Zerbe v. IMA Financial Group, Inc.

• Court: District Court, D. Kansas
• Decided: August 6, 2024
• Docket: 2:24-cv-02026
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF KANSAS

JASON ZERBE, et al.,

Plaintiffs,

v. Case No. 2:24-cv-02026-HLT-GEB

IMA FINANCIAL GROUP, INC.,

Defendant.

MEMORANDUM AND ORDER The plaintiffs in this case are Jason Zerbe, Mark Masterson, and Jessica Abel. They previously brought a nearly identical case against Defendant IMA Financial Group, Inc. That case, like this one, arose out of a data breach of IMA’s computer systems, which allegedly compromised Plaintiffs’ personal information. The Court dismissed the first case because Plaintiffs had not demonstrated a concrete injury traceable to IMA and therefore lacked standing. Plaintiffs did not appeal. Instead, Plaintiffs filed this case about a month after the Court dismissed the first case. The complaint in this case includes a few additional allegations but is otherwise identical to the complaint that was dismissed in the first case. IMA moves to dismiss. Doc. 23. IMA argues that issue preclusion bars Plaintiffs from relitigating the standing issue, that Plaintiffs still cannot demonstrate standing, and that the claims fail under Rule 12(b)(6). The Court grants the motion because Plaintiffs are not entitled to relitigate the standing issue and, even if they could, the additional allegations still do not demonstrate standing. I. BACKGROUND In 2023, Masterson and Zerbe separately filed actions against IMA. The cases were consolidated, and Abel was added as a plaintiff. The consolidated action focused on a data breach that affected personal information stored by IMA. IMA moved to dismiss that case. The Court granted IMA’s motion and dismissed the case on December 14, 2023, for lack of standing. See Masterson v. IMA Fin. Grp., Inc., 2023 WL 8647157 (D. Kan. 2023) (“Masterson”).1 Plaintiffs did not appeal in Masterson. Plaintiffs filed this case on January 18, 2024. The complaint in this case is substantively

very similar to the complaint in Masterson. The underlying facts are included in the order dismissing Masterson. See id. at *1-2. The Court discusses any relevant changes or additions below in the analysis. II. ANALYSIS IMA moves to dismiss on three grounds. First, it argues Plaintiffs may not relitigate standing under the doctrine of issue preclusion. Second, Plaintiffs still fail to plausibly allege an injury-in-fact traceable to IMA. Third, Plaintiffs have failed to allege any plausible claims. Doc. 23 at 1-2. A. Issue Preclusion

IMA first argues this case should be barred under the doctrine of issue preclusion because the Court determined in Masterson that Plaintiffs lack standing, and they cannot relitigate that issue in this case. Res judicata was developed to prevent relitigation of issues and claims. See Park Lake Res. Ltd. Liab. v. U.S. Dep’t of Agric., 378 F.3d 1132, 1135 (10th Cir. 2004). Res judicata can take two forms: claim preclusion and issue preclusion. Id. Issue preclusion “bars a party from relitigating an issue once it has suffered an adverse determination on the issue, even if the issue

1 The first case is referred to as Masterson because consolidation of the original cases made Masterson the first plaintiff on the docket. In the current case, Zerbe is the first plaintiff listed. But both cases have the same three plaintiffs—Zerbe, Masterson, and Abel—and the same defendant, IMA. arises when the party is pursuing or defending against a different claim.” Id. at 1136. It has four elements: (1) the issue previously decided is identical with the one presented in the action in question, (2) the prior action has been finally adjudicated on the merits, (3) the party against whom the doctrine is invoked was a party, or in privity with a party, to the prior adjudication, and (4) the party against whom the doctrine is raised had a full and fair opportunity to litigate the issue in the prior action.

