concrete to confer standing. Id. Plaintiffs do not allege, and the Court does not see how this type of harm bears, a “close relationship to a harm that has traditionally been regarded as providing a basis for lawsuit in English or American courts.” Spokeo, 578 U.S. at 341. For one, Plaintiffs do not allege that a legitimate market exists for the type of PII involved in this case. Doc. 21 at ¶ 98 nn.28 & 29 (citing to articles that state that a market exists to buy an individual’s internet browsing history, app usage data, or location data). And even if Plaintiffs plausibly alleged that a legitimate market did exist for the PII in this case, they do not

allege with any particularity that they intended to sell their PII but were forced to accept a decreased price. See Prestby v. A&A Servs., LLC, No. 8:24-cv-204, 2026 WL 26128, at *10–11 (D. Neb. Jan. 5, 2026); see also Pulliam, 2024 WL 356777 at * 8. Nor do they allege any facts explaining how the breach devalued their PII. See Prestby, 2026 WL 26128, at *10–11. The Court finds that Plaintiffs do not allege a type of harm sufficient to have standing to assert damages arising from the diminished value of their PII. 5. Emotional harm Finally, Plaintiffs allege that the hack and its aftermath left them with increased anxiety and emotional distress. Doc. 21 at ¶¶ 117, 134, 154, 173, 196, 216, 235, 252, 255, 302, 355. Neighbors responded that emotional distress without more cannot constitute concrete injury. Doc. 25 at 24. The Court agrees with Neighbors that emotional harm alone cannot constitute a concrete injury. SeeDenmon v. Kan. Couns., Inc., 149 F.4th 1010, 1013 (8th Cir. 2025) (“In general, allegations of intangible injury such as distress and alarm fall short of cognizable injury

as a matter of general tort law”) (cleaned up). But Plaintiffs don’t allege emotional harm alone, they also allege financial injuries and several intangible injuries. Doc. 21 at ¶ 8; see Rydholm, 44 F.4th at 1108 (holding that “tangible financial harm and intangible emotional injury . . . are sufficient to establish standing”). The Court finds that Plaintiffs, at this stage, have standing to assert damages arising from the emotional harm they suffered because of the hack. B. Traceability Typically, to satisfy the traceability prong of Article III standing, a plaintiff must show that a “causal connection between the injury and the conduct complained of” exists. Lujan, 504 U.S. at 560. The alleged injury must, in other words, “result[] from the putatively illegal action” or the “challenged action” of the defendant. Simon v. E. Ky. Welfare Rts. Org., 426 U.S. 26, 41

(1976)). But at the pleadings stage, Plaintiffs’ burden is “relatively modest.” Bennett v. Spear, 520 U.S. 154, 171 (1997). Plaintiffs must only show that their injury is “fairly traceable” to the hack. Id. Neighbors argues that Colley, and Plaintiffs, cannot even make that lesser showing because “[it] was not responsible for the Security Incident; third-party cybercriminals were responsible.” Doc. 25 at 26–27. To be sure, at a high level of generality, Neighbors is correct. Many events in life have multiple but-for causes. And on the merits, Plaintiffs bear the burden to show that Neighbors’ negligence was the proximate cause of Plaintiffs’ damages. But “[p]roximate causation is not a requirement of Article III standing.” Lexmark Int’l, Inc. v. Static Control Components, Inc., 572 U.S. 118, 134 n.6 (2014). Here, the issue is whether Plaintiffs’ harms are fairly traceable to Neighbors’ conduct as pleaded. And Plaintiffs’ Complaint, taken as true, sufficiently pleads that Plaintiffs’ alleged harms are fairly traceable to Neighbors’ allegedly deficient cybersecurity practices.

For one, Plaintiffs allege that Neighbors only discovered the hack nearly four months after it occurred, and it took about another four months for it to notify Plaintiffs of the breach. Doc. 21 at ¶¶ 32–34. Plaintiffs also allege that Neighbors failed “to employ reasonable and appropriate measures to protect against unauthorized access to Plaintiffs’ and Class Members’ Private Information” as required by “Section 5 of the [Federal Trade Commission Act].” Doc. 21 at ¶ 53. And they allege that it failed to “implement industry-standard cybersecurity measures . . . thereby permitting the Data Breach to occur.” Id. at ¶¶ 57–58. Finally, Plaintiffs allege that “[h]ad [Neighbors] remedied the deficiencies in its information storage and security systems, followed industry guidelines, and adopted security measures recommended by experts in the field, it could have prevented intrusion into its information storage and security systems and,

ultimately, the theft of Plaintiffs’ and Class Members’ confidential Private Information.” Id. at ¶ 62. In sum, Neighbors allegedly failed to secure Plaintiffs’ PII, it got hacked, and the hackers posted the stolen PII on the Dark Web. The Court therefore finds that Plaintiffs’ harm is fairly traceable to Neighbors’ alleged conduct and that Plaintiffs’ harm will likely be redressed by a favorable decision. Lujan, 504 U.S. at 661. And so, the Court finds that Plaintiffs have standing at this early stage in the litigation. IV. Motion to Compel Arbitration Having found that Plaintiffs have standing, the Court turns to Neighbors’ Motion to Compel Arbitration. Doc. 24. Neighbors alleges that Plaintiffs Johnson, Beinart, Colley, and Wilbur’s claims are subject to mandatory arbitration. Doc. 25 at 10. It therefore moves the

