Opinion · District Court, N.D. Georgia
In re Young Consulting Data Breach Litigation
In re Young Consulting Data Breach Litig., No. 1:24-cv-03938, UP11442368 (District Court, N.D. Georgia Sept. 15, 2026)
- Type
- Opinion
- Court
- District Court, N.D. Georgia
- Jurisdiction
- Georgia
- Date
- 2026-09-15
- Topic
- litigation
IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF GEORGIA ATLANTA DIVISION IN RE YOUNG CONSULTING DATA CIVIL ACTION FILE NO. BREACH LITIGATION 1:24-CV-3938-TWT ALL CASES OPINION AND ORDER This is a class action data breach action. It is before the Court on Defendant California Physicians’ Service d/b/a Blue Shield of California’s (“Blue Shield”) Motion to Dismiss [Doc. 43] and Defendant Young Consulting, LLC’s d/b/a Connexure’s (“Young Consulting”) Motion to Dismiss [Doc. 45]. For the reasons set forth below, the Court GRANTS in part and DENIES in part Defendant Blue Shield’s Motion to Dismiss [Doc. 43] and GRANTS in part and DENIES in part Defendant Young Consulting’s Motion to Dismiss [Doc. 45]. I.
Citator
UpLaw has not yet analyzed In re Young Consulting Data Breach Litigation. The absence of a flag is not a finding that it is good law.
IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF GEORGIA
ATLANTA DIVISION
IN RE YOUNG CONSULTING DATA CIVIL ACTION FILE NO.
BREACH LITIGATION 1:24-CV-3938-TWT
ALL CASES
OPINION AND ORDER
This is a class action data breach action. It is before the Court on
Defendant California Physicians’ Service d/b/a Blue Shield of California’s
(“Blue Shield”) Motion to Dismiss [Doc. 43] and Defendant Young Consulting,
LLC’s d/b/a Connexure’s (“Young Consulting”) Motion to Dismiss [Doc. 45]. For
the reasons set forth below, the Court GRANTS in part and DENIES in part
Defendant Blue Shield’s Motion to Dismiss [Doc. 43] and GRANTS in part and
DENIES in part Defendant Young Consulting’s Motion to Dismiss [Doc. 45].
I. Background
This case arises from a data breach involving Defendants California
Physicians’ Service’s d/b/a Blue Shield of California and Young Consulting,
LLC d/b/a Connexure. Blue Shield is a health insurance company that
“provides coverage to approximately 4.5 million individuals.” (Consol. Am.
Class Action Compl. (“CAC”) ¶ 20 [Doc. 31].) Through its coverage, it collects
the personally identifiable information (“PII”) and protected health
information (“PHI”) of its “members, patients, customers, business partners,
and employees.” ( ¶¶ 21, 26.) Young Consulting is a company that provides
“software solutions” to health insurance companies, including Blue Shield. (
¶ 19.) In providing its services, Young Consulting accessed and maintained the
PII and PHI collected by Blue Shield and other health insurance companies.
( ¶ 36, 21.)
In April 2024, “an unauthorized actor” accessed Young Consulting’s
network and stole the PII and PHI of at least 1,071,336 individuals, including
information associated with Blue Shield. ( ¶¶ 46–47, 54, 60.) About four
months later, Young Consulting and Blue Shield notified the affected
individuals and the public about the data breach. ( ¶¶ 44–45.) The “Notice
Letter” states that the stolen data may have included names, Social Security
numbers, dates of birth, and “insurance policy/claim information.” Young
Consulting, LLC, (“Notice
Letter”) (last visited July 3, 2026),
https://youngconsulting.com/notice/youngconsulting-notice.html. 1 According
to the Complaint, the data likely also includes sensitive medical information
such as an individual’s diagnoses, treatments, physicians, and medications.
( CAC ¶ 54.) The prominent ransomware group BlackSuit later claimed
1 Courts ordinarily cannot consider documents outside the pleadings on
a motion to dismiss. Fed. R. Civ. P. 12(d). However, the Eleventh Circuit has
held that courts may do so if the document is “(1) central to the plaintiff's
claims; and (2) undisputed, meaning that its authenticity is not challenged.”
, 107 F.4th 1292, 1300
(11th Cir. 2024). Here, the
Notice Letter is obviously central to the Plaintiffs’ claims, and none of the
parties dispute its authenticity.
2
responsibility for the breach and published the stolen data on the “dark web”
for download. ( ¶¶ 48–53, 68.) As of the date of the Complaint’s filing, the
data remained available for download, along with a “directory listing each
stolen file by name.” ( ¶ 53.)
The Plaintiffs allege that this cyberattack was a foreseeable result of
Young Consulting’s failure to implement appropriate safeguards and Blue
Shield’s failure to vet and monitor Young Consulting. ( ¶¶ 42–43, 65–67, 73.)
The alleged injuries are numerous, including identity theft and fraud,
out-of-pocket expenses for fraud monitoring and prevention tools, and the
“[c]ontinued and imminent risk of future fraud and identity theft.” ( ¶ 115.)
The Plaintiffs further allege that Young Consulting’s “delayed and incomplete”
Notice Letter hindered their ability to respond quickly and proactively to the
breach. ( ¶ 122.)
The Plaintiffs assert a total of fifteen claims. They assert eight claims
against Defendant Young Consulting: negligence (Count I), negligence per se
(Count II), breach of fiduciary duty (Count VI), breach of third-party
beneficiary contract (Count X), declaratory and injunctive relief (Count XI),
and three state law claims under California law (Counts XII–XIV). And they
assert eleven claims against Blue Shield: negligence (Count III), negligence per
se (Count IV), unjust enrichment (Count V), breach of fiduciary duty
(Count VII), invasion of privacy in violation of the California Constitution
3
(Count VIII), breach of implied contract (Count IX), declaratory and injunctive
relief (Count XI), and four claims under California law (Counts XII–XV).
II. Legal Standard
A complaint should be dismissed under Rule 12(b)(1) only where the
court lacks jurisdiction over the subject matter of the dispute. Fed. R. Civ.
P. 12(b)(1). Attacks on subject matter jurisdiction come in two forms: “facial
attacks” and “factual attacks.”
, 104 F.3d 1256, 1260
(11th Cir. 1997). Facial attacks on the complaint “require the court merely to look and see if the plaintiff has sufficiently alleged a basis of subject matter jurisdiction, and the allegations in his complaint are taken as true for the purposes of the motion.” at 1261 (citation modified). On a facial attack, therefore, a plaintiff is afforded safeguards similar to those provided in opposing a Rule 12(b)(6) motion. ,645 F.2d 404, 412
(5th Cir. May 1981).2 “Factual attacks, on the other hand, challenge the existence of subject matter jurisdiction in fact, irrespective of the pleadings, and matters outside the pleadings, such as testimony and affidavits, are considered.” ,104 F.3d at 1261
(citation modified). On a factual attack,
“no presumptive truthfulness attaches to plaintiff’s allegations, and the
existence of disputed material facts will not preclude the trial court from
2 The Eleventh Circuit has adopted as binding precedent all decisions of
the Fifth Circuit issued prior to the close of business on September 30, 1981.
, 661 F.2d 1206, 1207
(11th Cir. 1981).
4
evaluating for itself the merits of jurisdictional claims.” , 175 F.3d 957
, 960–61 (11th Cir. 1999) (quotation marks and citation omitted).
A complaint should be dismissed under Rule 12(b)(6) only where it
appears that the facts alleged fail to state a “plausible” claim for relief.
, 556 U.S. 662, 678
(2009); Fed. R. Civ. P. 12(b)(6). A complaint may
survive a motion to dismiss for failure to state a claim, however, even if it is
“improbable” that a plaintiff would be able to prove those facts and even if the
possibility of recovery is extremely “remote and unlikely.”
, 550 U.S. 544, 556
(2007). In ruling on a motion to dismiss, the court
must accept the facts pleaded in the complaint as true and construe them in
the light most favorable to the plaintiff.
, 711 F.2d 989
, 994–95 (11th Cir. 1983);
, 40 F.3d 247, 251
(7th Cir. 1994) (noting that, at the pleading stage, the plaintiff “receives the benefit of imagination”). Generally, notice pleading is all that is required for a valid complaint. ,753 F.2d 974, 975
(11th Cir. 1985). Under notice pleading, the plaintiff need only give the defendant fair notice of the plaintiff’s claim and the grounds upon which it rests. ,551 U.S. 89, 93
(2007) (citing ,550 U.S. at 555
).
5
III. Discussion
A. Article III Standing
Standing is a “threshold jurisdictional question” that the Court must
address before all other questions.
, 494 F.3d 1356, 1359
(11th Cir. 2007) (citations omitted). Article III extends the judicial power of federal courts only to “cases” and “controversies” between parties. ,578 U.S. 330, 337
(2016) (quoting U.S. Const. art. III, §§ 1–2). To ensure that federal courts adjudicate only “cases” and “controversies,” the Plaintiffs must establish (1) an injury in fact, (2) causation, and (3) redressability. ,693 F.3d 1317, 1323
(11th Cir. 2012) (quoting
, 528 U.S. 167
, 180–81 (2000)). A suit may proceed as long as at least one named plaintiff possesses standing as to each claim advanced. ,999 F.3d 1247, 1261
(11th Cir. 2021) (citing ,941 F.3d 1116
, 1124–25 (11th Cir. 2019)). In its briefing, Defendant Young Consulting challenges the injury-in-fact and causation elements. Defendant Blue Shield does not challenge the Plaintiffs’ standing. 1. Injury in Fact An injury in fact is “(a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical.” ,693 F.3d at 1323
6
(quoting , 528 U.S. at 180–81). For plaintiffs seeking injunctive relief,
a “material risk of future harm” qualifies as a concrete injury. However, for
those seeking monetary relief, the “mere risk of future harm, without more,”
does not qualify as a concrete injury. , 73 F.4th 883, 889
(11th Cir. 2023) (citing ,594 U.S. 413, 2210
(2021)). Plaintiffs seeking monetary relief must allege either
(1) “tangible harms, like physical or monetary harms” or (2) “intangible harms,
like injuries with a close relationship to harms traditionally recognized as
providing a basis for lawsuits in American courts.” at 889. Here, the
Plaintiffs seek both injunctive and monetary relief.
Young Consulting denies the existence of an injury in fact, arguing that
there are no allegations of actual misuse of information or identity fraud nor
is there a substantial risk that either will occur in the future. (Br. in Supp. of
Def. Young Consulting’s Mot. to Dismiss, at 13 [Doc. 45-1].) The company notes
that, as of December 2025, nineteen months had passed since the data breach
without incident. ( )
The Plaintiffs satisfy the injury-in-fact requirement. No “actual”
identity theft or fraud is required to establish a concrete injury. As the
Eleventh Circuit stated, “a plaintiff whose personal information is subject to a
data breach can establish a concrete injury for purposes of Article III standing
if, as a result of the breach, he experiences ‘misuse’ of his data in some way.”