Id. (internal quotation omitted). The Tenth Circuit has specifically held that “[s]tanding and other such threshold jurisdictional issues are subject to the doctrine of issue preclusion.” N.M. Off- Highway Vehicle All. v. U.S. Forest Serv., 702 F. App’x 708, 710 (10th Cir. 2017). 1. Identical Issues The first element is whether the issues decided in the previous action are identical to those in the current case. Park Lake Res. Ltd. Liab., 378 F.3d at 1136. IMA argues this element is satisfied because whether Plaintiffs have Article III standing was adjudicated in Masterson. In response to IMA’s motion to dismiss, Plaintiffs “concede . . . that the first and third elements [of issue preclusion] are satisfied.” Doc. 27 at 5 n.1. But, despite this concession, Plaintiffs proceed to argue that the issues are not identical because the complaint in this case “includes a litany of new allegations that remedy the issues identified by the Court in [Masterson].” Id. at 5-6. This approach invokes the “curable-defect exception.” This exception recognizes that a second lawsuit may be brought “where a jurisdictional defect has been cured or loses its controlling force.” Park Lake Res. Ltd. Liab., 378 F.3d at 1137 (internal quotation and citation omitted). “But the change in circumstances that cures the jurisdictional defect must occur subsequent to the prior litigation.” Id. Here, Plaintiffs cite some additional allegations that they say remedy the standing problems identified in Masterson. Doc. 27 at 5-6. The Court addresses those below in its alternative analysis on standing. But for purposes of issue preclusion, the Court finds Plaintiffs have not identified any change in circumstances that should be considered under the curable-defect exception. In other words, Plaintiffs identify nothing that they learned after Masterson was dismissed that would

permit them to get around the “identical issue” element. Arguably, the only “new” information in the complaint that was not included in the Masterson complaint is the handful of allegations about the group allegedly responsible for the data breach, Black Basta. See Doc. 1 at ¶¶ 36-38. Plaintiffs also state that the new complaint includes allegations about how cybercriminals like Black Basta use stolen data. Doc. 27 at 3. But Plaintiffs never claim that this information was learned after Masterson was dismissed. The articles about Black Basta cited in the complaint suggest that this information is not new, as one is dated November 29, 2023, see Doc. 1 at 7 n.7, which was before Masterson was decided, and the other is dated August 23, 2022, id. at 9 n.8, which was before Masterson was even filed.2 Nor is it

believable that Plaintiffs only recently learned that cybercriminals use stolen data. Adding additional information that could have been included in the original action is not sufficient to invoke the curable-defect exception. Park Lake Res. Ltd. Liab., 378 F.3d at 1137-38 (agreeing with the statement that “it does not make sense to allow a plaintiff to begin the same suit over and over again in the same court, each time alleging additional facts that the plaintiff was aware of from the beginning of the suit, until it finally satisfies the jurisdictional requirements” (internal quotation and citation omitted)); N.M. Off-Highway Vehicle All., 702 F. App’x at 712 (“Other authorities have also affirmed the preclusive effect of prior lack-of-standing

2 Neither of the articles reference IMA. determinations when the plaintiff only offers facts that were available before dismissal of the first action.”). Here, Plaintiffs don’t explain why this information could not have been included in Masterson. Accordingly, the Court finds the standing issue here is identical to the standing issue in Masterson and Plaintiffs have not sufficiently invoked the “curable-defect exception.”

2. Adjudication on the Merits The second element of issue preclusion is met if the prior action was finally adjudicated on the merits. Park Lake Res. Ltd. Liab., 378 F.3d at 1136. Plaintiffs argue that this element cannot be met here because Masterson was dismissed for lack of subject-matter jurisdiction and the Court never considered the merits of the case. Doc. 27 at 5-6. Plaintiffs are correct that dismissals based on jurisdiction are without prejudice, see Brereton v. Bountiful City Corp., 434 F.3d 1213, 1216 (10th Cir. 2006), and therefore are ordinarily not adjudications “on the merits,” Park Lake Res. Ltd. Liab., 378 F.3d at 1136. But dismissals for lack of jurisdiction are excepted from this element of issue preclusion. Id.; N.M. Off-Highway