Court to compel arbitration for these four plaintiffs. Doc. 24 at 1. For the following reasons, the Court grants in part, and denies in part without prejudice, Neighbors’ Motion to Compel Arbitration. Doc. 24. A. Standard The Federal Arbitration Act (FAA) governs arbitration agreements. Hoffman v. Cargill Inc., 236 F.3d 458, 461 (8th Cir. 2001). The FAA mandates broad enforcement of arbitration provisions: A written provision in . . . a contract evidencing a transaction involving commerce to settle by arbitration a controversy thereafter arising out of such contract or transaction . . . or an agreement in writing to submit to arbitration an existing controversy arising out of such a contract, transaction, or refusal, shall be valid, irrevocable, and enforceable, save upon such grounds as exist at law or in equity for the revocation of any contract. 9 U.S.C. § 2. Likewise, it provides that: A party aggrieved by the alleged failure, neglect, or refusal of another to arbitrate under a written agreement for arbitration may petition any United States district court which, save for such agreement, would have jurisdiction under title 28, in a civil action or in admiralty of the subject matter of a suit arising out of the controversy between the parties, for an order directing that such arbitration proceed in the manner provided for in such agreement. 9 U.S.C. § 4. The FAA establishes a “liberal federal policy favoring arbitration.” AT&T Mobility LLC v. Concepcion, 563 U.S. 333, 339 (2011). Accordingly, “courts must place arbitration agreements on an equal footing with other contracts” and enforce them according to their terms. Id.; see also Morgan v. Sundance, Inc., 596 U.S. 411, 418 (2022) (“[A] court must hold a party to its arbitration contract just as the court would to any other kind.”). But “[a] matter should not be sent to arbitration unless there is a valid agreement to arbitrate and the underlying dispute falls within the scope of that agreement.” Northport Health Servs. of Ark., LLC v. Posey, 930 F.3d 1027, 1030 (8th Cir. 2019) (quoting Telectronics Pacing Sys., Inc. v. Guidant Corp., 143 F.3d

428, 433 (8th Cir. 1998)). The Court, rather than the arbitrator, decides these substantive questions of arbitrability unless the parties clearly delegated that issue to the arbitrator. First Options of Chi., Inc. v. Kaplan, 514 U.S. 938, 944 (1995). Courts must address “questions of arbitrability . . . with a healthy regard for the federal policy favoring arbitration.” Moses H. Cone Mem’l Hosp. v. Mercury Constr. Corp., 460 U.S. 1, 24 (1983). “[A]ny doubts concerning the scope of arbitrable issues should be resolved in favor of arbitration.” Id. at 24–25. And because “arbitration is a matter of contract,” state-law contract principles govern the validity of an arbitration agreement. Torres v. Simpatico, Inc., 781 F.3d 963, 968 (8th Cir. 2015) (citations omitted). “If a valid and enforceable arbitration agreement exists under state-law contract principles, any dispute that falls within the scope of that agreement must be submitted to

arbitration.” Id. (citation omitted). The Eighth Circuit has instructed that a motion to compel arbitration should be “analyzed under a standard akin to [that for] summary judgment.” Neb. Mach. Co. v. Cargotec Sols., LLC, 762 F.3d 737, 741 (8th Cir. 2014). Accordingly, the Court must view the evidence in the light most favorable to the nonmoving party, resolving all factual disputes in their favor. Id. at 742. The Court cannot compel arbitration where any genuine dispute of material fact remains as to whether a valid arbitration agreement exists. Id. B. Plaintiffs Johnson & Beinart Because neither of these Plaintiffs nor Neighbors dispute what law applies, doc. 25 at 14– 17; doc. 30 at 14–17, the Court applies Missouri law, BBSerCo, Inc. v. Metrix Co., 324 F.3d 955, 960 n.3 (8th Cir. 2003). Plaintiffs Johnson and Beinart are both current Neighbors customers.

Doc. 21 at ¶¶ 181, 201. The Account Agreement that they signed nearly twenty years ago, states: By signing, the CU is authorized to make inquiries, view credit report or otherwise, necessary to process the account also, by signing, the signers agree to the by-laws of this Credit Union and applicable account terms and conditions, as amended from time to time . . . .

Doc. 25-2 at 2 (Johnson’s Account Agreement); doc. 25-3 at 2 (Beinart’s Account Agreement). Fast forward to March 2020: Neighbors mailed its customers a Notice of Amendment to Neighbors Credit Union Membership and Account Agreement (“Notice of Amendment”). Doc. 25-4. The Notice of Amendment stated that, after the effective date, a new account agreement— the Membership and Account Agreement—will replace customers’ Account Agreement with Neighbors. Id. The Notice of Amendment also gave recipients notice of the Membership and Account Agreement’s arbitration provision: On the Effective Date, your Account(s) will be subject to a mandatory arbitration provision and you will no longer be able to elect to resolve any disputes related to your Account(s) in court or resolve a dispute through a class action . . . . . If you do not want to agree to mandatory arbitration and class action waiver contact Neighbors Credit Union . . ., in writing, that You reject this arbitration provision within thirty (30) days of receiving this arbitration provision, including Your name, as listed on Your account, Your account number, and a statement that You reject this arbitration provision.

Doc. 25-4 at 2; see also doc. 25-5 at 8–9 (Membership and Account Agreement). Neighbors argues that because Johnson and Beinart failed to opt out of the arbitration provision, doc. 25 at 15; see also doc. 25-1 at ¶ 10, they must arbitrate their claims against Neighbors. Plaintiffs argue in response that: (i) Neighbors failed to produce the original agreements that established its right to amend the original Account Agreement, (ii) even if Neighbors produced the original agreements, a unilateral right to amend is unenforceable, and (iii) Neighbors failed to provide evidence that Johnson and Beinart received notice of the