7
, 73 F.4th at 889
(quoting ,986 F.3d 1332, 1343
(11th Cir. 2021)); at 890 n.9 (recognizing
data misuse as an intangible harm sufficient to confer Article III standing, and
reading as consistent with ’s common law analog test despite
being issued before ). The misuse of a plaintiff’s personal
information includes instances in which cybercriminals “expose[ ]” the data
“for theft and sale on the dark web.” In those instances, the misuse
“establishes both a present injury—. . . personal information floating around
on the dark web—and a substantial risk of future injury—future misuse of
personal information associated with the hacked [information].” at 890.
Here, the Complaint alleges this exact kind of misuse. It alleges that the
BlackSuit hackers “made the stolen data available for download on the dark
web, exposing Plaintiffs’ and Class Members’ information to malicious actors
worldwide.” (CAC ¶ 52.) Indeed, the Complaint alleges that three Named
Plaintiffs received alerts that their sensitive data had been uploaded to the
dark web. ( ¶ 133, 159, 168.) The Complaint further alleges that “the stolen
data is still available for download” on the dark web, ( ¶ 53), and of a kind
that is “particularly valuable to thieves” seeking to commit “medical fraud,
identity theft, tax fraud, credit and bank fraud, and more,” ( ¶ 96). The
sensitive data allegedly includes the Plaintiffs’ “names, Social Security
numbers, dates of birth, and insurance claims information.” ( ¶ 3.) Accepting
8
these allegations as true, the Court finds that this alleged misuse of data
constitutes both an actual injury and a substantial risk of future injury.
, 73 F.4th at 890
. That three of the Named Plaintiffs received dark web alerts supports—rather than hurts—the Plaintiffs’ theory of standing, as it increases the risk that the data of other Plaintiffs will be on the dark web. ,749 F. Supp. 3d 1240
, 1258 (S.D. Fla. 2024) (citing
, 603 F. Supp. 3d 1183
, 1202 (S.D. Fla. 2022)). For purposes of proving a concrete injury, the Complaint need not contain further details on exactly who uploaded the data to the dark web or when, as Young Consulting suggests. Lastly, to the extent Young Consulting challenges the Plaintiffs’ statutory standing on the same grounds addressed above, (Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 13–14), the Court finds the Plaintiffs possess statutory standing. The Court addresses the standing arguments specific to the California Unfair Competition Law below. 2. Causation To satisfy the causation element, the Plaintiffs must show that their alleged injuries are “fairly traceable” to Defendant Young Consulting’s conduct. ,693 F.3d at 1323
(quoting , 528 U.S. at 180–81).
According to Young Consulting, the alleged injuries are not fairly traceable
9
because the Plaintiffs provide “no explanation” as to how they determined
Young Consulting’s actions caused their injuries and cannot establish who may
have uploaded the Plaintiffs’ PII to the dark web or when. ( Br. in Supp. of
Def. Young Consulting’s Mot. to Dismiss, at 11–12.)
The Court finds the Plaintiffs’ alleged injuries fairly traceable to
Defendant Young Consulting’s conduct. The Plaintiffs allege that Young
Consulting failed to “implement reasonable and appropriate administrative,
technical, and physical safeguards to protect the sensitive data it received and
maintained.” (CAC ¶ 42.) The Complaint lists a variety of security precautions
recommended by relevant government agencies that could hinder a
cyberattack like that launched by BlackSuit, then alleges on information and
belief that Young Consulting “failed to implement some or all of these
well-established security controls.” ( ¶¶ 71–73.) While the Plaintiffs do not
specify which security precautions Young Consulting failed to take or how the
hackers were able to infiltrate Young Consulting’s systems, allegations of such
are not required at this time. Indeed, it is likely the answers to these questions
can only be found through discovery. Lastly, the Court finds unpersuasive
Young Consulting’s suggestion that another data breach or incident may be
the reason why the Plaintiffs’ PII is on the dark web. For standing purposes, it
is sufficient that the Complaint points to a web post by BlackSuit claiming
responsibility for the cyberattack and claiming to have uploaded the sensitive
10
data to the dark web. ( ¶¶ 48–50.) And this is to say nothing of the fact that
at least one Plaintiff—Plaintiff Emily Desley-Bloom—received an alert that
her name and Social Security number were uploaded to the dark web due to
this specific data breach. ( ¶ 133.)
B. Choice of Law
Before proceeding to the merits of the common law claims, the Court
addresses choice of law. Georgia’s choice-of-law rules determine the applicable
state law. , 763 F.3d 1265, 1270
(11th Cir. 2014) (citations omitted). In Georgia, courts traditionally apply the law of the state where the tort was committed for tort claims ( ) and the law of the state where a contract was made for contract and quasi-contract claims ( ). ,532 B.R. 859, 865
(N.D. Ga. 2015)
(citations omitted). However, one odd exception to these rules is that “Georgia
courts do not apply other states’ common law” and instead “apply only the
statutory law of other states.”
, 823 Fed. App’x 815, 822 (11th Cir. 2020) (citing
, 713 F.2d 1500, 1503
(11th Cir. 1983)). In other words,
even if or would traditionally require the
application of another state’s laws, Georgia courts do not apply the substantive
law of that state unless codified in statute. The Georgia Supreme Court
re-affirmed this common law exception most recently in
11
, 300 Ga. 722
, 728–35 (2017) (“[A] Georgia court will defer to
another state’s statutes, as well as its judicial decisions authoritatively
interpreting those statutes, in determining the law of that state. . . . In the
absence of a statute, however, . . . a Georgia court will apply the common law
as expounded by the courts of Georgia.”).
Now, the Court will review the parties’ positions on choice of law. The
Defendants apply Georgia law to all common law claims for the purposes of the
present motions. (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 5 n.3
[Doc. 43-1] (noting that it does so “without conceding that Georgia law applies
to Plaintiffs or the entire putative class); Br. in Supp. of Def. Young
Consulting’s Mot. to Dismiss, at 17–25 (applying Georgia law without
expressly addressing choice of law).) By contrast, the Plaintiffs appear to apply
Georgia law to all tort claims but take a different approach for the contract and
quasi contract claims. For unjust enrichment, the Plaintiffs point out that
California law may govern the claim and conflict with Georgia law on the
subject. (Pls.’ Joint Resp. Br. to Defs.’ Mots. to Dismiss, at 28 [Doc. 51].) For
the third-party breach of contract claim (Count X), they argue it would be
premature to determine which state’s laws apply because the contracts,
including their choice-of-law provisions, have not yet been entered into the
record. ( at 29–30.) For the breach of implied contract claim (Count IX), the
Plaintiffs do not expressly address choice of law or raise any conflict-of-law
12
issues between the laws of Georgia, California, or other states. ( at 32–
33.)
The Court will apply Georgia law to all common law claims at this time
pursuant to the foreign law exception.3 , 713 F.2d at 1503
;
, 2022 WL 409484
, at *4 (N.D. Ga. Feb.
10, 2022) (quoting , 300 Ga. at 729–33);
, 861 Fed. App’x 270, 277–78 (citations omitted)).
No party has directed the Court to any relevant state statute regarding the
common law claims, and the Court will not seek out statutory bases for each of
the common law claims, though some may exist.
, 362 F. Supp. 3d 1295, 1312
(N.D. Ga. 2019) (applying
Georgia law to all common law claims because the plaintiffs “identif[ied] no
foreign statutes that govern their common law claims”);
, 215 F.R.D. 660, 679
(N.D. Ga. 2003) (applying Georgia law where “the parties have not directed the Court’s attention to statutes of foreign states”). 3 Because of the historical nature of Georgia’s unique exception, there is some confusion over whether it “applies to common law claims that arise in states, or only those where ‘the other state was one of, or formed from the territory of one of, the original 13 colonies that inherited the common law of England.” ,764 F. Supp. 3d 1233
, 1257–58 (N.D. Ga. 2024) (citing ,300 Ga. at 731
n.5). Following in ’s footsteps,
the Court applies the exception to all states in the present litigation. at
1258 (applying the exception to all state subclasses because the Georgia
Supreme Court had applied the exception to Florida on at least one occasion).
13
C. Negligence (Counts I, III)
To survive a motion to dismiss their negligence claim, the Plaintiffs
must allege a legal duty, a breach of that duty, causation, and damages.
, 289 Ga. 565, 566
(2011) (citing
, 278 Ga. 747, 751
(2004)). The Defendants dispute three of these elements, with both Defendants challenging causation, Blue Shield challenging duty, and Young Consulting challenging damages. The Court denies the Defendants’ Motion to Dismiss as to the negligence claims (Counts I, III) for the reasons set forth below. 1. Young Consulting (Count I) Young Consulting takes the following positions. As to causation, Young Consulting argues that the Plaintiffs’ “conclusory and unsupported” allegations about its actions establish no more than the “mere possibility” that Young Consulting caused the data breach. (Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 18–19.) As to damages, Young Consulting argues that no Plaintiff suffered “actual identity theft” nor verified whether his or her data was posted on the dark web. ( at 19.) According to Young The Georgia Supreme Court and Eleventh Circuit have declined to expressly address this question. ,300 Ga. at 731
n.5 (declining to address the
question after finding it sufficient that “Alabama was formed predominantly
from the territory of Georgia”); , 823 Fed. App’x at 823 n.3
(declining to address the question as the argument was raised for the first time
in reply).
14
Consulting, only Plaintiffs Desley-Bloom, Murillo, and Wasserman allege that
their data be on the dark web, but none allege where it was posted, when,
or by whom. ( )
The Court holds that the Complaint plausibly pleads causation and
damages as to Young Consulting. The Plaintiffs allege that Young Consulting
“fail[ed] to use reasonable measures to protect Private Information and fail[ed]
to comply with applicable industry standards” designed to thwart “foreseeable
security threats such as ransomware attacks.” (CAC ¶ 217; ¶ 224
(alleging eight ways Young Consulting breached its duties to secure the
Plaintiffs’ sensitive data).) These allegations are sufficient at the pleading
stage to establish causation. Courts recognize that plaintiffs often cannot
explain a company’s particular securities practices without the benefit of
discovery, given that the information is often within the company’s exclusive
control. , 69 F.4th 1213
, 1220–21 (11th Cir. 2023); ,2025 WL 1643485
, at *3 (N.D. Ga. June 9, 2025); ,864 F. Supp. 2d 1302, 1311
(S.D. Fla. 2011) (quoting ,604 F.3d 110, 120
(2d Cir. 2010)) (“Pleading on information [and] belief is still permissible where
. . . the facts are ‘peculiarly within the possession and control of the
defendant.’”).