Vehicle All., 702 F. App’x at 711 (“The second element, final adjudication on the merits, is not a prerequisite to preclusion of issues determined in ruling on a jurisdictional question, however.”); Burrell v. Armijo, 456 F.3d 1159, 1172 n.10 (10th Cir. 2006) (“[A] dismissal for lack of jurisdiction, such as sovereign immunity, is an exception to the final adjudication on the merits requirement.”). Thus, where issue preclusion is based on a jurisdictional dismissal, as Masterson was, an adjudication on the merits is not required. Rather, “dismissals for lack of jurisdiction preclude future relitigation of that jurisdictional question.” Boulter v. Noble Energy Inc., 74 F.4th 1285, 1289 (10th Cir. 2023). This includes dismissals without prejudice based on standing. See N.M. Off-Highway Vehicle All., 702 F. App’x at 711-12.3 Accordingly, the fact that Masterson was dismissed without prejudice for lack of jurisdiction does not limit IMA’s ability to argue issue preclusion in this case. Issue preclusion still applies to the question of standing that was decided in Masterson if the other factors are met.

3. Privity of the Parties The third element is that the party against whom the doctrine is invoked was a party in the previous case. Park Lake Res. Ltd. Liab., 378 F.3d at 1136. Plaintiffs concede this element is met here, as they were also the plaintiffs in Masterson. See Doc. 27 at 5 n.1. 4. Full and Fair Opportunity to Litigate The fourth element is that the party against whom the doctrine is raised had a full and fair opportunity to litigate the issue in the prior action. Park Lake Res. Ltd. Liab., 378 F.3d at 1136. On this point, courts “focus on whether there were significant procedural limitations in the prior proceeding, whether the party had the incentive to litigate fully the issue, or whether effective

3 Plaintiffs’ argument on this point misapprehends the distinction between claim preclusion and issue preclusion. See Cory v. Fahlstrom, 143 F. App’x 84, 86-87 (10th Cir. 2005) (“The district court decided this case on claim preclusion grounds, which was improper because claim preclusion only applies when the prior suit ‘ended with a judgment on the merits.’ . . . . Issue preclusion, however, is appropriate with respect to the claims in the second lawsuit that mirror the claims in the first lawsuit.” (emphasis added)); see also 18A Charles Alan Wright & Arthur R. Miller, Federal Practice and Procedure § 4436 (3d ed., June 2024 update) (“Although a dismissal for lack of jurisdiction does not bar a second action as a matter of claim preclusion, it does preclude relitigation of the issues determined in ruling on the jurisdiction question unless preclusion is denied for some other reason.”). Plaintiffs also cite Williams v. Sprint/United Mgmt. Co., for the proposition that “it is well settled that a dismissal for lack of subject matter jurisdiction is not an adjudication on the merits for purposes of res judicata.” 2006 U.S. Dist. LEXIS 4392, at *5 n.1 (D. Kan. 2006). But the court there seems to be drawing a distinction between claim preclusion (called res judicata), and issue preclusion, as it also stated that “Defendant is correct that issue preclusion prevents Mr. Shikles from relitigating the question of subject matter jurisdiction as that issue has been fully litigated and decided.” Id. at *5 (emphasis added). Here, only issue preclusion is at issue. See Boulter v. Noble Energy Inc., 2024 WL 1526289, at *2 n.1 (10th Cir. 2024) (noting that res judicata is sometimes used to refer to both claim and issue preclusion but that courts also use “res judicata” to refer to claim preclusion and “collateral estoppel” to refer to issue preclusion). litigation was limited by the nature or relationship of the parties.” Burrell, 456 F.3d at 1172 (internal quotation and citation omitted). IMA argues this element is met because Plaintiffs opposed the motion to dismiss in Masterson, did not appeal, and never sought leave to amend. Plaintiffs briefly respond that they had “no choice but to file a new complaint, thereby giving rise to this action” because the Court

did not grant leave to amend in Masterson. Doc. 27 at 6-7. Plaintiffs’ argument on this point is not well-taken. In Masterson, Plaintiffs filed an initial complaint. They amended once before IMA entered an appearance. They amended again after the Plaintiffs’ claims were consolidated. They amended a third time by motion. It was therefore the fourth iteration of the complaint in Masterson that was the subject of the motion to dismiss. The motion to dismiss challenged Plaintiffs’ Article III standing. Plaintiffs filed an 18-page response brief, which addressed the standing argument. IMA filed a reply brief. During this briefing, Plaintiffs never requested leave to amend to address any of the standing issues.4 And Plaintiffs did not appeal Masterson. Instead, Plaintiffs filed this case

using a nearly identical complaint a little over a month later. Nothing about these circumstances suggest there was any procedural limitation imposed on Plaintiffs. They had a full and fair opportunity to establish standing in Masterson but still came up short. The fact that the Court did not sua sponte give Plaintiffs leave to amend (yet again) does not change this conclusion.