Membership and Account Agreement. Doc. 30 at 14–16. The Court addresses each argument in turn. First, Plaintiffs argue that Neighbors failed to produce the original agreements. Doc. 30 at 14–15. But as Neighbors notes, doc. 31 at 2–3, it produced the original Account Agreements that gave it a unilateral right to amend, see docs. 25-2, 25-3. Then Plaintiffs argue that Neighbors’ Notice of Amendment operated as an unenforceable, unilateral amendment to the original Account Agreement. Doc. 30 at 15. And because Neighbors doesn’t have an independent contractual right to retroactively amend the original Account Agreement, the Amended Agreement doesn’t bind Johnson and Beinart. Id. Neighbors disagrees: first, the plain terms of their Account Agreement contemplated

amendment. Doc. 31 at 2–3; see also doc. 25-3 at 2 (“[B]y signing, the signers agree to the by- laws of this Credit Union and applicable account terms and conditions, as amended from time to time . . . .”). Second, Neighbors states that it is not “attempting to compel arbitration as to any matter that predated the amendment.” Doc. 31 at 4. Instead, Neighbors seeks only to compel arbitration as to issues arising from a data breach that “occurred more than four years after the arbitration provision was incorporated into the agreement.” Id.; see Patrick v. Altria Grp. Distrib. Co., 570 S.W.3d 138, 143–44 (Mo. Ct. App. 2019) (holding that consideration supporting a unilateral right to amend is not illusory when it applies prospectively and advance notice is given). Thus, the crux of the matter is whether Johnson and Beinart received the Notice of Amendment, which gave them thirty days to opt out of arbitration provision. Arbitration agreements, like all contracts, require three essential elements: (i) offer, (ii) acceptance, and (iii) consideration. Bridgecrest Acceptance Corp. v. Donaldson, 648 S.W.3d 745, 752–54 (Mo.

2022) (citation omitted). “An offer may . . . be accepted by the offeree’s conduct or failure to act.” Citibank (S.D.), N.A. v. Wilson, 160 S.W.3d 810, 813 (Mo. Ct. App. 2005). If Johnson and Beinart received the Notice of Amendment, failed to opt out of the arbitration provision, yet continued using their accounts, then they accepted the arbitration provision in the Membership and Account Agreement. Id. (“If this party receives the benefit of the services in silence, when there was a reasonable opportunity to reject them, this party is manifesting assent to the terms proposed and thus accepts the offer.”); see Cicle v. Chase Bank USA, 583 F.3d 549, 555 (8th Cir. 2009) (holding that an arbitration agreement that was deemed accepted by failure to opt out not unconscionable under Missouri law); cf. Lopez v. H & R Block, Inc., 491 S.W.3d 221, 227 (Mo. Ct. App. 2016) (refusing to compel arbitration when customer

properly opted out of the arbitration provision). Simply put, Johnson and Beinart’s receipt of the Notice of Amendment coupled with their continued use of their accounts can constitute acceptance of the arbitration provision. See 1 Corbin on Contracts § 3.18 (2026) (“Often, however, silence coupled with conduct . . . can reasonably be understood by the offeror as an acceptance.”); 2 Williston on Contracts § 6:71 (4th ed.) (stating that an offeree’s silence constitutes acceptance when the “offeree, by previous words or conduct, has led the offeror to believe that by remaining silent in this particular case it nevertheless intends to accept”); Restatement (Second) of Contracts § 69(1)(a) (A.L.I. 1981) (“Where an offeree fails to reply to an offer, his silence and inaction operate as an acceptance . . . [w]here an offeree takes the benefit of offered services with reasonable opportunity to reject them and reason to know that they were offered with the expectation of compensation.”). The parties agree that Johnson and Beinart never opted out of the arbitration provision. Doc. 25 at 12; see doc. 30 at 14. The Court therefore addresses whether Johnson and Beinart received the

Notice of Amendment. Missouri law presumes receipt of duly mailed materials. Am. Fam. Mut. Ins. Co. v. Vein Ctrs. for Excellence, Inc., 912 F.3d 1076, 1083 (8th Cir. 2019) (citing Ins. Placements, Inc. v. Utica Mut. Ins. Co., 917 S.W.2d 592, 595 (Mo. Ct. App. 1996)). For Neighbors to properly raise this presumption, it must introduce evidence that the “letter was properly addressed, stamped, and placed in the mail.” Crutcher v. MultiPlan, Inc., 22 F.4th 756, 767 (8th Cir. 2022). “[E]vidence of the settled custom and usage of the sender in the regular and systematic transaction of its business gives rise to this presumption.” Id. (citation modified). If Neighbors properly raises this presumption, then Plaintiffs can rebut with evidence that “it was not, in fact, received.” Id. (citation omitted). “Evidence of non-receipt, however, does not nullify the

presumption but leaves the question for the determination of the jury under all of the facts and circumstances of the case.” Id. (citation omitted). Here, Neighbors filed a declaration by its Chief Financial Officer—Janice Bennett— stating that, “[o]n or about March 25, 2020,” Neighbors mailed “all then-current members, including Plaintiffs Johnson and Beinart” the Notice of Amendment and the Membership and Account Agreement. Doc. 25-1 at ¶¶ 7–8; see also doc. 31-1 at ¶¶ 4–8 (explaining Neighbors’ “customary and regular practice to use a third-party vendor for printing and mailing”). Bennett stated she reviewed records “kept in the ordinary course of [Neighbors’] regularly conducted business activities,” doc. 25-1 at ¶ 2, and “Johnson and Beinart did not notify [Neighbors] in writing that they desired to opt out of the arbitration provision,” id. at ¶ 10. Bennett further states that Neighbors never received any returned mail for Johnson or Beinart. Doc. 31-1 at ¶ 9; cf. id. at ¶¶ 11–12 (noting that Neighbors mailed the notice of data breach letter to Johnson and Beinart at the same addresses); doc. 21 at ¶¶ 181, 201 (noting that Johnson and Beinart received

Neighbors’ notice of breach letter). The Court finds that Neighbors properly raised the presumption that Johnson and Beinart received the Notice of Amendment. See Am. Fam. Mut. Ins. Co., 912 F.3d at 1083. To rebut, Plaintiffs filed identical declarations signed by Johnson and Beinart denying receipt. Docs. 30-1, 30-2. While Plaintiffs’ denials of receipt are insufficient to rebut the presumption, they do create a genuine dispute of material fact. Kohler v. Anderson, 986 F.2d 503, *1 (8th Cir. 1993); see also Stephenson v. El-Batrawi, 524 F.3d 907, 913 (8th Cir. 2008). As stated above, the Eighth Circuit instructs district courts to analyze a motion to compel arbitration “under a standard akin to [a motion for] summary judgment.” Neb. Mach. Co., 762 F.3d at 741. Accordingly, the Court must view the evidence in the light most favorable to the