15
As to damages, the Plaintiffs’ allegations satisfy the plausibility
standard. As a result of the data breach, the Plaintiffs allege that they have
suffered or will imminently suffer damages such as “out-of-pocket expenses
associated with the prevention, detection, and recovery from identity theft,
fraud, and/or unauthorized use of their Private Information”; “time, effort, and
expense associated with placing fraud alerts or freezes on credit reports”;
“anxiety, emotional distress, [and] loss of privacy”; “the present value of
ongoing credit monitoring and identity defense services”; and “the loss of the
benefit of the bargain for the failure of Defendant Young Consulting to securely
store and maintain their Private Information.” (CAC ¶ 228.) The Complaint
alleges that the ransomware group that targeted Young Consulting uploaded
the Plaintiffs’ PII and PHI to the dark web and thus exposed the Plaintiffs to
these harms. ( ¶ 52.) Contrary to Young Consulting’s position, the
Complaint need not plead more, such as alleging that each individual Plaintiff
verified that his or data was uploaded, the specific domain to which it was
uploaded, or the specific date of publishing. As discussed above, the fact that
three of the Plaintiffs received dark web alerts makes it more plausible (not
less likely) that other Plaintiffs’ data was uploaded to the dark web and
exposed the Plaintiffs to these harms.
16
2. Blue Shield (Count III)
Blue Shield argues it owed the Plaintiffs no duty to safeguard their data
because it had no special relationship to the Plaintiffs requiring such and could
not otherwise foresee the risk of a cyberattack on Young Consulting. (Br. in
Supp. of Def. Blue Shield’s Mot. to Dismiss, at 9–11.) It additionally argues
that the Complaint lacks “concrete allegations” on how the company caused
the Plaintiffs’ injuries, ( at 7), and points out that Blue Shield cannot be the
proximate cause of those injuries because it neither launched nor suffered the
cyberattack, ( at 8).
a. Duty
The Court begins with the law on duty. In Georgia, one does not owe “a
general legal duty to all the world not to subject others to an unreasonable risk
of harm.” , 313 Ga. 533, 544
(2022) (citations omitted). This is because one has “no duty to rescue another from a situation of peril which the former has not caused.” ,302 Ga. App. 260, 263
(2010) (quoting ,270 Ga. 770, 773
(1999)). In other words, one has no “duty to control the conduct of a potential tortfeasor[ ] so as to prevent that person from harming a third person.” ,263 Ga. 26
, 28 n.3 (1993) (quoting
, 185 Ga. App. 798, 801
(1988)),
, 317 Ga. 703
(2023). But a duty of care may arise
17
where “(a) a special relation exists between the actor and the third person
which imposes a duty upon the actor to control the tortfeasor’s conduct, or (b) a
special relation exists between the actor and the tortfeasor which gives to the
third person a right to protection.” (quoting , 185 Ga. App. at 801
);
, 356 Ga. App. 706
, 710 (2020) (quoting
, 263 Ga. App. 139, 142
(2003)). Georgia courts have recognized special relationships between landlords and tenants, employers and employees, common carriers and passengers, doctors and patients, and more. ,69 F.4th at 1219
. The duty, however, is “generally limited to reasonably foreseeable risks of harm.” ,313 Ga. at 537
n.3;
, 300 Ga. 327, 330
(2016) (explaining that “public policy”
considerations may further curb the “bounds of duty,” even if the risk of harm
is foreseeable).
Courts in this circuit have applied these principles in the data breach
context. In , the Eleventh Circuit held that the defendant had a duty
to protect its employees’ PII from a cyberattack due to the special relationship
between employers and their employees and the reasonably foreseeable risk of
a cyberattack under the circumstances. , 69 F.4th at 1220–21. Relying
on , both the Georgia Court of Appeals and this Court have similarly
held that a defendant healthcare company owed a duty to its employees to
protect their PII from the reasonably foreseeable risk of a cyberattack.
18
, 377 Ga. App. 177
, 181 (2025); ,2025 WL 1643485
, at *3–4 (finding that ll,305 Ga. 812
(2019), was not so broad as to “altogether reject the existence of a
duty to safeguard personal information”). Another court in this district found
that the reasonably foreseeable risk of a cyberattack was sufficient to impose
a duty on the defendant to protect the plaintiffs’ PII.
, 563 F. Supp. 3d 1360
, 1366–71 (N.D. Ga. 2021). The court
there did not mention the phrase “special relationship,” at 1371 n.4, but it
noted “common sense” dictates that, “when patients and employees are
required to turn over PII and PHI as a condition of medical care and
employment, the entity receiving that information has some baseline
obligation to adopt reasonable precautions to guard against known or
reasonably foreseeable threats to the security of that information,” at 1370.
Here, the Court concludes that Blue Shield owed a duty to the Plaintiffs
to protect their PII and PHI from the reasonably foreseeably risk of a
cyberattack. First, a special relationship between health insurance providers
and their members exists and supports the existence of a duty to safeguard
members’ data. Several factors are relevant. The Plaintiffs are or were
customers (or “members”) of Blue Shield, (CAC ¶¶ 6–12), who were required to
provide their PII and PHI as a condition of receiving healthcare services, (
¶¶ 21–22). They are also wholly dependent on Blue Shield’s decisions
19
regarding where and how to protect the data, including the company’s choice
of vendor for maintaining the data. ( ¶¶ 252.) This dependent relationship
means that Blue Shield controls the risk of a cyberattack, as it controls the
“virtual premises” subject to a third-party’s attack.
, 2019 WL 13041330
, at *5 (M.D. Fla. Oct. 1, 2019) (applying analogous
Florida law). Moreover, the type of information shared is highly sensitive
rather than ordinary, including not only PII that a government agency or
employer might collect but also PHI that a doctor might collect.
Second, the alleged cyberattack was a reasonably foreseeable risk.
According to the Complaint, “[t]he healthcare industry has become a primary
target for cybercriminals due to a combination of high-value data and outdated
infrastructure,” (CAC ¶ 65), prompting federal agencies to issue repeated
warnings to healthcare entities about the threat, ( ¶ 63, 70). The
Complaint pleads a slew of additional statistics regarding the high number of
data breaches in the healthcare industry, further putting healthcare entities
like Blue Shield and Young Consulting on notice. ( ¶¶ 66–67.) This Court
follows others that have found these kinds of (or lesser) allegations sufficient
to plausibly plead a reasonably foreseeable risk of harm. , , 563
F. Supp. 3d at 1369; , 377 Ga. App. at 181–82; , 69 F.4th at 1220–
21 (inferring that “a company of [the defendant’s] size and sophistication—
especially one maintaining such an extensive database of prior employees’
20
PII—could have foreseen being the target of a cyberattack,” even without
allegations as to how “well-known” or “common” the cyberattacks were in the
defendant’s industry). Together, the special relationship and foreseeable risk
of harm give rise to a legal duty.
b. Causation
Having found the existence of a duty, the Court next considers the
Defendants’ proximate cause arguments. The Court finds in favor of the
Plaintiffs as to proximate cause. Georgia law provides that a defendant is liable
for “[a]l of the natural and probable consequences” of its negligent conduct,
“unless there is a sufficient and independent intervening cause.”
, 932 S.E.2d 74
, 104 (2026). But the intervening cause rule “does not
insulate the defendant ‘if the defendant had reasonable grounds for
apprehending that such wrongful act would be committed.’”
, 300 Ga. 840, 841
(2017) (quoting
, 275 Ga. 683, 686
(2002)). As discussed above, the Plaintiffs
plausibly allege that Blue Shield should have anticipated a cyberattack on it
and/or its vendors, as discussed above. ( CAC ¶¶ 63–70.) For this reason,
Blue Shield cannot escape liability by merely pointing to the “intervening”
actions of other actors or by claiming that the Plaintiffs’ allegations lack
sufficient specificity.
21
D. Negligence per Se (Counts II, IV)
In Georgia, negligence per se arises when a statute establishes a legal
duty and a defendant breaches that legal duty. , 349 Ga. App. 381
, 385 (2019) (citing ,251 Ga. App. 699, 702
(2001)); O.C.G.A. § 51-1-6. A plaintiff satisfies these elements if he or she can show “a statute is violated, the person injured by the violation is within the class of persons the statute was intended to protect, and the harm complained of was the harm the statute was intended to guard against.” ,300 Ga. 840, 845
(2017) (quoting ,282 Ga. 197, 200
(2007)). A plaintiff may maintain
a negligence per se action for violations of both statutes and regulations.
, 251 Ga. App. at 702
. The Plaintiffs assert a negligence per se claim against Young Consulting (Count II) and Blue Shield (Count IV) based on violations of the Health Insurance Portability and Accountability Act (“HIPAA”) and the Federal Trade Commission Act (“FTCA”). Specifically, they claim that the Defendants violated (1) HIPAA regulations, pursuant to 42 U.S.C. § 1320d , regarding the protection of PHI, (CAC ¶ 240, 290), and (2) Section 5 of the FTCA,15 U.S.C. § 45
, regarding the protection of confidential consumer
information, ( ¶¶ 232, 282).
22
The Defendants argue that neither HIPAA nor the FTCA can support
the negligence per se claim. As to HIPAA, the Defendants argue that the
statute does not create a private right of action to enforce its regulations and
thus cannot support a negligence per se claim. (Br. in Supp. of Def. Blue
Shield’s Mot. to Dismiss, at 11; Br. in Supp. of Def. Young Consulting’s Mot. to
Dismiss, at 20.) As to the FTCA, the Defendants take different approaches.
Blue Shield asserts that no private right of action exists here either and further
claims that the Plaintiffs are “not within the class of persons the FTCA was
designed to protect” because they are “employees whose employers obtained
certain insurance coverage from Blue Shield” and not Blue Shield’s
“consumers.” (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 12.) Young
Consulting concedes that courts in this district have allowed negligence per se
actions to proceed under Section 5 of the FTCA but argues that the Plaintiffs’
allegations nonetheless fail to allege sufficient facts to establish a statutory
violation.4 (Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 20.)
The Court rejects each of these arguments for the reasons set forth below and
denies the Defendants’ Motions to Dismiss the negligence per se claim.
4 Young Consulting also seeks dismissal of this claim because the
Plaintiffs “fail[ed] to allege a concrete injury.” (Br. in Supp. of Def. Young
Consulting’s Mot. to Dismiss, at 21.) But the Court rejects this argument for
the same reasons discussed previously.
23
1. Intended Protections
The Court first dispenses with the Defendants’ arguments that the
Plaintiffs are not “consumers” under the FTCA and thus not within the class
of persons the FTCA intends to protect. In relevant part, the FTCA protects
“consumers” from “unfair . . . practices in or affecting commerce.” 15 U.S.C. § 45
(a)(1); ,405 U.S. 233, 244
(1972)
(“Congress, through [section] 5, charged the FTC with protecting consumers as
well as competitors.”). The FTCA does not define “consumer,” but the Court is
satisfied that the Plaintiffs qualify as such because they paid for Blue Shield’s
health insurance services and became Blue Shield’s health insurance
members. (CAC ¶¶ 124, 132, 140, 148, 156, 165, 174.)
