Ortiz v. Perkins & Co

Background

Alice Ortiz sued Perkins & Co. over a data breach involving information stored for Perkins & Co. by its cloud-storage vendor, Netgain. According to the notice sent to affected individuals, an attacker accessed Netgain’s servers between November 8, 2020, and December 3, 2020, and copied and stole some files, including information held by Perkins & Co. The information concerning Ortiz included her full name, financial account information, and Social Security number. Perkins & Co. offered credit monitoring and identity-restoration services and advised affected individuals to monitor their accounts and credit reports.

Ortiz alleged that she spent time verifying the breach, considering credit monitoring and identity-theft insurance, monitoring her accounts, and seeking legal counsel. She also alleged lost time, annoyance, and anxiety. Her complaint asserted claims for negligence, breach of implied contract, breach of the implied covenant of good faith and fair dealing, and unjust enrichment.

Standing

The court considered whether Ortiz had Article III standing, which requires a concrete injury, a connection between that injury and the defendant’s conduct, and a likelihood that a court decision would remedy the injury.

The court held that the increased risk of future fraud, standing alone, was not enough to establish standing for a damages claim after the Supreme Court’s decision in TransUnion LLC v. Ramirez. But the court found that Ortiz’s time spent dealing with the breach was a legally recognizable injury because the stolen information included Social Security numbers and could be used for identity theft. The court therefore found that Ortiz could establish standing at the pleading stage to seek damages based on that lost time.

The court reached a different conclusion concerning injunctive relief, which is a court order requiring or prohibiting future conduct. Ortiz had not explained how security measures by Perkins & Co. would prevent another breach of Netgain’s systems. The court found that she had not shown standing to seek an injunction but allowed her to amend her complaint to try to demonstrate that such relief was appropriate.

Claims

For negligence, the court recognized that Ortiz had adequately alleged an injury through the time she spent dealing with the breach. But the court found that she had not adequately alleged that Perkins & Co. was the legal or proximate cause of her injury. The breach occurred in Netgain’s system, and Ortiz relied on general data-security practices rather than identifying the specific duties Perkins & Co. allegedly breached and explaining how those breaches caused her harm. The court therefore found that the negligence claim was inadequately pleaded.

For breach of implied contract, Ortiz alleged that Perkins & Co. implicitly agreed to provide adequate security for her financial information because she had to provide that information to receive services. The court found these allegations too conclusory. Ortiz did not identify where Perkins & Co. made the alleged security assurance or explain why it created a contract. The court also noted that she had not clearly alleged the nature of the relationship between the parties or that she provided consideration—something given in exchange for a promise—for the alleged security services.

Because Ortiz had not adequately alleged an implied contract requiring Perkins & Co. to provide data security, the related claim for breach of the implied covenant of good faith and fair dealing also failed. The court stated that both the implied-contract and good-faith-and-fair-dealing claims were dismissed without prejudice, meaning the order did not bar Ortiz from attempting to replead them.

For unjust enrichment, Ortiz alleged that Perkins & Co. benefited from failing to disclose lax data-security practices. The court found that she did not identify any benefit Perkins & Co. retained. Her loss of time did not necessarily mean that Perkins & Co. gained anything, and the pleadings did not make clear that Perkins & Co. received a benefit from Ortiz, particularly if she had not hired the firm for services. The court dismissed the unjust-enrichment claim without prejudice.

Disposition

The court granted Perkins & Co.’s motion to dismiss. Ortiz could file an amended complaint within 21 days of the order. If she filed neither an amended complaint nor a notice stating that she would not file one, the court stated that it would dismiss the case under Federal Rule of Civil Procedure 41(b). The order does not separately state a dismissal qualifier for the negligence claim beyond finding that it was inadequately pleaded.