nonmoving parties, resolving all factual disputes in their favor. Id. at 743. And the Court cannot compel arbitration where any genuine dispute of material fact remains as to whether a valid arbitration agreement exists. Id. Applying this standard, the Court finds that Johnson and Beinart raise a genuine dispute of material fact regarding their receipt of the Notice of Amendment. Id. The Court accordingly denies Neighbors’ Motion to Compel Arbitration as to Johnson and Beinart. The FAA provides: “If the making of the arbitration agreement or the failure, neglect, or refusal to perform the same be in issue, the court shall proceed summarily to the trial thereof.” 9 U.S.C. § 4; see also Neb. Mach. Co., 762 F.3d at 744. The Eighth Circuit has observed that, in an appropriate case, “the [FAA’s] summary trial can look a lot like summary judgment.” Neb. Mach. Co., 762 F.3d at 743. Although the Court analyzed Neighbors’ Motion to Compel Arbitration under a summary-judgment standard, the parties briefed the motion without the benefit of discovery. After a reasonable period of

discovery, perhaps no genuine dispute of material fact will remain. So, the Court denies Neighbors’ present Motion to Compel Arbitration without prejudice, and the Court enters a separate order governing the limited discovery. C. Plaintiffs Colley & Wilbur Plaintiffs Colley and Wilbur are not Neighbors’ customers—at least not traditional banking customers. Neighbors seeks to compel arbitration for Colley and Wilbur based on the arbitration clauses in their secured-vehicle-loan contracts, of which as explained above, Neighbors is the assignee. Doc. 25 at 17–21; see supra Part I. 1. Choice of law The Court first addresses a choice-of-law issue. As noted, before compelling arbitration,

a court first determines whether a valid arbitration agreement exists. Robinson v. EOR-ARK, LLC, 841 F.3d 781, 783–84 (8th Cir. 2016). And when determining that question, courts look to state-law contract principles. Torres, 781 F.3d at 968. Here, the parties dispute what law applies to Colley and Wilbur’s alleged arbitration agreements. See docs. 25 at 30, 30 at 13, 31 at 2. “[F]ederal courts in diversity of citizenship cases are governed by the conflict of laws rules of the courts of the states in which they sit.” Griffin v. McCoach, 313 U.S. 498, 503 (1941) (citing Klaxon Co. v. Stentor Elec. Mfg. Co., 313 U.S. 487, 496–97 (1941); see also Day & Zimmermann, Inc. v. Challoner, 423 U.S. 3, 4 (1975) (reaffirming Klaxon Co., 313 U.S. at 496– 97). Missouri applies the “Restatement (Second) of Conflict of Laws” to determine what law applies. Ameristar Jet Charter, Inc. v. Dodson Int’l Parts, Inc., 155 S.W.3d 50, 58 (Mo. 2005); see also Fruin-Colnon Corp. v. Mo. Highway & Transp. Comm’n, 736 S.W.2d 41, 44 (Mo. 1987) (applying the Restatement (Second) of Conflict of Laws); Est. of Brown, 955 S.W.2d 940, 944–45 (Mo. Ct. App. 1997) (“Missouri follows the Restatement (Second) Conflict of Laws in

contract actions.”). And under section 187, “[t]he law of the state chosen by the parties to govern their contractual rights and duties will be applied.” Est. of Brown, 955 S.W.2d at 945 (citing Restatement (Second) of Conflict of Laws § 187 (A.L.I. 1971)); Eagle Tech. v. Expander Ams., Inc., 783 F.3d 1131, 1137 (8th Cir. 2015) (“Under Missouri law, a choice-of-law clause in a contract generally is enforceable . . . .”). Here, Colley signed a secured-vehicle-loan contract with a Tennessee choice-of-law provision. Doc. 25-7 at 3. Wilbur signed a secured-vehicle-loan contract with an Alabama choice-of-law provision. Doc. 25-9 at 2. The Court therefore applies Tennessee law to Colley’s contract and Alabama law to Wilbur’s contract. Est. of Brown, 955 S.W.2d at 945 (citing Restatement (Second) of Conflict of Laws § 187 (A.L.I. 1971)); Eagle Tech., 783 F.3d at 1137.

2. Colley and Wilbur’s secured-vehicle-loan contracts were validly assigned to Neighbors

Neighbors seeks to compel arbitration with Colley and Wilbur based on the arbitration clauses in their secured-vehicle-loan contracts. Doc. 25 at 17–18. Plaintiffs, however, argue that the Court cannot compel arbitration because Neighbors failed to prove each assignment in the chain. Doc. 30 at 18. In response, Neighbors argues that “the chain is clear,” and “Plaintiffs attempt to introduce confusion where there is none.” Doc. 31 at 6. As noted above, the Court finds that Neighbors has sufficiently demonstrated that it is the assignee of these contracts. See supra Part I. Tennessee and Alabama both permit the assignee of a valid arbitration agreement to enforce those agreements and compel arbitration. Blue Water Bay at Ctr. Hill, LLC v. Hasty, No. M2016-02382-COA-R3-CV, 2017 WL 5665410, at *6 (Tenn. Ct. App. Nov. 27, 2017); Ocwen Loan Servicing, LLC v. Washington, 939 So. 2d 6, 9–10 (Ala. 2006). Neighbors, as the assignee

of Colley and Wilbur’s loans, may enforce the arbitration clauses in those contracts. Blue Water Bay, 2017 WL 5665410, at *6; Ocwen, 939 So. 2d at 9–10. The Court now turns to address whether Colley and Wilbur’s claims fall within the scope of their arbitration clauses contained in their secured-vehicle-loan contracts. See Torres, 781 F.3d at 968. 3. Colley and Wilbur’s disputes fall within the scope of the arbitration clauses in their secured-vehicle contract loans

The Court analyzes the scope of the arbitration clauses. While “state contract law governs the threshold question of whether an enforceable arbitration agreement exists,” federal law governs whether Colley and Wilbur’s dispute “falls within the scope of the arbitration agreement.” Donaldson Co. v. Burroughs Diesel, Inc., 581 F.3d 726, 731 (8th Cir. 2009) (citation omitted). The Court starts with Colley’s secured-vehicle-loan contract. Colley agreed to arbitrate: [A]ny claim, dispute, or controversy relating to this agreement and/or any other dispute with dealer including employees and agents, including claims involving the applicability of this arbitration clause or the validity of the entire agreement, shall be resolved by binding arbitration.