The Court is not persuaded that the Plaintiffs are stripped of their
consumer status because they paid their insurance premiums through an
employer-sponsored plan rather than directly to Blue Shield. Blue Shield’s case
law is inapposite; courts dismissed the negligence per se claims in those cases
because the plaintiffs were employees who did not purchase any goods or
services—whether directly or indirectly—from the defendants.
, 2025 WL 552676
, at *5 (N.D. Ga. Feb. 19, 2025);
, 2025 WL 1643485
, at *5.
24
2. Private Right of Action
The Court rejects the Defendants’ private right of action arguments. A
statute can support a negligence per se claim, even if the statute lacks a private
right of action. , 293 Ga. 162
, 164 (2013).
The relevant question is whether the statute supporting the negligence per se
claim can supply “a legal duty with some ascertainable standard of conduct,”
not necessarily whether the statute has a private right of action. at 163–64.
Georgia courts have stated as much multiple times. For example, the Georgia
Court of Appeals has unequivocally stated:
O.C.G.A. § 51-1-6 authorizes a plaintiff to recover damages for the
breach of a legal duty even when that duty arises from a statute
that does not provide a private cause of action. O.C.G.A. § 51-1-6
does not create a legal duty but defines a tort and authorizes
damages when a legal duty is breached.
, 322 Ga. App. 699, 705
(2013) (quoting
, 314 Ga. App. 257, 259
(2012),
, 293 Ga. 162
(2013)). ’s reasoning can be traced back to ,206 Ga. App. 876
(1992). The court found that a criminal statute, which naturally lacked
a private cause of action, supplied the standard of care and imposed a duty on
a police officer sufficient to state a negligence per se claim. at 879–81. Other
courts in Georgia have upheld negligence per se claims under similar
25
reasoning.5 Prior to its decision, the Georgia Supreme Court had also
previously suggested that a plaintiff could pursue tort liability under Georgia’s
negligence per se statute, O.C.G.A. § 51-1-6, despite the lack of a private right
of action. , 287 Ga. 448, 460
(2010)
(relying in part on O.C.G.A. § 9-2-8(b), which states that the requirement that
private rights of action be made explicit will not “prevent the breach of any
duty imposed by law from being used as the basis for a cause of action under
any theory of recovery otherwise recognized by law, including . . . theories of
recovery . . . for breach of legal or private duties as set forth in [O.C.G.A.
§ 51-1-6]”).
The Court is aware that a number of Georgia courts have enforced a
categorical rule that a negligence per se claim cannot proceed if the violation
is premised on a statute without a private right of action. ,
, 334 Ga. App. 826
, 833–34 (2015) (affirming the dismissal of a negligence per se claim because “’[n]one of the statutes . . . provides a private cause of action for damages arising from any 5 , ,199 Ga. App. 138, 141
(1991) (quoting ,195 Ga. App. 449, 450
(1990)) (regarding Occupational Safety and Hazard Act regulations);
, 328 Ga. App. 775, 789
(2014) (allowing a
negligence per se claim based on violations of FTC regulations to proceed),
, 333 Ga. App. 897
(2015);
, 2018 WL 3018901
, at *3 (N.D. Ga. June 18, 2018) (rejecting
the defendant’s argument that the negligence per se claim must be dismissed
because the underlying statute lacks a private right of action).
26
violation of the respective statute”);
, 580 F. Supp. 3d 1314
, 1346 (N.D. Ga. 2021) (dismissing a negligence per se claim “[b]ecause there is no private cause of action under O.C.G.A. § 19-7-5”).6 The bulk of these cases rely on ,272 Ga. 279
(2000), and ,271 Ga. App. 36
(2004). But, in the Court’s opinion, and do not stand for the categorical rule that a negligence per se claim fails when it is premised on a statute without a private right of action. In , the Georgia Supreme Court held that a negligence per se claim was not cognizable based on the violation of a certain age discrimination statute. , 272 Ga. at 279–80. It reasoned that a plaintiff could not use Georgia’s negligence per se provision, O.C.G.A. § 51-1-6, to circumvent both Georgia’s statutory bar on tort actions against 6 , ,2014 WL 12489755
, at *3 (N.D.
Ga. Dec. 31, 2014) (“[V]iolations of civil statutes do not give rise to negligence
claims when the statutes do not provide a private cause of action.” (citing
, 271 Ga. App. 36
, 41–42 & 42 n.17));
, 2017 WL 11151639
, at *6–7 (N.D. Ga. July 14, 2017); ,2016 WL 11544774
(N.D. Ga. June 10, 2016), ,2016 WL 11544908
, at *28 (N.D. Ga. Aug. 30, 2016); ,2011 WL 10944693
,
at *6 (N.D. Ga. Oct. 6, 2011) (rejecting a negligence claim where the statute in
question did not provide a private cause of action and thus no “civil remedy”);
, 2015 WL 13271597
, at *9 (N.D. Ga. Apr. 30, 2015),
, 2015 WL 13357899
, at *1 (N.D. Ga. May 29, 2015);
, 2023 WL 5658976
, at *7 (S.D. Ga. Aug. 31, 2023) (dismissing
a negligence per se claim based on HIPAA because the statute does not provide
a private right of action and thus cannot “provide for a civil remedy” (citation
omitted)).
27
employers for wrongful termination and the age discrimination statute’s lack
of a private right of action. at 280. In , the Georgia Court of Appeals
relied on to uphold the dismissal of a negligence per se claim where the
claim was premised on a statute without a private right of action. does
not provide much other citation7 or analysis in justifying this holding, nor does
it reckon with the significance that placed on Georgia’s specific and
long-standing prohibition on torts for wrongful termination. With this context,
the Court is not persuaded that either or go so far as to require
dismissal of a negligence per se claim if the supporting statute lacks a private
right of action, as the Defendants presume. , 563 F. Supp. 3d at 1374
(interpreting narrowly).
3. FTCA Duty & Violation8
As to Young Consulting’s arguments that the Complaint fails to include
7 The court cited other cases, but none establish a categorical rule
as to negligence per se claims and private causes of action.
, 243 Ga. App. 894, 895
(2000) (affirming the dismissal of a negligence per se claim in the employment-at-will context where the statute did not specify a civil remedy); ,237 Ga. App. 10
, 12– 13 (1999) (noting that a criminal statute does not automatically give rise to “a private cause of action in tort in favor of the victim,” and finding as much for the criminal statute in question); ,198 Ga. App. 49, 50
(1990) (same), ,295 Ga. 235
, 239 n.2
(2014).
8 Beyond Blue Shield’s assertion that HIPAA lacks a private right of
action, the Defendants do not appear to expressly challenge whether HIPAA
imposes a standard of conduct nor whether the Defendants violated any
corresponding duty. Out of an abundance of caution, the Court clarifies that
HIPAA imposes duties to “maintains reasonable and appropriate
28
sufficient facts alleging an FTCA violation, the Court disagrees. A number of
courts in this district have concluded that Section 5 of the FTCA “imposes a
legal duty to safeguard personally identifiable information in a business’s
custody.” , 371 F. Supp. 3d 1150, 1176
(N.D. Ga. 2019); , 563 F. Supp. 3d at 1374 (“Section 5 of the FTC Act . . . creates enforceable duties . . . relat[ing] to data breach cases based on the text of the statute and a body of precedent interpreting the statute and applying it . . . . [A] defendant’s inadequate cybersecurity measures fall within the plain meaning of Section 5’s prohibition on ‘unfair’ practices.” (citation omitted)); ,2023 WL 5167366
, at *9 (N.D. Ga. July 19, 2023) (“Georgia courts have recognized that violations of the FTC Act and rules enforcing the Act can support a negligence per se claim under [Georgia] state law.” (citing ,328 Ga. App. at 790
)); ,2024 WL 519722
, at *9 (N.D. Ga. Feb. 9, 2024). The Court has already explained that the Complaint plausibly pleads that the Defendants failed to employ reasonable and appropriate data security measures. Therefore, the Plaintiffs adequately plead an FTCA violation as a predicate to their negligence per se claim. administrative, technical, and physical safeguards” for “health information,” 42 U.S.C. § 1320d-2(d)(2), and to timely notify affected individuals about the breach of this information,45 C.F.R. §§ 164
.400–164.414. The Plaintiffs
plausibly plead a violation of these duties as to both Young Consulting and
Blue Shield. (CAC ¶¶ 240, 271.)
29
E. Unjust Enrichment (Count V)
In the alternative to their breach of implied contract claim (Count IX),
the Plaintiffs assert an unjust enrichment claim (Count V) against Blue Shield.
“Unjust enrichment applies when as a matter of fact there is no legal contract,
but when the party sought to be charged has been conferred a benefit by the
party contending an unjust enrichment which the benefitted party equitably
ought to return or compensate for.” , 285 Ga. 632, 635
(2009) (quoting ,265 Ga. 804, 806
(1995)). Such a claim is “premised upon the principle that a party cannot induce, accept, or encourage another to furnish or render something of value to such party and avoid payment for the value received.” ,338 Ga. App. 382
, 386–87 (2016) (quoting ,311 Ga. App. 822
, 827–28 (2011)). The “benefit” or “something of value” can refer to “any form of advantage.” ,311 Ga. App. at 828
(citation omitted). But, importantly, “the party conferring the . . . things of value must act with the expectation that the other will be responsible for the cost.” ,375 Ga. App. 567
, 575 (2025) (citation omitted).
The Plaintiffs allege they paid insurance premiums to Blue Shield to
procure health insurance services, (CAC ¶ 299), but with the belief that “Blue
Shield would use part of the monies paid . . . to fund proper and reasonable
30
data security practices,” ( ¶ 361).9 They allege that Blue Shield benefited
from this arrangement because it “retain[ed] money that it should have used
to provide reasonable and adequate data security,” “sold more services and
products than [it] otherwise would have,” and otherwise “profi[ted]” from
gathering the Plaintiffs’ data. ( ¶¶ 300, 304–06.)
Reasonable courts—applying substantially the same unjust enrichment
standard—disagree on whether allegations of this type survive a motion to
dismiss, but this Court is persuaded that they do. Here, the Plaintiffs allege
they paid Blue Shield on the expectation that the company would provide
health insurance services and data security, yet they did not receive the latter.
That is sufficient at the pleading stage to allege a “benefit” conferred that ought
to be equitably returned. , 2026 WL 2333808
, at *7 (M.D. Ga. Aug. 12, 2026) (declining to dismiss an unjust enrichment claim under Georgia law based on similar facts); ,693 F.3d at 1328
(applying Florida law); ,567 F. Supp. 3d 1130
,
1146 (C.D. Cal. 2021) (applying California law);
, 198 F. Supp. 3d 1183, 1201
(D. Or. 2016) (applying Oregon law); ,278 F. Supp. 3d 739
,
9 The Plaintiffs allege this fact under their breach of implied contract
claim (Count IX), but the Court will consider it in the context of this unjust
enrichment claim (Count V) in construing the Complaint in the light most
favorable to the Plaintiffs.
