Nunow v. FEI.COM

Background

Defendant FEI.COM, Inc. operates MnCHOICES, a computer platform used to determine eligibility for certain government programs. The personally identifiable information (PII) of plaintiff Khadijo Nunow and at least 303,965 others—including names, sex, dates of birth, phone numbers, Medicaid IDs, last four digits of Social Security numbers, and addresses—was stored on MnCHOICES. On November 18, 2025, FEI discovered a cyberattack in which an unauthorized individual accessed that PII. On January 16, 2026, the Minnesota Department of Human Services notified affected individuals, including Ms. Nunow, of the breach. Ms. Nunow filed suit four days later in Ramsey County District Court, asserting three claims under Minnesota law: (1) negligence in failing to protect her PII, (2) breach of implied contract, and (3) breach of the implied covenant of good faith and fair dealing. She sought class certification, damages, and extensive injunctive relief including mandatory cybersecurity audits, penetration testing, a prohibition on cloud-based storage of PII, annual security training for FEI employees, and education for class members about data breach risks. FEI was served January 22, 2026, and removed the case to federal court on February 23, 2026. FEI then moved to dismiss, arguing first that Ms. Nunow lacked Article III standing (the constitutional minimum required to sue in federal court), and as a fallback, that her claims failed on the merits.

CAFA Jurisdiction

Before reaching the standing issue, the court independently examined whether it had subject-matter jurisdiction under the Class Action Fairness Act (CAFA), 28 U.S.C. § 1332(d), which requires: (1) a proposed class of more than 100 members, (2) minimal diversity between the parties, and (3) more than $5 million in controversy. As the removing party, FEI bore the burden of establishing these elements.

Numerosity and diversity were uncontested. The complaint alleged over 303,965 potential class members, satisfying numerosity. Ms. Nunow alleged Minnesota citizenship; FEI alleged Maryland citizenship (incorporating and having its principal place of business there), confirmed at the hearing.

Amount in controversy required closer analysis. The complaint sought monetary damages but did not specify a sum. FEI's notice of removal attempted to satisfy the $5 million threshold two ways:

1. Monetary damages via secondary-market data valuation: FEI extrapolated from the complaint's allegation that personal information sells for $40–$200 on illicit markets, arguing even at $40 per person, 303,965 class members produces over $12 million. The court rejected this theory, finding no rational connection between a data-breach victim's actual monetary harm and the illicit market value of their stolen data, and noting FEI cited no supporting authority.

2. FEI's cost of compliance with requested injunctive relief: FEI described the sweeping operational and technological changes Ms. Nunow's injunctive relief would require and alleged these would cost more than $5 million. The court found this sufficient, relying on what it read as an implicit adoption of the "either-viewpoint rule" (counting either the plaintiff's gain or the defendant's cost) by the Eighth Circuit in Leflar v. Target Corp., 57 F.4th 600 (8th Cir. 2023).

After the hearing, the court ordered supplemental briefing. FEI submitted a declaration from its general counsel, Scott Morrow, estimating that converting MnCHOICES from a cloud-based to a server-based infrastructure (as Ms. Nunow's injunction would require) would cost $20–$30 million, and that educating all class members would also exceed $5 million. Ms. Nunow called these estimates "untested and self-serving" but offered no counter-evidence. The court found FEI had shown by a preponderance of the evidence that the amount in controversy exceeded $5 million, satisfying CAFA.

Article III Standing Analysis

The central issue was whether Ms. Nunow plausibly alleged a concrete "injury in fact" sufficient to satisfy Article III of the Constitution. The court applied the standard from Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992), and TransUnion LLC v. Ramirez, 594 U.S. 413 (2021). Because FEI mounted a facial challenge (accepting the complaint's allegations as true), the court applied the Twombly/Iqbal plausibility standard.

The court synthesized seven lessons from data-breach standing caselaw and applied each:

1. No identity theft or fraud alleged: Ms. Nunow did not claim to have been a victim of identity theft or fraudulent charges, nor did the complaint identify any class member who had.

2. No express contract: Ms. Nunow's implied-contract theory could not support the "benefit of the bargain" standing theory the Eighth Circuit recognized only for express contracts in Kuhns v. Scottrade, 868 F.3d 711 (8th Cir. 2017).

3. Uncertainty about what data was stolen and how it could be misused: Although the complaint listed categories of data stored on MnCHOICES, it acknowledged that Ms. Nunow was "in the dark" about what specifically was taken. The complaint did not explain how any of the potentially stolen data could be used to perpetrate identity theft, credit fraud, or similar harm.

4. Unknown perpetrator with no established criminal intent: The complaint described the perpetrator generically as an "unauthorized individual" and conceded the perpetrator was "unknown." The court further noted that the Department of Human Services breach notice—properly considered because the complaint referenced it—identified the perpetrator as "a user affiliated with a licensed health care provider" who "accessed more data than was reasonably necessary," undercutting the complaint's characterization of the breach as a criminal, profit-motivated hack.

5. Speculative future harm: The complaint expressly stated that Ms. Nunow could only "speculate" about where her data ended up and acknowledged the data "may" end up on the dark web or in the hands of companies for targeted marketing. Under Clapper v. Amnesty International USA, 568 U.S. 398 (2013), allegations of possible future injury are not sufficient.

6. Anxiety and mitigation costs: Ms. Nunow alleged annoyance, anxiety, and time spent exploring credit monitoring. The court held that without a plausible showing of substantial risk of future identity theft or like injury, such self-imposed costs cannot establish a present Article III injury, citing In re SuperValu, Inc., 870 F.3d 763 (8th Cir. 2017), and Clapper.

7. Diminished monetary value of PII: Ms. Nunow alleged her PII suffered a "diminution in value." The court rejected this theory because the complaint never alleged what her data was worth to her, how she might have monetized it, or that she intended to do so. The court cited several recent district court decisions—including Fitzgerald v. Jeff Anderson & Assocs., No. 26-cv-1486 (D. Minn. Aug. 3, 2026)—reaching the same conclusion.

Disposition

Because Ms. Nunow lacked Article III standing and the case had been removed from state court (rather than originally filed in federal court), the court was required to remand rather than dismiss. Citing Wallace v. ConAgra Foods, 747 F.3d 1025 (8th Cir. 2014), and 28 U.S.C. § 1447(c), Chief Judge Tostrud granted FEI's motion to dismiss for lack of subject-matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1) and remanded the case to Minnesota District Court, Second Judicial District (Ramsey County).