Doc. 25-8 at 2. Neighbors argues that because it obtained Colley’s PII “in connection with its business activities, which included the purchase of Colley’s vehicle loan . . . ., Colley’s claims ‘clearly relate to the agreement.’” Doc. 25 at 19. The Court agrees. The Eighth Circuit has explained that the phrase “arising out of or relating to” captures all claims that have “some logical connection” to the agreement. Vondeylen v. Aptive Env’t, LLC, No. 24-3578, 2026 WL 621880, at *1 (8th Cir. Mar. 5, 2026). Colley agreed to arbitrate “any claim . . . relating to this agreement and/or any other dispute with dealer.” Doc. 25-8 at 2. Colley asserted that Neighbors obtained his PII “pursuant to [Neighbors’] business and/or banking activities.” Doc. 21 at ¶ 105. And the Court has found

that Neighbors is the proper successor in interest to “dealer.” The Court therefore finds that Colley’s claims fall within the scope of the arbitration clause. See Torres, 781 F.3d at 968. Similarly, Wilbur’s arbitration clause states: You and we agree that any claim or dispute, whether in contract, tort, statute or otherwise . . ., between you and us or our employees, agents, successors, or assigns, which arises out of or relates to your credit application, purchase, lease, or condition of the vehicle, any retail installment sale contract or lease agreement or any resulting transaction or relationship . . . shall, at your or our election, be resolved by neutral, binding arbitration . . . .

Doc. 25-10 at 2. Here too, Wilbur agreed that “any claim or dispute . . . between you and us or . . . successors, or assigns, which arises out of or relates to . . . any resulting transaction or relationship . . . shall . . . be resolved by neutral, binding arbitration.” Doc. 25-10 at 2. This broad language encompasses Wilbur’s claim, which relates to a resulting transaction or relationship with a successor in interest—Neighbors. Vondeylen, 2026 WL 621880, at *1. The Court therefore finds that Colley’s claims fall within the scope of the arbitration clause. See Torres, 781 F.3d at 968. So, because Neighbors has valid and enforceable arbitration agreements with Colley and Wilbur, respectively, and because this dispute falls within the scope of the agreements, the Court grants Neighbors’ Motion to Compel as to these plaintiffs. Doc. 24. Four Plaintiffs without arbitration agreements remain in this case, so the Court now turns to Neighbors’ Motion to Dismiss. V. Motion to dismiss A. Legal standard Under Federal Rule of Civil Procedure 12(b)(6), a party may move to dismiss a claim for “failure to state a claim upon which relief can be granted.” The pleading standard of

Rule 8(a)(2) requires a plaintiff to give “a short and plain statement . . . showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). To meet this standard and to survive a Rule 12(b)(6) motion to dismiss, “a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). This requirement of facial plausibility means the factual content of the plaintiff’s allegations must “allow[] the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Whitney v. Guys, Inc., 700 F.3d 1118, 1128 (8th Cir. 2012) (quoting Iqbal, 556 U.S. at 678). The Court must grant all reasonable inferences in favor of the nonmoving party. Lustgraaf v. Behrens, 619 F.3d 867, 872–73 (8th Cir. 2010).

When ruling on a motion to dismiss, a court “must liberally construe a complaint in favor of the plaintiff.” Huggins v. FedEx Ground Package Sys., Inc., 592 F.3d 853, 862 (8th Cir. 2010). But if a claim fails to allege one of the elements necessary to recover on a legal theory, the Court must dismiss that claim for failure to state a claim upon which relief can be granted. See Crest Constr. II, Inc. v. Doe, 660 F.3d 346, 355 (8th Cir. 2011). “Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Iqbal, 556 U.S. at 678; see also Twombly, 550 U.S. at 555. Nor does a “pleading that merely pleads ‘labels and conclusions,’ or a ‘formulaic recitation’ of the elements of a cause of action, or ‘naked assertions’ devoid of factual enhancement” suffice. Hamilton v. Palm, 621 F.3d 816, 817 (8th Cir. 2010) (quoting Iqbal, 556 U.S. at 678). Although courts must accept all factual allegations as true, they are not bound to take as true a legal conclusion couched as a factual allegation. Twombly, 550 U.S. at 555; Iqbal, 556 U.S. at 677–78. Only a complaint that states a plausible claim for relief survives a motion to dismiss.

Iqbal, 556 U.S. at 679. Therefore, the Court must determine if the well-pleaded factual allegations “plausibly give rise to an entitlement to relief.” Id. This “context-specific task” requires the Court to “draw on its judicial experience and common sense.” Id. B. Discussion The Court only decides Neighbors’ Motion to Dismiss for the four Plaintiffs it has not yet addressed: Hollis, Short-Shumate, Beatty Jr., and Putney. Plaintiffs allege six common-law counts of: (i) negligence, see doc. 21 at ¶¶ 274–306, (ii) negligence per se, see id. at ¶¶ 307–20, (iii) breach of implied contract, see id. at ¶¶ 321–32, (iv) unjust enrichment, see id. at ¶¶ 333–43, (v) breach of confidence, see id. at ¶¶ 344–55, and (vi) invasion of privacy, see id. at ¶¶ 356–73. The Court notes that because neither party disputes what law applies for the remaining four

plaintiffs, doc. 25 at 30; doc. 30 at 26, the Court applies Missouri law, BBSerCo, Inc., 324 F.3d at 960 n.3. For the reasons stated below, the Court grants Neighbors’ Motion. Doc. 24. 1. Negligence While negligence has four elements, the Court focuses on whether Neighbors owed the duty these Plaintiffs claim. Finding no such duty exists under Missouri law, the Court dismisses Plaintiffs’ negligence claim. a. Duty Plaintiffs allege various theories of Neighbors’ duty to safeguard Plaintiffs’ PII. First, because Neighbors “required, collected, possessed, and maintained” Plaintiffs’ PII, Plaintiffs claim it had a “duty to exercise reasonable care in safeguarding” such PII from misuse. Doc. 21 at ¶¶ 275–77. Second, Plaintiffs allege Neighbors owed a duty to exercise reasonable care based on their “special relationship.” Id. at ¶ 281. Third, they allege it owed Plaintiffs a statutory duty to protect their PII under a negligence-per-se theory. Id. at ¶¶ 279–80.