4 Frequently, plaintiffs include a blanket request for leave to amend in responding to a motion to dismiss should the Court accept the arguments raised in the motion to dismiss. Such “shots in the dark” are not proper and are generally not granted. See Brooks v. Mentor Worldwide LLC, 985 F.3d 1272, 1282-83 (10th Cir. 2021). However, the Court notes Plaintiffs did not even do that in Masterson. And they did not formally move for leave to amend in compliance with the federal and local rules. Plaintiffs did briefly request the chance to conduct discovery, but they did not explain what discovery was needed or how discovery would enable them to discover their own injuries. In sum, the Court finds issue preclusion bars Plaintiffs’ attempt to relitigate the issue of whether they have standing to pursue their claims. As the Court has already addressed this issue in Masterson, this case is dismissed for the same reason. B. Standing Although issue preclusion bars relitigation of standing, the Court has considered whether

any of the additional allegations would change the standing analysis outlined in Masterson. The Court finds that none of the additional allegations or arguments persuade the Court that a different outcome on standing is warranted. Motions to dismiss for lack of jurisdiction under Rule 12(b)(1) can generally take two forms: a facial attack or a factual attack. “[A] facial attack on the complaint’s allegations as to subject matter jurisdiction questions the sufficiency of the complaint.” Holt v. United States, 46 F.3d 1000, 1002 (10th Cir. 1995), abrogated on other grounds by Cent. Green Co. v. United States, 531 U.S. 425, 437 (2001). In that situation, the allegations in the complaint are accepted as true. Id. A factual attack looks beyond the operative complaint to the facts on which subject-matter

jurisdiction depends. Id. at 1003. Plaintiffs bear the burden of establishing Article III standing. Ward v. Utah, 321 F.3d 1263, 1266 (10th Cir. 2003). A plaintiff can do this by showing “that (1) he or she has suffered an injury in fact; (2) there is a causal connection between the injury and the conduct complained of; and (3) it is likely that the injury will be redressed by a favorable decision.” Id. (internal quotation and citation omitted). An injury in fact must be “(a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical.” Initiative & Referendum Inst. v. Walker, 450 F.3d 1082, 1087 (10th Cir. 2006). Traceability requires a plaintiff to allege “a substantial likelihood that the defendant’s conduct caused [the] plaintiff’s injury in fact.” Santa Fe All. for Pub. Health & Safety v. City of Santa Fe, N.M., 993 F.3d 802, 814 (10th Cir. 2021). A court lacks jurisdiction if Article III standing is not met. See Lujan v. Defs. of Wildlife, 504 U.S. 555, 559 (1992). In evaluating whether Plaintiffs have demonstrated Article III standing, the Court focuses on the claimed injuries as alleged by Plaintiffs: actual misuse of data, lost time monitoring accounts, emotional distress, loss of privacy, diminished value of personal information, risk of

future injury, and delayed notification. See Doc. 27 at 7-12. These are the same injuries claimed in Masterson. Masterson, 2023 WL 8647157, at *3. For some of these claimed injuries—lost time, emotional distress, diminished value of personal information, and delayed notification—the cited portions of the complaint are substantively identical to those in Masterson. Compare Doc. 1 at ¶¶ 57, 68-70, 180, 95-96, 105, and 114 with Masterson complaint at ¶¶ 47, 59-61, 162, 79-80, 87, and 96. Plaintiffs make no effort to explain why a different outcome should occur here. Thus, the Court incorporates its rulings from Masterson and finds Plaintiffs have failed to assert standing based on these claimed injuries for the same reasons as stated in Masterson. See Masterson, 2023 WL 8647157, at *6-8.