31
751 (S.D.N.Y. 2017) (applying New York law); , 455 F. Supp. 3d 749
, 766 (C.D. Ill. 2020) (dismissing an unjust enrichment claim
under Illinois law where the plaintiffs “ha[d] not alleged that any specific
portion of their payments went toward data protection”).10
Contrary to Blue Shield’s position on the conferral of benefits, (Br. in
Supp. of Def. Blue Shield’s Mot. to Dismiss, at 12–13), it makes no difference
that the Plaintiffs paid their insurance premiums through an
employer-sponsored plan as opposed to directly to the Blue Shield.
, 838 F. Supp. 2d 1340
, 1366 n.27
(N.D. Ga. 2012) (“[I]t is not necessary that the plaintiff allege a direct payment
by the plaintiff to the allegedly unjustly-enriched defendant.”);
, 2013 WL 12121864
, at *8 (S.D. Ga. Mar. 18, 2013) 10 ,2025 WL 552676
, at *8 (rejecting the “cost-savings benefit” theory of unjust enrichment); , 377 Ga. App. at 185 (affirming the dismissal of an unjust enrichment claim for failure to allege a benefit conferred, but where the plaintiffs merely alleged they “believed the defendant would keep their information safe” and were “denied . . . the ability to make an informed purchasing decision”); ,732 F. Supp. 3d 765
,
782 (S.D. Ohio 2024) (“[A] traditional exchange of payment for goods and
services is not a circumstance in which it is ‘unjust’ to allow the defendant to
retain the benefit. . . . Plaintiffs fail to plausibly allege that the banking fees
Plaintiffs paid ([(the alleged benefit conferred)] were in exchange for PII
protection.”);
, 2023 WL 8540911
, at *5 (D.N.J. May 5, 2023) (“Plaintiffs pay
Defendants for medical services received and entrust their Personal
Information incidental to those services. Allegations that Plaintiffs would not
have engaged Defendants for medical services do not plausibly suggest that
the Personal Information itself is part of Defendants’ business model.”).
32
(rejecting the argument that the benefit conferred must be “direct”).
F. Breach of Fiduciary Duty (Counts VI–VII)
To establish a claim for breach of fiduciary duty in Georgia, a plaintiff
must establish “(1) the existence of a fiduciary duty; (2) breach of that duty;
and (3) damage proximately caused by the breach.”
, 321 Ga. App. 584, 594
(2013) (citation omitted). “Fiduciary duties and obligations are owed by those in confidential relationships.” ,269 Ga. 604, 606
(1998). Georgia law defines a confidential relationship as one where (1) “one party . . . exercise[s] a controlling influence over the will, conduct, and interest of another” or (2) “from a similar relationship of mutual confidence, the law requires the utmost good faith.” ,325 Ga. App. 194, 201
(2013) (citing O.C.G.A. § 23-2-58). The confidential
relationship may arise from “law, contract, or the facts of a particular case.”
, 278 Ga. App. 117, 120
(2006); O.C.G.A. § 23-2-58
(regarding confidential relationships by nature, law, or contract). A fiduciary
“owes a duty of ‘utmost good faith’ and loyalty to the other party.”
, 361 Ga. App. 475
, 479 (2021) (quoting ,286 Ga. App. 774, 783
(2007)). This duty requires “act[ing] for the benefit of
another person on all matters within the scope of their relationship.”
, 376 Ga. App. 159
, 163–64 (2025) (quoting Black’s Law Dictionary
33
(12th ed. 2024)).
The Plaintiffs allege a fiduciary relationship between themselves and
both Young Consulting (Count VI) and Blue Shield (Count VII), based on the
exchange of PHI for health insurance and healthcare services. (CAC ¶¶ 319,
332.) Because providing PHI was a requirement for obtaining these services,
the Defendants supposedly “exercised a controlling influence over Plaintiffs
and Class Members as it related to the security of their Private Information.”
( ¶¶ 320, 333.) According to the Complaint, this relationship gave rise to a
fiduciary duty to safeguard the data and exercise oversight over vendors
handling the data, timely notify individuals affected by a data breach, and
maintain “complete and accurate records regarding the storage, usage of, and
access to the Private Information.” ( ¶¶ 323, 337.) The Defendants allegedly
breached this duty and injured the Plaintiffs as a result. ( ¶¶ 326, 340.)
The Defendants challenge only the existence of a fiduciary duty, arguing
that the Complaint does not allege a confidential relationship involving a
“controlling influence.” (Br. in Supp. of Def. Young Consulting’s Mot. to
Dismiss, at 21–22; Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 13.)
Blue Shield claims that “Georgia courts do not recognize fiduciary duties by
healthcare providers outside the physician-patient relationship and limit such
duties strictly to matters of care.” (Br. in Supp. of Def. Blue Shield’s Mot. to
Dismiss, at 13 (citing ., 279 Ga. App. 586
,
34
592 (2006)).)
The Court first reviews the case law on relationships that do and do not
give rise to fiduciary duties. As an initial matter, fiduciary duties do not
typically arise when individuals disclose sensitive information in standard
arms-length consumer transactions. ,
272 Ga. App. 703, 705
(2005) (“[A]n arm’s-length relationship by its nature excludes a confidential relationship.” (citation omitted)). In the insurance context, Georgia courts have held that no fiduciary duty ordinarily exists between the insurer and insured. ,321 Ga. App. 496, 501
(2013) (citations omitted). By contrast, physicians typically owe fiduciary duties, including confidentiality and the utmost good faith, to their patients when providing medical care. ,279 Ga. App. at 593
n.14 (citing ,260 Ga. App. 723, 726
(2003)). In , another court in this district
considered whether the exchange of PHI in a healthcare provider–patient
relationship was more like the exchange of information in a nonconfidential
arms-length-transaction relationship or the exchange of information in a
confidential physician-patient relationship. , 563 F. Supp. 3d at 1383.
The court reasoned that the alleged healthcare provider–patient relationship
“was different from standard consumer transactions insofar as it necessarily
entailed the patient-[p]laintiffs sharing and disclosing private health
information with [the] [d]efendant that was akin to the health information that
35
would be communicated to a physician when receiving medical care.”
Nevertheless, in this case, the breach of fiduciary claims against Blue
Shield and Young Consulting both fail as a matter of law. While it may be true
that certain health information collected by Blue Shield (and Young
Consulting) may be of the same or similar kind as those collected by a doctor
treating a patient, the Court is not persuaded that the relationship between
doctors and patients in providing medical care is akin to that between health
insurance providers (and their vendors) and their insured members in
providing insurance coverage.
, 2025 WL 2179475
, at *22 (D. Mass. July 31, 2025) (finding that a
medical provider’s fiduciary duty to safeguard patients’ information “presents
wholly different questions from whether and under what circumstances an
insurer ‘owes an obligation to consider the interests of its insured above its
own’ so as to support the existence of a fiduciary relationship”);
, 2025 WL 2754760
, at *11 (N.D. Ill. Sept. 27, 2025) (rejecting the plaintiffs’ attempt to “use the fiduciary duty a treating physician owes their patients to bootstrap into Illinois law” a new fiduciary duty owed by healthcare facilities). ,742 F. Supp. 3d 1304
, 1318 (N.D. Ga. 2024) (declining to dismiss a breach of
fiduciary duty claim given that there was a factual question as to information
involved in the data breach and that “in some circumstances, the retention of
36
private information that patients provided while seeking medical care can
create a fiduciary duty under Georgia law”).
To find otherwise would go too far, in the Court’s view. It would impose
a fiduciary duty on virtually any company dealing with health information,
which could be easily characterized as that which a treating physician collects.
While the Court has stated that the relationship between Blue Shield and its
members is a special one requiring a duty of ordinary care to safeguard
members’ PII and PHI, the Court is not convinced it is one requiring a fiduciary
duty. “Fiduciaries are held to the highest standard of the law” and must “act
for the benefit” of the other “on all matters within the scope of their
relationship.” , 319 Ga. App. 354
, 364 n.19 (2012) (citation omitted). The relationship between Blue Shield and its members is not so unequal that Blue Shield possesses a “controlling influence over the will, conduct, and interest” of the Plaintiffs. The Plaintiffs entered into an arms-length transaction with Blue Shield, which is ordinarily insufficient to establish a fiduciary duty. ,272 Ga. App. at 705
; ,
567 F. Supp. 3d at 1146 (applying California law);
, 2024 WL 5055556
, at *13 (S.D. Iowa June 26, 2024) (applying
Iowa law, and collecting cases). Georgia courts typically treat the relationship
between the insurer and insured as an arms-length transaction. , 321
Ga. App. at 501 (citation omitted). Here, the Plaintiffs do not allege a
37
relationship with Blue Shield that goes beyond the ordinary relationship
between a health insurance provider and its member.
, 777 F. Supp. 3d 913
, 942 (E.D. Wis. 2025). Therefore, Blue Shield owes no fiduciary duty to the Plaintiffs to safeguard their PII and PHI, and neither does Young Consulting as Blue Shield’s vendor. G. California Invasion of Privacy (Count VIII) California Plaintiffs Emily Desley-Bloom, Kevin Chinchilla Montero, and Alexandra Murillo allege an invasion of privacy claim under the California Constitution against Blue Shield. The California Constitutions protects individuals from invasions of their privacy. Cal. Const. art. I, § 1. To establish an invasion of privacy claim under the California Constitution, a plaintiff must show “(1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by [the] defendant constituting a serious invasion of privacy.” ,7 Cal. 4th 1, 66
(1994). Blue Shield challenges only the third element, arguing that “the
type of personal information impacted by the [data breach] does not qualify as
a ‘serious invasion’ of privacy.” (Br. in Supp. of Def. Blue Shield’s Mot. to
Dismiss, at 14.)
To qualify as a “serious invasion of privacy,” the invasion “must be
sufficiently serious in [its] nature, scope, and actual or potential impact” such
that it “constitute[s] an egregious breach of the social norms underlying the
38
privacy right.” , 7 Cal. 4th at 37
. California courts have dismissed invasion of privacy claims at the pleading stage even where the plaintiffs alleged the disclosure of highly sensitive information such as social security numbers and geolocation data. ,540 F. Supp. 2d 1121, 1128
(N.D. Cal. 2008), , 380 Fed. App’x 689 (9th Cir. 2010) (holding the theft of 800,00 job applicants’ “personal information, including . . . social security numbers,” did not amount to a serious invasion of privacy); ,844 F. Supp. 2d 1040, 1063
(N.D. Cal. 2012) (holding the disclosure of “unique device identifier number[s], personal data, and geolocation information” from certain Apple devices “does not constitute an egregious breach of social norms”); ,63 F. Supp. 3d 1159, 1169
(C.D. Cal. 2014) (“[A]n accidental disclosure (of the kind that is inevitable when human beings process large amounts of information) is not necessarily sufficient to sustain a claim under article I, § 1.”). But California courts treat medical records with special importance such that the disclosure of certain medical information may amount to a serious invasion of privacy. ,41 Cal. App. 5th 497
, 507 (Cal. Ct. App. 2019) (“It is well established that the right to privacy
extends to medical records, which may contain ‘matters of great sensitivity
going to the core of the concerns for the privacy of information about an
individual.’” (citations omitted)).