“Whether a duty exists is purely a question of law.” State ex rel. Tyler Techs., Inc. v. Chamberlain, 679 S.W.3d 474, 477 (Mo. 2023) (quoting Tharp v. St. Luke’s Surgicenter-Lee’s Summit, LLC, 587 S.W.3d 647, 654 (Mo. 2019)). Thus, the Court can properly resolve the question of duty on a motion to dismiss. See Nat’l Union Fire Ins. Co. of Pittsburgh, Pa. v. Raczkowski, 764 F.3d 800, 802 (8th Cir. 2014) (affirming the dismissal of a negligence claim for lack of duty under Missouri law). In Missouri, a duty of care arises when: (i) “prescribed by the legislature,” (ii) “the common law imposes a duty based on the relationship between the parties, or because under a particular set of circumstances a party must exercise due care to avoid foreseeable injury,” or (iii) “a party has assumed a duty by contract or conduct.” Scales v. Whitaker, 615 S.W.3d 425, 431

(Mo. Ct. App. 2020). “The touchstone for the creation of a duty is foreseeability.” Wielandv. Owner-Operator Servs., Inc., 540 S.W.3d 845, 848 (Mo. 2018). Typically, Courts do not impose a duty on businesses to “protect against the criminal acts of third parties,” because criminal acts are “rarely foreseeable.” Id.;L.A.C. ex rel. D.C. v. Ward Parkway Shopping Ctr. Co., L.P., 75 S.W.3d 247, 257 (Mo. 2002) (citing Madden v. C & K Barbecue Carryout, Inc., 758 S.W.2d 59, 62 (Mo. 1988)). The Supreme Court of Missouri, however, recognizes an exception when a “special relationship exists between the parties.” J.M. v. Shell Oil Co., 922 S.W.2d 759, 765 (Mo. 1996). Missouri has recognized the following special relationships: “innkeeper-guest, common carrier-passenger, [and] school-student . . . .” Earley v. Dunn, 670 S.W.3d 47, 52 (Mo. Ct. App. 2023). The parties dispute whether Missouri law recognizes a special relationship between Plaintiffs and Neighbors. See doc. 25 at 31–32, doc. 31 at 10–11; see also doc. 30 at 27–28.

Much of their dispute hinges on whether the Court should follow the approach of Mackey, 2021 WL 3363174 at *6–7. In Mackey, the court found that an employer owes its employees a duty of care to protect employee PII due to the special “employer-employee relationship.” Id. At the time, Missouri case law indicated that a special relationship between an employer and employee can exist, see id., but since then, the Missouri Court of Appeals noted that its past statements were dicta, see Earley, 670 S.W.3d at 53. Moreover, unlike in Mackey, Plaintiffs never had an employer-employee relationship with Neighbors. See doc. 21. Mackey therefore offers Plaintiffs little support. Unlike in Mackey, Plaintiffs do not possess a single, recognized special relationship with Neighbors. Here, Hollis and Short- Shumate are former customers. Id. at ¶¶ 159, 238. And they allege Neighbors obtained Beatty

Jr. and Putney’s PII through Neighbors’ undefined business and banking activities. Id. at ¶¶ 123, 223. While Putney alleges that she had a line of credit maintained by Neighbors, id. at ¶ 122, Beatty Jr.’s exact relationship with Neighbors goes unexplained in Plaintiffs’ Complaint. See id. at ¶¶ 222–37. Plaintiffs have not cited, nor has the Court found, a Missouri court that imposed a duty based on a special relationship between a business and former customers, or between a business and individuals with an opaque relationship to the business. Plaintiffs also cite to Baldwin v. Nat’l W. Life Ins. Co., No. 2:21-cv-04066-WJE, 2021 WL 4206736, at *3–4 (W.D. Mo. Sept. 15, 2021) for support. But Baldwin didn’t address whether plaintiffs owed a common law duty of care. Id. at *2–4. Federal courts sitting in diversity should not expand state law “in ways not foreshadowed by state precedent,” Ashley Cnty. v. Pfizer, Inc., 552 F.3d 659, 673 (8th Cir. 2009), because courts “sitting in diversity do not create state law,” Crozier v. Wint, 736 F.3d 1134, 1138–39 (8th Cir. 2013). In the absence of direct Missouri precedent, the Court must predict, to the best of its

ability, how the Supreme Court of Missouri would rule. See Salier v. Walmart, Inc., 76 F.4th 796, 801 (8th Cir. 2023). Before extending a legal duty to a novel set of facts, the Court must exercise caution. In National Union, an insurance company sued a bank for negligence after the bank failed to inquire into whether an employee had the authority to open an account on the employer’s behalf. Nat’l Union, 764 F.3d at 801–802. The district court dismissed the complaint for failure to state a claim because the bank owed no duty to the employer. Id. And the Eighth Circuit affirmed. Id. For the proposition that the Supreme Court of Missouri would recognize a duty, the insurance company relied on a Supreme Court of Missouri decision that was “materially different” from the case at hand and “limited in scope” compared to the insurance company’s

proposed duty. Id. at 804. To extend that precedent to the case before it, the court held, would be to establish a rule with “no practical limitation.” Id. at 805. Here, Plaintiffs fail to convince the Court that the Supreme Court of Missouri would recognize a special relationship between Neighbors and Plaintiffs on these facts. See Nat’l Union, 764 F.3d at 806. The Court finds that—on this record—Neighbors does not owe Plaintiffs a duty of care. The Court therefore grants Neighbors’ motion to dismiss Plaintiffs’ negligence claim. 2. Negligence per se To assert a negligence-per-se claim, Plaintiffs must plausibly plead, among other elements, that Neighbors violated a statute or regulation. Parr v. Breeden, 489 S.W.3d 774, 781 (Mo. 2016). Here, Plaintiffs rely on section 5 of the Federal Trade Commission Act (FTCA) to

