Cooper v. Bonobos, Inc.

Background

Bradley Cooper brought a putative class action against Bonobos, Inc. concerning a 2020 data breach. Cooper had purchased approximately $170 of merchandise through Bonobos’s website in June 2013 and provided his name, address, email address, telephone number, and credit card information. In August 2020, hackers known as “Shiny Hunters” accessed Bonobos’s cloud backup database and posted stolen information on a hacker website forum.

The exposed information allegedly included customer addresses, telephone numbers, email addresses, order histories, Internet Protocol addresses, encrypted passwords, and partial credit card numbers consisting of the last four digits. Bonobos notified affected customers in January 2021, stating that contact information and encrypted passwords may have been viewed, that the actual passwords were not visible, and that payment-card information was not affected. Bonobos reset the account passwords and logged users out of their accounts.

Cooper alleged that he changed his Bonobos password, placed a security freeze on his credit, purchased credit repair and protection services for $85 per month, bought a robocall-blocking subscription for $19.99, and spent time dealing with spam texts, calls, and emails. He asserted claims for negligence, violation of Section 349 of the New York General Business Law, and unjust enrichment. Bonobos moved to dismiss under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6), arguing that the court lacked subject-matter jurisdiction and that Cooper failed to state a claim.

Standing Analysis

Federal-court standing requires an injury in fact that is concrete, particularized, and actual or imminent, as well as causation and redressability. In a class action, at least one named plaintiff must have standing. A threatened injury can satisfy this requirement when it is certainly impending or when there is a substantial risk that it will occur, but a plaintiff cannot create standing merely by spending money to protect against a speculative harm.

The court applied the Second Circuit’s framework for data-breach standing, which considers whether the data was exposed through a targeted effort, whether any of the data was already misused, and whether the data was sensitive enough to create a high risk of identity theft or fraud. The court found that the targeted-theft factor favored Cooper because a known hacking group stole the information. But the other factors did not establish standing.

Cooper did not allege that his accounts, or other Bonobos customers’ accounts, had actually been compromised through credential stuffing. Although the information was posted on a hacker forum, the court concluded that this fact did not establish a substantial future risk because the exposed data was not sufficiently sensitive. The court characterized the contact information as generally publicly available, found no adequately alleged risk from exposure of the Internet Protocol address, and noted that Cooper had not plausibly alleged that criminals could use the last four digits of his credit card to harm him. The court also found that Cooper’s encrypted password theory depended on unsupported assumptions that the password could be decrypted and reused, and Cooper did not allege that he used the same password on other accounts.

The court further held that Cooper’s mitigation expenses could not establish standing because he had not first shown a substantial risk of identity theft or fraud. It rejected his allegation that his personal information lost value because he did not plausibly allege that he intended to sell the information or that someone would have bought it as a standalone product. The court also found that the alleged increase in spam calls, texts, and emails did not establish an injury in fact and was not sufficiently connected to Bonobos’s conduct. Finally, the court noted that Cooper had not alleged that credential stuffing was actually used against him.

Disposition

Judge Jesse M. Furman concluded that Cooper had not alleged an injury that was certainly impending or based on a substantial risk of harm. The court therefore dismissed the claims without prejudice for lack of subject-matter jurisdiction. Because the court lacked jurisdiction, it did not address Bonobos’s other arguments under Rule 12(b)(6). The court stated that Cooper had already amended his pleadings once and that further amendment would be futile, directed the Clerk to terminate Bonobos’s motion, enter judgment consistent with the opinion, and close the case.