39
The Court denies Blue Shield’s Motion to Dismiss on the California
privacy claim, finding the nature, scope, and impact of the privacy invasion
“sufficiently serious.” Here, the nature of the privacy invasion can be fairly
characterized as serious. Blue Shield’s inadequate security practices allegedly
resulted in the disclosure of not only PII such as names, social security
numbers, dates of birth, and names, but also PHI such as medical diagnoses,
medical treatments, and medication and prescription data. (CAC ¶¶ 47, 54.)
California courts have found the disclosure of medical information such as
HIV-positive status, substance abuse treatment and prescription records, and
fertility treatment records to be of a serious nature. , , 63 F.
Supp. 3d at 1169–70 (HIV); , 65 Cal. App. 5th 621
, 645–46 (Cal. Ct. App. 2021) (substance abuse);
, 2024 WL 246178
, at *1–2, *6 (E.D. Cal. Jan. 23, 2024) (fertility). The
compromised data in this case plausibly includes highly sensitive medical
information of this sort, in addition to other personally identifiable
information. The scope of the privacy invasion is also large, given that the data
breach compromised the identities and medical information of more than one
million Blue Shield members across the country. (CAC ¶ 60.) Lastly, the Court
finds the impact of the invasion serious. All the records have allegedly been
made public by way of being posted on the internet, ( ¶ 52–54), and are ripe
for bad actors to sift through—whether to steal the identities of the affected
40
individuals, weaponize their medical information in some way, or take other
action. , 82 Cal. App. 4th 419, 429
(Cal. Ct.
App. 2000) (dismissing a California privacy claim where personnel records
were disclosed to an attorney). Considering the alleged nature, scope, and
impact of the privacy invasion, the Court therefore holds that the Complaint
plausibly pleads a serious invasion of privacy.
This holding is consistent with other courts who have found comparable
breaches of medical information to be serious invasions of privacy.
, 501 F. Supp. 3d 898
, 906, 926 (S.D. Cal. 2020)
(declining to dismiss a California privacy claim involving a “large data breach”
of “protected health information and personal information” such as “name,
address, date of birth, gender, and medical claim information including dates
of service, diagnosis codes, procedure codes and treating physician”); ,
567 F. Supp. 3d at 1138, 1143 (declining to dismiss a privacy claim involving
the allegedly data breach of the plaintiffs’ “names, dates of births, [ ] account
numbers, health insurance information, confidential medical information,
medical diagnoses, billing information including addresses, email addresses,
and telephone numbers, and Social Security numbers”).
H. Breach of Implied Contract (Count IX)
In Georgia, a contract exists between parties when there is
(1) consideration, (2) “the assent of the parties to the terms,” and (3) “a subject
41
matter upon which the contract can operate.” O.C.G.A. § 13-3-1. An
implied-in-fact contract is a type of contract where mutual “assent may be
implied from the circumstances and the conduct of the parties.”
, 325 Ga. App. 448, 452
(2013) (citations omitted);
, 154 Ga. App. 229
, 231–32 (1980) (“[T]he only
difference between an express contract and a contract implied in fact is that in
the former the parties arrive at their agreement by words, whether oral or
written, while in the latter their agreement is arrived at by a consideration of
their acts and conduct . . . .” (citation omitted)). Mutual assent, or the “meeting
of the minds,” occurs when “one party’s intention is deemed to be that meaning
a reasonable man in the position of the other contracting party would ascribe
to the first party’s manifestations of assent, or that meaning which the other
contracting party knew the first party ascribed to his manifestations of assent.”
, 250 Ga. 391, 395
(1982) (noting that the standard is objective). As the Georgia Supreme Court recently explained: “a court will honor [an] intention if the other party has reason to know it” or “actually knows it.” ,299 Ga. 443, 445
(2016)
(quoting E. Allan Farnsworth, Contracts § 3.7, at 122 (2d ed. 1990)). Assuming
the existence of a contract, a breach of implied contract claim survives a motion
to dismiss if a plaintiff can plausibly plead the traditional elements of a breach
of contract: duty, breach, causation, and damages.
42
The Plaintiffs assert this breach of implied contract claim against only
Defendant Blue Shield. They allege that, in providing their sensitive
information to Blue Shield “as a precondition for receiving health insurance,”
(CAC ¶ 354), they also entered into an implied contract with the company
whereby “Blue Shield agreed to safeguard and protect” their sensitive
information and “timely and accurately notify them if it was breached or
compromised,” ( ¶ 355). To support this implied contract, the Plaintiffs cite,
among other representations, Blue Shield’s “Notice of Privacy Practices.” (
¶ 357.) The privacy notice states: “we maintain physical technical and
administrative safeguards to ensure the privacy of your PHI,” and “[w]e are
required to maintain the privacy of your PHI and to notify you in the event
that you are affected by a breach of unsecured PHI.” ( ) A separate “HIPAA
Notice of Privacy Practices” document contains “the same or similar
representations,” plus other representations such as “[w]e will obey any and
all laws that require us to give you privacy protections, including HIPAA and
any other federal or California privacy law.” ( ¶ 358.)
Blue Shield disputes the existence of mutual assent and, if a contract
exists, any breach of such a contract. As to mutual assent, Blue Shield argues
that (1) conclusory statements about implied contracts and general references
to the company’s privacy policies are insufficient11 and that (2) the Plaintiffs
11 Blue Shield also points out that the Plaintiffs cite the company’s
43
do not allege “they read or relied upon” the company’s privacy representations.
(Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 15.) As to breach, Blue
Shield contends that the Complaint “fail[s] to identify any specific contract
term Blue Shield allegedly breached” and instead alleges “only vague failures
to implement security measures or oversee contractors.” ( at 16.)
Ultimately, the Court rejects Blue Shield’s arguments and denies
dismissal of the breach of implied contract claim. The Court first holds that the
Plaintiffs have plausibly pleaded mutual assent to an implied contract. A
reasonable person would understand Blue Shield’s representations—e.g.,
expressly stating that it would (or intended to) “maintain . . . safeguards to
ensure the privacy of your PHI”—as manifestations of assent, amounting to an
implied contract. , , 563 F. Supp. 3d at 1381–82 (denying
dismissal of a breach of implied contract claim where the plaintiffs alleged that
the defendant posted its privacy representations on its website and made the
statements “available to patients upon request”); , 667 F. Supp. 3d 1276
, 1286–87 (N.D. Ga. 2023) (denying dismissal where the
plaintiffs alleged an expectation that the defendant would implement
reasonable data security practices); , 136 F. Supp.
“codes of conduct” but that those codes of conduct do not even apply to the
Plaintiffs. (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 15.) The
Plaintiffs do not respond to this argument. The Court ignores the codes of
conduct for now, referring instead to Blue Shield’s privacy policy and other
privacy statements, which appear to expressly concern the Plaintiffs.
44
3d 654, 675 (E.D. Pa. 2015) (denying dismissal where the defendant implicitly
promised to safeguard the plaintiffs’ PII through “privacy policies, codes of
conduct, company security practices, and other conduct”).
Moreover, construed in the light most favorable to the Plaintiffs, the
Complaint plausibly alleges that the Plaintiffs relied on Blue Shield’s
representations. , 2026 WL 2333808
, at *4, 6–7 (inferring reliance
from allegations that the plaintiffs “understood” and “believed” the defendant
would “safeguard their PI” based on the defendant’s privacy policy);
, 2010 WL 11570892
, at *6 (N.D. Ga. Feb. 5, 2010)
(denying dismissal where the plaintiffs alleged that they would not have
provided their information to the defendant absent the defendant’s
representation that it would protect the information). The Plaintiffs allege that
they would not have entrusted their information to Blue Shield “in the absence
of the . . . implied terms between them and Blue Shield.” (CAC ¶ 362.)
Together, Blue Shield’s specific privacy representations and the
Plaintiffs’ apparent reliance on those representations are sufficient to
plausibly plead mutual assent. And, indeed, one Georgia appellate court
recently denied dismissal of a breach of implied contract claim in similar
circumstances, albeit applying Georgia procedure. , 377 Ga. App. at 184.
There, the court considered allegations that the plaintiffs “relied on the
defendant’s privacy notice, which included promises that the defendant would
45
implement reasonable and adequate data security safeguards and would not
disclose their private information to anyone, outside of certain, specific
circumstances.”
Having found the existence of an implied contract, the Court further
holds that the Plaintiffs plausibly plead the element of breach. The Plaintiffs
have alleged that Blue Shield failed to “implement adequate data security” and
“exercise sufficient oversight of the data security practices of its contractors,”
(CAC ¶ 364), including requiring the specific security measures listed in the
Complaint, ( , ¶ 71, 73, 81 ,83), and that it failed to timely notify the
Plaintiffs of a data breach, ( ¶ 364). This is sufficient to plausibly plead
breach of the promise to safeguard the privacy of the Plaintiffs’ data and notify
the Plaintiffs once PHI is compromised.
I. Breach of Third-Party Beneficiary Contract (Count X)
The Complaint alleges that Young Consulting qualifies as a “Business
Associate” under HIPAA “because it receives, maintains, and electronically
transmits PHI from health plans such as Blue Shield to assist in carrying out
healthcare-related functions.” ( ¶ 77.) As a Business Associate, Young
Consulting allegedly entered into a written contract (a “Business Associate
Agreement”) with Blue Shield in which Young Consulting “agreed . . . to
implement adequate security measures to safeguard the Private Information
of Plaintiffs and the Class and to timely and adequately notify them of the Data
46
Breach.” ( ¶ 371.) The Complaint alleges that Young Consulting breached
this contract, of which the Plaintiffs are third-party beneficiaries. ( ¶¶ 372–
74.)
Young Consulting argues that the Plaintiffs lack standing to assert their
breach of contract claims because the alleged contract does not contain “clear
and express language . . . demonstrating an intent to create third-party
beneficiary rights.” (Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss,
at 15.) Young Consulting takes issue with the Complaint’s failure to cite any
specific terms of the contract. ( at 24.) Young Consulting further argues that
parole evidence cannot be considered in determining the intent of the parties,
including statutes and regulations related to the contract. ( at 15–16.)
The Court declines to dismiss the Plaintiffs’ third-party beneficiary
contract claim on these grounds.12 The key question is “whether the parties’
intention to benefit the third party is shown on the face of the contract.”