establish their claim. See doc. 21 at ¶¶ 307–320. But under Missouri law, only statutes that create a private cause of action can serve as the basis of a negligence-per-se claim. Howland v. Truman Med. Ctr., Inc., 719 S.W.3d 98, 109 (Mo. Ct. App. 2025) (citing Bradley v. Ray, 904 S.W.2d 302, 314 (Mo. App. W.D. 1995)). And “[t]he FTCA creates no private right of action.” In re SuperValu, 925 F.3d 955, 963 (8th Cir. 2019). Plaintiffs also do not cite any case law that recognizes a negligence-per-se action based on a duty supplied by federal law. See doc. 30; cf. Parr, 489 S.W.3d at 780–81 (stating that state law doesn’t support imposing an independent, personal duty in a negligence action based on a federal regulation). The Court therefore grants Neighbors’ motion to dismiss Plaintiffs’ negligence-per-se claim. 3. Breach of implied contract

To assert a breach-of-implied contract claim, Plaintiffs must plausibly plead that they had an implied contract with Neighbors, and it breached the contract. Westerhold v. Mullenix Corp., 777 S.W.2d 257, 263 (Mo. Ct. App. 1989). An implied contract—unlike an express contract— exists when the parties’ make mutual promises by words or conduct rather than by written text. Id. But like any contract, consideration must support the parties’ mutual promises. See Bridgecrest Acceptance Corp., 648 S.W.3d at 752–53; Westerhold, 777 S.W.2d at 263 (citing Bailey v. Interstate Airmotive, 219 S.W.2d 333, 1132 (1949) (“There is no difference in legal effect between an express contract and one implied in fact. The distinction lies merely in the manner of manifesting mutual assent.”)); see also 17A Am. Jur. 2d Contracts § 14 (stating that a “contract implied in fact must embody all the elements of an express contract”). The Court must find that “there was a meeting of the minds on the agreement’s essential elements,” that the parties’ intended “to enter into a contract upon defined terms,” and that Plaintiffs “relied in good faith upon the alleged contract.” Nickel v. Stephens Coll., 480 S.W.3d 390, 397 n.6 (Mo. Ct.

App. 2015) (citing 17A Am. Jur. 2d Contracts § 14). Plaintiffs contend that Neighbors made several implied promises to them. Doc. 21 at ¶ 327. At bottom, Plaintiffs argue that Neighbors impliedly promised to reasonably protect their PII. Id. For consideration, Plaintiffs state that they paid Neighbors money or turned over PII in return for its implied promise to securely maintain their PII. Id. at ¶ 324. And Neighbors breached this implied contract or series of implied contracts when it failed to “employ reasonable and adequate security measures” to secure their PII. Id. at ¶ 331. Neighbors responds that Plaintiffs failed to plead that any meeting of the minds occurred as to the essential terms. Doc. 25 at 35. The Court agrees. Plaintiffs state, in a conclusory manner, that they “formed implied contracts with Neighbors regarding the provision of those

services through their collective conduct.” Doc. 21 at ¶ 322. But Plaintiffs’ Complaint does not clarify how or when they plausibly formed these implied contracts through their collective conduct. See doc. 21. As noted above, Hollis and Short-Shumate are former Neighbors customers. Id. at ¶¶ 159, 238. And Beatty Jr. and Putney state that Neighbors obtained their PII through its business and banking activities . Id. at ¶¶ 123, 223. Plaintiffs fail to plausibly plead how these Plaintiffs—with such vaguely-stated relationships to Neighbors—could have “formed implied contracts . . . through their collective conduct.” See id. at ¶ 322. Plaintiffs also failed to plausibly plead that Neighbors, in fact, impliedly assented to protect their PII as part of its services. Plaintiffs only plead that “Plaintiffs formed implied contracts with Neighbors” by “paying for services.” Id. at ¶ 322. They don’t sufficiently plead a “meeting of the minds” to protect their PII as part of Neighbors’ services. See Nickel, 480 S.W.3d at 397 n.6. Rather, Plaintiffs allege that by “delivering their [PII] to Neighbors and/or paying for service,” Plaintiffs “intended and understood that Neighbors would adequately

safeguard [their PII] as part of that service.” Doc. 21 at ¶ 326. But Plaintiffs don’t plausibly plead that Neighbors had the same intent or understanding, or agreed to Plaintiffs’ unexpressed intentions. See doc. 21. While Plaintiffs “need not set forth detailed factual allegations, or specific facts that describe the evidence to be presented, the complaint must include sufficient factual allegations to provide the grounds on which the claim rests.” Warmington v. Bd. of Regents, 998 F.3d 789, 795–96 (8th Cir. 2021) (citation modified). Because Plaintiffs failed to plausibly plead that “a meeting of the minds [existed] on the agreement’s essential elements,” see Nickel, 480 S.W.3d at 397 n.6, the Court grants Neighbors’ motion to dismiss Plaintiffs’ breach-of-implied-contract claim. 4. Unjust enrichment

To state an unjust-enrichment claim, Plaintiffs must plausibly plead that: (i) Plaintiffs enriched Neighbors by conferring a benefit, (ii) that its enrichment came at Plaintiffs’ expense, and (iii) that it would be unjust to allow Neighbors to retain the benefit. See Beeler v. Martin, 306 S.W.3d 108, 112 (Mo. Ct. App. 2010). Plaintiffs contend that they conferred a benefit on Neighbors when they exchanged their PII for adequate cybersecurity protection. Doc. 21 at ¶ 335. And they also contend that a portion of the revenue made from Plaintiffs’ contribution should have gone to providing adequate cybersecurity protection. Id. at ¶ 336. But instead Neighbors retained the revenue it should have been spent on protecting Plaintiffs’ PII. Id. at ¶ 337. And Plaintiffs alleged various harms resulting from Neighbors’ alleged enrichment. Id. at ¶ 341. Plaintiffs therefore conclude that it’s unjust to allow Neighbors to “retain the benefit of its wrongful conduct.” Id. at ¶ 340. The Court disagrees. Plaintiffs allege, in a conclusory manner, that they conferred a benefit on Neighbors when they exchanged their PII for adequate cybersecurity information.