For the remaining three claimed injuries—actual misuse of data, loss of privacy, and risk of future injury—Plaintiffs cite some allegations that are different than in Masterson. The Court therefore considers these claimed injuries based on the modified allegations. 1. Actual Misuse of Data Masterson and Abel both allege actual misuse of their data to establish an injury-in-fact.5 IMA makes both a factual and facial attack on these claims.6 In its factual attack, IMA submits

5 Zerbe alleged no misuse in Masterson. Masterson, 2023 WL 8647157, at *4. He still does not allege any misuse in this case. 6 The Court is mindful that factual and facial attacks are analytically distinct. But it notes that the arguments are substantively the same: that Plaintiffs have not pleaded, and there is no evidence, that IMA had the data allegedly misused, and they cannot trace any misuse to IMA. declarations that the claimed misuse of data—false charges to Masterson’s Medicare account and false charges on Abel’s debit and credit cards—cannot be traced to IMA or the data breach because IMA did not possess that information. Docs. 24-1 and 24-2. Plaintiffs respond to this factual attack that the complaint now alleges that Masterson’s Social Security number was compromised in the data breach, and that misuse is shown because he received a phishing call from someone who had

that information. Doc. 27 at 8. But like in Masterson, the only link to IMA is that this misuse occurred after the data breach. In Masterson, the Court rejected this argument as insufficient to show traceability, and nothing Plaintiffs have added to complaint change this conclusion. See Masterson, 2023 WL 8647157, at *4. Plaintiffs argue that the additional allegations in the complaint “go well beyond timing allegations.” Doc. 27 at 5. The Court disagrees. Other than timing, the only additional allegation cited by Plaintiffs linking the phishing call to the data breach is the conclusory statement that “[o]n information and belief, the phishing calls Plaintiff experienced is a result of Defendant’s exposure of his Private Information for theft and sale on the dark web and a consequence of the

Data Breach.” Doc. 1 at ¶ 77. This conclusory statement is not sufficient to establish standing. See Brady Campaign to Prevent Gun Violence v. Brownback, 110 F. Supp. 3d 1086, 1092 (D. Kan. 2015) (noting that a court is not bound by conclusory allegations in determining whether standing exists). As to Abel, Plaintiffs argue that the misuse of her credit and debit cards is traceable to IMA even if IMA never had that information because the data breach exposed her date of birth, name, and driver’s license number. But as discussed in Masterson, it’s not clear how this led to misuse of Abel’s credit and debit cards. Masterson, 2023 WL 8647157, at *4-5. Plaintiffs allege cybercriminals somehow compiled this information with other information (known as “Fullz” packages) to access her debit and credit cards, and that this plausibly alleges an injury traceable to IMA. Doc. 27 at 8-9. The Court rejected the argument about “Fullz” packages in Masterson as insufficient to show how the combination of some stolen data with unspecified other data available on the internet results in an injury traceable to IMA. Masterson, 2023 WL 8647157, at *5. Plaintiffs ostensibly argue they have expanded on these allegations about “Fullz” packages. Doc. 27 at 5-6.

But the paragraph cited is just a conclusory restatement of the argument that cybercriminals need not steal actual financial account information but can instead cross reference data from the data breach with other information available online to enable fraudulent activity. Nothing about this additional paragraph changes the analysis in Masterson.7 On the facial attack, IMA argues there are no allegations that IMA had the data Masterson or Abel claimed was misused, and the misuse is only alleged to be connected to the data breach because it came after. The Court upheld this facial challenge because it demonstrated there were no plausible allegations that any injury suffered by Masterson or Abel was traceable to IMA, even accepting the allegations as true. IMA makes similar arguments again here.

In response to IMA’s facial attack, Plaintiffs simply disagree that they have not plausibly alleged any concrete injury attributable to IMA. The argument is largely just a rehashing of the above analysis. They don’t offer any reason why the Court should differ from its holding in Masterson. Accordingly, the Court again finds Plaintiffs have not established standing based on any actual misuse of their data.