, 262 Ga. App. 339, 344
(2003) (citing
, 160 Ga. App. 756, 758
(1981) (finding that a
12 The Court applies Georgia law for the choice-of-law reasons stated
above but notes that the parties dispute whether Georgia or California law
applies to this claim. Young Consulting asserts that the contract is governed
by Georgia law, though it does not state the basis for concluding such. (Reply
Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 6–7 [Doc. 57].) The
Plaintiffs “cannot necessarily agree that Georgia law governs,” given that the
contract and facts surrounding its drafting remain unavailable. (Pls.’ Joint
Resp. Br. in Opp’n to Defs.’ Mots. to Dismiss, at 17 n.5 (noting that the contract
may contain a choice-of-law provision).)
47
contract may establish third-party beneficiaries, even if a third-party
beneficiary is “not [ ] specifically named”). The Complaint alleges these exact
facts—that Young Consulting entered into a contract intended to “protect the
information of individual patients” and is “expressly for the benefit of Plaintiffs
and Class Members.” (CAC ¶ 373.) Thus, accepting these allegations as true,
the Court finds them sufficient to state a claim for relief. Without the benefit
of discovery, it is only natural that the Plaintiffs cannot yet refer to the specific
language in the contracts, which are in the hands of the Defendants and not
yet in the record. The Court declines to dismiss this claim merely on Young
Consulting’s bald assertions that the contracts lack the requisite language and
intent.
J. Declaratory and Injunctive Relief (Count XI)
The Plaintiffs seek declaratory and injunctive relief against Blue Shield
and Young Consulting. Specifically, they ask this Court to enter a judgment
declaring that the Defendants owe a duty to secure the Plaintiffs’ data and
notify them about it, “breached and continue to breach” this duty, and continue
to harm the Plaintiffs. (CAC ¶ 382.) They also ask the Court to enjoin the
Defendants, requiring them to “employ adequate security protocols.” (
¶ 383.)
The Defendants advance three primary grounds for dismissal: (1) the
claim is duplicative of the Plaintiffs’ other claims; (2) adequate legal remedies
48
bar declaratory relief; and (3) the allegations do not plausibly plead a threat of
future harm. (Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 26–
27; Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 17.)
Pursuant to its “unique and substantial discretion in deciding whether
to declare the rights of litigants,” , 515 U.S. 277, 286
(1995), the Court grants dismissal to the extent this claim seeks a declaration regarding the Defendants’ duties to safeguard and notify as well as their past breach of these duties. The Court denies dismissal as to all other relief requested therein, finding that the Plaintiffs plausibly plead the Defendants’ security practices remain inadequate and create a future risk of harm. (CAC ¶¶ 379–80, 384–85.) K. California Consumer Privacy Act (Count XII) The California Plaintiffs allege a violation of the California Consumer Privacy Act (“CCPA”) against both Defendants Young Consulting and Blue Shield. The CCPA creates a private right of action for “consumer[s] whose nonencrypted and nonredacted personal information . . . is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of [a] business’ violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information.”Cal. Civ. Code § 1798.150
(a)(1) (West 2024).
The Complaint seeks injunctive relief and the greater of statutory and actual
49
damages, pursuant to Cal. Civ. Code § 1798.150
(a)(1)(A)–(B) (West 2024). (CAC ¶¶ 404–05.) 1. Young Consulting Young Consulting moves to dismiss the CCPA claim on two primary grounds. First, the company contends that it is not a “business” subject to private civil suit under the CCPA but rather a “service provider” subject only to state administrative enforcement actions. (Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 28–31.) Second, it contends that the Complaint is devoid of specific factual allegations regarding the company’s failure to implement reasonable security measures. ( at 31.) The Court dismisses the CCPA claim against Young Consulting, finding that Young Consulting is not a “business” under the statute. The CCPA grants a private right of action to sue “business[es]” underCal. Civ. Code § 1798.150
(a)(1) (West 2024). Beyond this limited private right of action, the
California Privacy Protection Agency and California Attorney General enforce
violations committed by businesses, service providers, contractors, and similar
entities. §§ 1798.155(a), 1798.199.90(a) (West 2024). The statute defines a
“business” as a “corporation . . . that collects consumers’ personal information,
or on the behalf of which such information is collected and that alone, or jointly
with others, determines the purposes and means of the processing of
50
consumers’ personal information.”13 § 1798.140(d)(1) (West 2024).
The Plaintiffs attempt to fit a square peg into a round hole by
characterizing Young Consulting as a “business.” The Complaint alleges that
Young Consulting is “a software-as-a-service [ ] company” that provides
“software solutions for the marketing, underwriting and administering of
medical stop loss insurance” and “collects and processes sensitive data on
behalf of its clients, including Blue Shield of California.” (CAC ¶¶ 19, 2.) In
other words, Blue Shield collects PII and PHI from its health insurance
members and contracts with Young Consulting for its software services to
maintain and process that data on Blue Shield’s behalf. ( ¶¶ 21–22, 36.) As
mentioned above, a “business” in the CCPA context (1) collects personal
information and (2) “determines the purposes and means” of “processing” that
information. Cal. Civ. Code § 1798.140
(d)(1) (West 2024). As to the first prong, the CCPA broadly defines “collect[ing]” as including “gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means,” whether that information is received “actively or passively.” § 1798.140(f). It is clear that Young Consulting collected the Plaintiffs’ personal information because Young 13 The statute only applies to businesses that “do[ ] business” in California and satisfy certain revenue and consumer thresholds.Cal. Civ. Code § 1798.140
((d)(1)(A)–(C) (West 2024). Neither Young Consulting nor Blue
Shield dispute that they satisfy these requirements, so the Court does not
scrutinize this requirement further.
51
Consulting received and accessed the Plaintiffs’ personal information in
providing software services to Blue Shield. (CAC ¶ 36.)
But the Complaint fails to plausibly satisfy the second prong, that it
“determine[d] the purpose and means” for processing the Plaintiffs’ data. The
Complaint alleges that Young Consulting “determine[s] the purpose and
means for processing the data because it “use[s] consumers’ personal data to
provide services at customers’ requests,” ( ¶ 392), and “performs analytics
with consumer data to perform underwriting and block analysis” and “various
reporting functions,” ( ¶ 393). It further alleges that Young Consulting
“uses[s] consumers’ personal data to . . . develop, improve, and test Defendants’
services.” ( ¶ 392.) These allegations are all consistent with a company that
provides software services at the request of Blue Shield (Young Consulting’s
client) and does not plausibly allege something more—determining the
(and means) of the data processing.14
This conclusion makes sense given the CCPA’s definition of a “service
provider,” which would appear to better fit Young Consulting’s role. A “service
provider” is “a person that processes personal information on behalf of a
business and that receives from or on behalf of the business consumer’s
personal information for a business purpose pursuant to a written contract,”
14 , 742 F. Supp. 3d at 1327 (finding a health IT company’s
services qualify it as a “business”).
52
provided the contract requires certain confidentiality protections for the data.
Cal. Civ. Code § 1798.140
(ag)(1) (West 2024). Here, the Complaint alleges that
Young Consulting processes Blue Shield members’ personal information “on
behalf of” Blue Shield “for a business purpose” and was required by Blue Shield
to treat that information with a certain level of care and security. (CAC ¶¶ 19,
26–35.) While the Court does not affirmatively determine that Young
Consulting is a “service provider,” this context supports the Court’s holding.
Common sense dictates that a company that provides data processing services
“on behalf of a business” and “for a business purpose” ordinarily does not set
the purpose of the data processing—rather, that company’s client (like Blue
Shield) sets that purpose and hires a service provider to fulfill it. To hold that
the Plaintiffs’ allegations here are sufficient to allege a “business” would
collapse the definitions of businesses and service providers as virtually every
company that “processes personal data on behalf of a business” (a “service
provider”) could qualify as a company that collects personal data and
determines the purpose and means of processing it (a “business”).15 The Court
15 The Court is aware that some courts have suggested that a company
can both be a service provider and a business. ,
, 2021 WL 3568394
, at *6 (D.S.C. Aug. 12, 2021). But the Court reads the CCPA as providing that, while a company could function both as a business and a service provider in separate contexts, a company cannot simultaneously be both the business and the service provider in the context of the same services.Cal. Civ. Code § 1798.145
(i)(1) (“A
service provider or contractor shall [ ] not be liable under this title for the
obligations of a business for which it provides services as set forth in this title
53
is not persuaded that this outcome is consistent with the CCPA’s design.
2. Blue Shield
Blue Shield moves to dismiss the CCPA claim on two grounds. First, the
company claims that statutory damages are unavailable because the Plaintiffs
did not comply with the CCPA’s pre-suit notice requirement in a timely or
sufficient manner. (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 17–
18.) Second, Blue Shield moves to dismiss the CCPA claim to the extent it
alleges violations based on information protected by HIPAA or the California
Confidentiality of Medical Information Act (“CMIA”), as the CCPA exempts
information protected by those statutes. ( at 18–19.)
The Court dismisses the CCPA claim against Blue Shield (1) as to
statutory damages and (2) to the extent the claim relies on health and medical
information governed by HIPAA and the CMIA. The Court clarifies both. First,
the Court dismisses the CCPA claim to the extent it seeks statutory damages
(but not as to the actual damages or injunctive relief sought). A plaintiff can
seek actual damages under the CCPA without pre-suit notice but, in order to
seek statutory damages, he must provide notice and an opportunity to cure
thirty days prior to initiating an action. Cal. Civ. Code § 1798.150
(b) (West
2024). Here, Plaintiff Montero sent a CCPA notice letter to Blue Shield on July
provided that the service provider or contractor shall be liable for its own
violations of this title.”).
54
16, 2025, (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, Ex. 1 [Doc. 46]),16
and then filed this consolidated class action complaint seeking statutory
damages under the CCPA on July 21, 2025. This five-day notice-and-cure
period does not comply with the CCPA, so the Plaintiffs cannot recover
statutory damages. Contrary to the Plaintiffs position, merely amending the
Complaint would not restart the clock, as the statute requires notice “
against a business for statutory damages.” Cal. Civ. Code § 1798.150
(b) (West 2024) (emphasis added);
, 2022 WL 1811165
, at *6 (D. Ariz. June 2, 2022) (“If a notice . . . could be updated when an amended complaint is filed and satisfy the 30-day notice requirement, then having the pre-suit notice requirement would be pointless.”); ,2025 WL 213744
, at
*20 (D. Utah Jan. 16, 2025) (finding notice timely between the filing of the
initial and amended complaint because the plaintiff alleged a CCPA claim
initially only for actual damages and first sought statutory damages in the
amendment, which was filed after the thirty-day notice period). Having
determined that the notice was not timely, the Court need not reach Blue
Shield’s other arguments as to whether the contents of the notice were
16 A copy of the notice letter was presented to the Court as an
attachment to Blue Shield’s motion. The Court finds the CCPA notice letter is
central to the Plaintiffs’ claims, and no party disputes its authenticity.
, 107 F.4th at 1300
.
55
deficient. ( Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 18.)