Doc. 21 at ¶ 335. But they provide no well-pleaded facts from which the Court can plausibly infer that, in fact, such an exchange plausibly occurred. See doc. 21. And without sufficient well-pleaded facts to support their claim, the Court finds it implausible that Plaintiffs—with such vaguely-stated relationships to Neighbors—exchanged their PII for adequate cybersecurity information. Warmington, 998 F.3d at 795–96 (holding that a district court need not “conjure up unpled allegations to save a complaint”). Plaintiffs may have paid for financial services. But Plaintiffs fail to plausibly plead that they paid “a premium for a side order of data security.” SuperValu, 925 F.3d at 966 (cleaned up). Nor do they plausibly allege that “any specific portion of [their] payment went toward data protection.” Id.; see also Carlsen v. GameStop, Inc., 833 F.3d 903, 912 (8th Cir. 2016) (finding

that because plaintiff did not allege that a specific portion of his subscriber fee went toward data protection, he failed to allege a benefit conferred in exchange for his PII). Because Plaintiffs don’t plausibly allege that a specific portion of their payment went towards data protection, see doc. 21 at ¶ 337 (alleging only that some portion “should have been used for adequate cybersecurity practices”) (emphasis added)). The allegations don’t plausibly suggest that Neighbors received some benefit in exchange for providing data security. SuperValu, 925 F.3d at 966; Carlsen, 833 F.3d at 912). The Court therefore grants Neighbors’ motion to dismiss Plaintiffs’ unjust-enrichment claim. 5. Breach of confidence Plaintiffs assert that Neighbors breached their confidence by failing to adequately protect their PII. See id. at ¶¶ 344–55. Neighbors asserts that Missouri courts don’t recognize a breach-of-confidence claim outside of the disclosure-of-trade-secrets context. Doc. 25 at 38.

The Court agrees with Neighbors. The Court has not found any cases applying a breach of confidence claim to an analogous context. See Mackey, 2021 WL 3363174 at *9 (finding that “Missouri courts have only recognized the validity of this claim in the trade secret context”). The Court declines to extend state law “in ways not foreshadowed by state precedent.” Ashley Cnty., 552 F.3d at 673. The Court grants Neighbors’ motion to dismiss Plaintiffs’ breach-of-confidence claim. 6. Invasion of privacy Finally, to assert a claim for the public disclosure of private facts, Plaintiffs must plausibly plead that Neighbors: (i) “publication or publicity,” (ii) “absent any waiver or privilege,” (iii) “of private matters in which the public has no legitimate interests,” (iv) “so as to

bring shame or humiliation to a person of ordinary sensibilities.” Balke v. Ream, 33 S.W.3d 589, 594 (Mo. Ct. App. 2000). The Court notes that Plaintiffs refer to Neighbors’ intentional disclosure of “PII and PHI[,]” though they don’t define “PHI.” See doc. 21 at ¶¶ 367–69. Plaintiffs similarly don’t allege with any particularity that Neighbors possessed their “PHI,” which the Court takes to mean their private health information. See doc. 21. Though Plaintiffs allegedly suffered the theft of their PII, and perhaps their PHI, the facts don’t fit their legal theory. See Negron v. Ascension Health, No. 4:24-cv-00669, 2025 WL 2710014 at *13 (E.D. Mo. Sept. 23, 2025). Neighbors didn’t intentionally publish Plaintiffs’ PII (or, for that matter, any PHI, assuming Neighbors had any); hackers did. See id. Plaintiffs’ attempt to impute the hackers conduct to Neighbors due to its allegedly inadequate security “essentially reprise[s] [Plaintiffs’] negligence claim.” See id. And even assuming that one could consider a hacker’s post on the Dark Web to be a common-law “publication,” the Court remains unpersuaded that the published information would

shame or humiliate the reasonable person. See Restatement (Second) of Torts § 652D, cmt. c (1977) (“Complete privacy does not exist in this world except in a desert, and anyone who is not a hermit must expect and endure the ordinary incidents of the community life.”); see also Y.G. v. Jewish Hosp. of St. Louis, 795 S.W.2d 488, 498 (Mo. Ct. App. 1990) (holding that “the elements and scope of [a public-disclosure-of-private-facts claim], recognized in Missouri, are embodied in the Restatement (Second) of Torts”). The PII in this case, while sensitive, doesn’t approach the sort of intimate information that this claim covers. See, e.g., Y.G., 795 S.W.2d at 502–503 (holding that a patient pleaded a public-disclosure-of-private-facts claim when the hospital disclosed her IVF treatment to the media). The Court therefore grants Neighbors’ motion to dismiss Plaintiffs’ invasion-of-privacy claim.

VI. Conclusion Accordingly, the Court finds that, at this stage, Plaintiffs have standing to survive Neighbors’ Motion to Dismiss under Rule 12(b)(1). But after some discovery, the Court may revisit its decision. The Court also grants in part, and denies in part without prejudice, Neighbors’ [24] Motion to Compel Arbitration. The Court will allow the parties a reasonable period of time to engage in limited discovery—on the terms to set out in a separate order— limited to the issue of Johnson and Beinart’s receipt of the Notice of Amendment. Finally, the Court grants Neighbors’ [24] Motion to Dismiss, and dismisses without prejudice Plaintiffs Hollis, Short-Shumate, Beatty Jr., and Putney. A separate order of dismissal accompanies this Memorandum and Order. So ordered this 30th day of March 2026.

STEPHEN R. CLARK CHIEF UNITED STATES DISTRICT JUDGE