7 Plaintiffs also cite an allegation that IMA does not know the full scope of the data breach. Doc. 27 at 6. But this doesn’t make the speculative nature of Plaintiffs’ claimed injuries any more concrete. 2. Loss of Privacy In Masterson, the Court rejected Plaintiffs’ claimed injury for loss of privacy because there were no allegations that Plaintiffs’ private information had ever been viewed by a third party. Masterson, 2023 WL 8647157, at *7. Plaintiffs argue they’ve shown a concrete injury based on the additional allegation that IMA exposed their data to Black Basta, which led to publication of

that data on the dark web. Doc. 27 at 10-11. The allegations that Black Basta was responsible for the data breach are new to this case, though as discussed above, there is no indication that Plaintiffs only recently learned this information. Plaintiffs cite to paragraphs 33-39 of the complaint. Doc. 27 at 11. Those paragraphs allege that IMA learned of unusual activity on their network, discovered that data may have been accessed without authorization, and that “upon information and belief,” the “Black Basta ransomware gang” was responsible for the cyberattack. Doc. 1 at ¶¶ 33-36. Black Basta “purportedly issued a ransom demand to IMA,” id. ¶ 37, and “on information and belief,” Black Basta releases stolen data on the dark web where cybercriminals can access it, id. ¶¶ 38-39.

These additional allegations do not allege an injury-in-fact for loss of privacy under the standards discussed in Masterson. At most, this is just an allegation that Black Basta was responsible for the attack and that Black Basta puts information on the dark web. There are still no particularized allegations that Plaintiffs’ data was viewed or exposed. See In re Sci. Applications Int’l Corp. (SAIC) Backup Tape Data Theft Litig., 45 F. Supp. 3d 14, 29 (D.D.C. 2014) (“[U]ntil Plaintiffs can aver that their records have been viewed (or certainly will be viewed), any harm to their privacy remains speculative.”). And even assuming it was, this does not necessarily establish an Article III injury. C.C. v. Med-Data Inc., 2022 WL 970862, at *10 (D. Kan. 2022) (“Even if this upload qualifies as the requisite ‘publicity’ for a public disclosure of private facts claim, plaintiff hasn’t alleged a concrete harm resulted from this publicity. She hasn’t alleged any harm to her reputation from the alleged breach.”). 3. Risk of Future Injury In support of their argument about the risk of future injury, Plaintiffs cite paragraphs 49 and 62 of the complaint. Doc. 27 at 11. The allegation in paragraph 62 is identical to paragraph 52

in the Masterson complaint. Paragraph 49 in the complaint appears to be new. It states that IMA has offered complimentary credit monitoring. Plaintiff argues that IMA would not offer credit monitoring “if the risk of Plaintiffs suffering fraud and identity theft did not exist.” Doc. 27 at 11. This additional paragraph does not meaningfully change the analysis in Masterson. In Masterson, the Court noted that the risk of future injury is too attenuated without some actual misuse. Masterson, 2023 WL 8647157, at *8. As discussed above, Plaintiff still fail to plausibly allege any injury from actual misuse of their data attributable to IMA. Given this, Plaintiffs’ new paragraph about credit monitoring is not sufficient to establish standing based on the risk of future injury.

In sum, the Court finds that none of the additional allegations warrant a different outcome on standing from Masterson, even assuming issue preclusion did not bar Plaintiffs from relitigating the question. C. Failure to State a Claim The Court has found that this action is barred under principles of issue preclusion. And even considering the additional allegations, the Court finds no grounds to deviate from its earlier ruling about standing. Accordingly, the Court does not reach the merits of IMA’s arguments about Plaintiffs’ individual claims. III. CONCLUSION THE COURT THEREFORE ORDERS that IMA’s Motion to Dismiss Plaintiffs’ Class Action Complaint Under FRCP 12(b)(1) and 12(b)(6) (Doc. 23) is GRANTED. This case is again dismissed without prejudice under Rule 12(b)(1) for lack of subject-matter jurisdiction.8, 9 IT IS SO ORDERED.

Dated: August 6, 2024 /s/ Holly L. Teeter HOLLY L. TEETER UNITED STATES DISTRICT JUDGE

8 Plaintiffs alternatively seek leave to take jurisdictional discovery. Doc. 27 at 7 n.2. Even if discovery could address the standing issues identified, it does not overcome IMA’s argument that issue preclusion bars Plaintiffs from relitigating standing. 9 See Boulter, 2024 WL 1526289, at *5 (noting that dismissal based on the preclusive effect of an earlier jurisdictional ruling is without prejudice).