Fitzgerald v. Jeff Anderson & Associates

Background

Plaintiff Andrew Fitzgerald, a California citizen, received legal services from defendant Jeff Anderson & Associates, PA, a Minnesota law firm that represented victims of childhood sexual abuse. In September 2025, Anderson detected suspicious activity in its network. Its investigation revealed that on September 18, 2025, an unauthorized party gained access to parts of its computer environment and copied certain data. Anderson's review concluded in December 2025, and it began notifying affected individuals in February 2026.

Anderson notified Fitzgerald that his Social Security number was "present in the potentially impacted data," but stated there was "no evidence" his information had been made public or misused and "no reason to believe that it ever will." Anderson offered 24 months of complimentary credit monitoring through Experian.

Fitzgerald filed this lawsuit in February 2026, individually and as a proposed class action. His amended complaint asserted three claims: (1) negligence; (2) breach of implied contract; and (3) breach of the implied covenant of good faith and fair dealing. He alleged four categories of harm: (a) time and expenses spent monitoring accounts and seeking legal counsel; (b) an imminent risk of identity theft and fraud; (c) diminution in the value of his personally identifiable information (PII — data that can identify a specific person, such as a Social Security number); and (d) anxiety and emotional distress. He sought both monetary damages and equitable relief (injunctive and declaratory relief requiring Anderson to implement stronger cybersecurity measures).

Anderson moved to dismiss under Federal Rule of Civil Procedure 12(b)(1) (lack of subject matter jurisdiction — here, lack of standing) and Rule 12(b)(6) (failure to state a claim upon which relief can be granted).

Legal Standard: Article III Standing

Article III standing — the constitutional requirement that a plaintiff show a sufficient stake in the dispute to bring a federal lawsuit — is a threshold issue that courts must resolve before addressing the merits. To establish standing, a plaintiff must clearly allege facts showing: (1) an injury in fact; (2) that the injury is fairly traceable to the defendant's conduct; and (3) that a favorable ruling would redress the injury. An injury in fact must be "concrete and particularized" and "actual or imminent, not conjectural or hypothetical." The court separately analyzed standing for equitable relief and for monetary damages.

Standing for Equitable Relief

Fitzgerald sought injunctive and declaratory relief requiring Anderson to implement a comprehensive cybersecurity system to prevent future breaches. To establish standing for such forward-looking relief, a plaintiff must show an imminent and substantial risk of future harm — not merely a generalized interest in data security.

The court found Fitzgerald's allegations insufficient. The amended complaint stated only that Fitzgerald had a "continuing interest" in ensuring his PII is "protected and safeguarded from future breaches." The court concluded this established nothing more than the same risk of future cyberattack faced by virtually any holder of private data. Without allegations establishing a likelihood that Anderson specifically would suffer a future breach, Fitzgerald lacked standing for equitable relief. The court dismissed these requests.

Standing for Monetary Relief

For monetary damages, the analysis shifts from future risk to whether the plaintiff has suffered or will likely suffer a concrete harm because of the breach that already occurred. A mere risk of future harm, standing alone, is not enough to establish a concrete injury for damages purposes.

A. Time and Expenses Spent Monitoring

Fitzgerald alleged he spent time verifying the breach, exploring credit monitoring options, self-monitoring his accounts, and seeking legal counsel. The court held these allegations insufficient because the amended complaint contained no allegation that Fitzgerald's PII was actually disclosed to or misused by anyone. Under controlling precedent, a plaintiff cannot create standing by taking precautionary steps in response to a purely speculative future threat. Because no actual misuse was alleged, Fitzgerald lacked standing to recover for this category of harm.

B. Risk of Future Identity Theft and Fraud

Fitzgerald alleged he faced an "imminent and impending" risk of fraud and identity theft. The court identified two independent deficiencies.

First, the amended complaint did not adequately allege what information was actually disclosed. Anderson's notice stated only that Fitzgerald's Social Security number was "present in the potentially impacted data" — not that it was actually accessed or exfiltrated — and affirmatively stated there was no evidence of misuse.

Second, even if specific disclosure had been alleged, the complaint did not allege that Fitzgerald's own PII had been misused or that he experienced any concrete injury. The court distinguished two cases Fitzgerald relied on: in Perry v. Bay & Bay Transportation Services, Inc., the plaintiff alleged a cybercriminal used his specific disclosed data to impersonate his bank and scam him out of $500; in In re Pawn America Minnesota, LLC, at least some plaintiffs alleged actual identity theft resulting from the breach. Fitzgerald alleged no comparable facts. Accordingly, he failed to plead a sufficient risk of future harm.

C. Diminution in Value of PII

Fitzgerald claimed his PII lost monetary value as a result of the breach. The court found these allegations too general and conclusory. The amended complaint did not state the monetary value of Fitzgerald's PII before or after the breach, did not explain how its value was reduced, and did not allege that Fitzgerald intended to sell his PII or was otherwise harmed by any change in its economic value. In a footnote, the court also rejected a related "lost benefit of the bargain" theory — the idea that Fitzgerald received less than he paid for because Anderson failed to protect his data — because the complaint did not allege his PII had any material economic value in relation to the legal services received from Anderson. Fitzgerald therefore lacked standing to assert either of these injury theories.

D. Anxiety and Emotional Distress

Fitzgerald alleged he suffered "anxiety and increased concerns for the loss of privacy" and anxiety about cybercriminals accessing, using, and selling his PII. The court held these allegations were not fairly traceable to the data breach because the complaint did not allege that Fitzgerald's own PII was actually disclosed or that he faced a substantial risk of identity theft arising from the breach. Emotional distress based on fear of hypothetical future harm that is not certainly impending cannot establish standing. The court contrasted this with In re Pawn America, where emotional distress claims survived because some plaintiffs had alleged actual identity theft from the breach. Here, no such allegations were present.

Disposition

Because Fitzgerald failed to establish standing for any of his requested forms of relief, the court granted Anderson's motion to dismiss without prejudice — meaning Fitzgerald is not barred from refiling if he can allege sufficient facts. The court expressly declined to reach Anderson's alternative argument that the complaint failed to state a claim under Rule 12(b)(6), as the standing deficiency was dispositive.