Second, the Court dismisses the claim to the extent it relies on health
and medical information governed by HIPAA and the California
Confidentiality of Medical Information Act (but not as to other non-medical
PII). The CCPA expressly exempts any “[m]edical information governed by the
Confidentiality of Medical Information Act . . . or protected health information
that is collected by a covered entity or business associate governed by the
privacy, security, and breach notification rules . . . established pursuant to the
Health Insurance Portability and Accountability Act of 1996.” Cal. Civ. Code § 1798.145
(c)(1)(A) (West 2024). However, because the Complaint alleges the breach of non-medical PII such as names, social security numbers, dates of birth, and non-medical patient data, (CAC ¶¶ 21, 47, 394), this dismissal is not fatal to the CCPA claim. L. California Unfair Competition Law (Count XIII) The California Unfair Competition Law (“UCL”) prohibits “unfair competition,” which includes “any unlawful, unfair or fraudulent business act or practice.”Cal. Bus. & Prof. Code § 17200
(West 2024). Those three types of
acts or practices are independent sources of liability under the UCL.
, 567 F.3d 1120, 1127
(9th Cir. 2009) (citation omitted). The
California Plaintiffs17 allege violations of the unlawful and unfair prongs
17 In response to extraterritoriality concerns from Young Consulting,
56
against both Blue Shield and Young Consulting. (CAC ¶ 413; Pls.’ Joint Resp.
Br. in Opp’n to Defs.’ Mot. to Dismiss, at 42.) The Defendants advance a variety
of arguments, which the Court addresses in turn. Ultimately, the Court
dismisses the UCL claim as to Young Consulting but not as to Blue Shield, and
it dismisses the UCL claim to the extent it is premised on a violation of the
California Consumer Privacy Act.
1. UCL Standing
The UCL authorizes suit by persons who “ha[ve] suffered injury in fact
and ha[ve] lost money or property as a result of the unfair competition.” Cal. Bus. & Prof. Code § 17204
(West 2024). According to the Defendants, the
California Plaintiffs have failed to allege the loss of money or property and thus
have no statutory standing. (Br. in Supp. of Def. Young Consulting’s Mot. to
Dismiss, at 16–17; Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 20–
21.) The Plaintiffs respond by pointing to alleged damages such as future credit
monitoring and other anti-theft costs, loss of the benefit of the bargain (through
overpaying for Defendants’ services, which should have but did not include
“adequate data security”), the diminution of value of their PII/PHI, and loss of
privacy in their PII/PHI. (CAC ¶¶ 428, 424.) As evident by the parties’ briefs,
(Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 33), the Plaintiffs
clarify in briefing that the Complaint brings a UCL claim only on behalf of the
California Plaintiffs (Desley-Bloom, Montero, and Murillo). (Pls.’ Joint Resp.
Br. in Opp’n to Defs.’ Mots. to Dismiss, at 42.) The Court construes the UCL
claim accordingly.
57
courts differ on how they treat these various theories of injury. But California
courts generally appear to agree—and this Court is persuaded—that the loss
of the benefit of the bargain is an injury sufficient to establish lost money or
property under the UCL. ,
, 313 F. Supp. 3d 1113, 1131
(N.D. Cal. 2018);
, 66 F. Supp. 3d 1197, 1224
(N.D. Cal. 2014) (“Plaintiffs can establish UCL standing by alleging they paid more than they actually valued the product.” (citing ,51 Cal. 4th 310, 330
(2011))). The Court therefore finds that the California Plaintiffs satisfy the UCL’s standing requirements. 2. CCPA as a Predicate Violation Following argument from Young Consulting, the Plaintiffs concede that their UCL claim cannot be predicated on a violation of the California Consumer Privacy Act standing alone. (Pls.’ Joint Resp. Br. in Opp’n to Defs.’ Mots. to Dismiss, at 43 n.17.) The Court agrees the UCL claim must be dismissed to the extent it’s based on a CCPA violation.Cal. Civ. Code § 1798.150
(c) (West 2025) (“Nothing in this title shall be interpreted to serve as the basis for a private right of action under any other law.”); ,2021 WL 3191752
,
at *7 (N.D. Cal. July 28, 2021) (dismissing the UCL claim to the extent it is
based on a violation of the CCPA because the CCPA “on its face states that
consumers may not use [the statute] as a basis for a private right of action
58
under any statute” (citation omitted)).
3. Young Consulting
The reach of California’s UCL is limited by the “presumption against
exterritoriality,” meaning it will not apply to conduct occurring outside of
California. , 51 Cal. 4th 1191, 1207
(2011) (“[T]he presumption against extraterritoriality applies to the UCL in full force.”).18 The key inquiry is whether the “liability-creating conduct occurs outside of California.” ,889 F.3d 1075, 1079
(9th Cir. 2018).
The Court dismisses the UCL claim against Young Consulting on
extraterritoriality grounds. Young Consulting’s principal place of business is
Georgia, so it presumably implemented (or failed to implement) security
measures in Georgia, where its servers and all of the compromised data were
presumably located. The Plaintiffs argue that the UCL applies to Young
Consulting because “the conduct giving rise to the claims occurred at least in
part in California, where Blue Shield is headquartered and where key
decisions regarding vendor oversight, data transmission to Young Consulting,
and data-security practices were made.” (Pls.’ Joint Resp. Br. in Opp’n to Defs.
Mots. to Dismiss, at 42.) While these allegations suggest that Blue Shield may
have made poor data security decisions in California, they do not plausibly
18 Young Consulting does not argue that this presumption applies to the
other California statutory claims alleged against it, so the Court does not
consider whether it does.
59
plead that Young Consulting made security-related decisions in California,
failed to properly secure data in California, or otherwise engaged in
liability-creating conduct in California. Other courts have held the same on
similar facts. , , 631 F. Supp. 3d 573
, 596 (N.D. Ill. 2022) (dismissing the California UCL claim for failure to allege the defendants’ poor security measures “emanated from California,” as opposed to Illinois where the defendants’ internal servers were presumably located and attacked); ,2024 WL 2965642
, at *11 (W.D. Ky. June 12, 2024) (dismissing the UCL claim
because the defendant “is headquartered out of state and all relevant conduct
leading to the data breach, and, presumably, the data breach itself, is alleged
to have taken place in Kentucky”). The UCL claim is therefore dismissed
against Young Consulting, and the Court does not consider Young Consulting’s
alternative grounds for dismissal.
4. Blue Shield
Beyond the UCL arguments already addressed above, Blue Shield
advances two additional grounds for dismissal. First, it claims that the
Complaint fails to “plead specific facts” showing how the company violated the
UCL’s unlawful and unfair prongs. (Br. in Supp. of Def. Blue Shield’s Mot. to
Dismiss, at 19–20.) Second, the company seeks dismissal because the Plaintiffs
“have an adequate legal remedy . . . through their negligence and contract
60
claims” and thus cannot access the equitable remedies afforded by the UCL.
( at 21.)
These arguments are unavailing. The Complaint pleads sufficient facts
as to Blue Shield’s unlawful business practices. The unlawful prong “prohibits
anything that can properly be called a business practice and that at the same
time is forbidden by law.”
, 613 F. Supp. 3d 1284
, 1303 (S.D. Cal. 2020) (quoting ,66 F. Supp. 3d at 1225
). Allegations that a defendant violated “[a]lmost any law
may serve as a basis for a UCL claim,” so long as those allegations “identify
the particular section of the statute that was violated” and “describe[s] with
reasonable particularity the facts supporting the violation.” (quoting
, 2010 WL 2486353
, at *6 (N.D. Cal. June 16, 2010)). As stated elsewhere, the California Plaintiffs have independently alleged violations of several laws, including tort laws, the California Constitution, and California statutes. They do so with reference to specific statutory provisions and “reasonable particularity” as to Blue Shield. ( , CAC ¶¶ 37–38, 40, 43, 73, 251–56, 258–63, 271–73, 282, 290, 348, 446.) The Complaint also pleads sufficient facts as to Blue Shield’s unfair business practices. The unfair prong prohibits “unfair” business practices, which courts have identified by applying either a “balancing” test and “tethering” test. ,2025 WL 1140788
, at *10
61
(C.D. Cal. Feb. 28, 2025). The balancing test “weigh[s] the utility of the
defendant’s conduct against the gravity of the harm to the alleged victim.”
, 613 F. Supp. 3d at 1303 (citing , 691 F.3d 1152, 1169
(9th Cir. 2012)). The tethering test asks whether the defendant’s conduct “is ‘tethered’ to some legislatively declared policy.” ,2025 WL 1140788
, at 10. Several district courts weighing allegations similar to those in the present case—including false representations by the defendant of reasonable and appropriate data security measures and the large-scale breach of PII and PHI as a result of poor security and oversight—have declined to dismiss UCL claims under the balancing test at the pleading stage. , at 1304 ,2024 WL 4253198
, at *11 (D. Nev. Sept. 19, 2024). The Court follows suit and holds similarly. Blue Shield attempts to distinguish these cases because they concerned “breaches of [the defendants’] own systems,” (Reply Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 12 [Doc. 58]), but that is a distinction without a difference. The gravity of the harm is not lessened by the fact that Blue Shield’s negligent oversight of its vendor’s systems allegedly caused the data breach. ( , CAC ¶ 37–38, 43.) Applying the tethering test would not alter this conclusion; as evidenced by the other claims in this case, the California Constitution and “numerous California statutes . . . reflect California’s public policy of protecting consumer data.” ,2025 WL 1140788
, at *10.
62
Blue Shield’s remedies argument fares no better. The UCL authorizes
recovery in the form of restitution and injunctive relief.
, 903 F. Supp. 2d 942, 970
(S.D. Cal. 2012). Because these remedies are equitable in nature, a plaintiff generally must show the lack of an adequate remedy at law in order to establish this claim. ,971 F.3d 834, 844
(9th
Cir. 2020). However, at the pleading stage, the Plaintiffs may assert claims in
the alternative, including those involving remedies at law and equity.
, 668 F. Supp. 3d 881
, 894–97 (N.D. Cal. 2022) (allowing the
UCL claim to proceed in the alternative notwithstanding existing claims
involving remedies at law, and limiting ’s applicability because that
case occurred “on the eve of trial” rather than at the pleading stage). The only
case that Blue Shield cites in its favor is , but California district courts
have limited the applicability of that case at the pleading stage. ,
, 668 F. Supp. 3d at 896; , 651 F. Supp. 3d 1111
, 1129 (N.D. Cal. 2023) (“A number of district courts since
have concluded that it has minimal application at the pleading stage.”).
M. California Confidentiality of Medical Information Act (Count XIV)
The California Plaintiffs allege a violation of California’s Confidentiality
of Medical Information Act against Blue Shield and Young Consulting. The
CMIA imposes liability on “[a]ny provider of health care, health care service
63
plan, . . . or contractor who negligently creates, maintains, preserves, stores,
abandons, destroys, or disposes of medical information.” Cal. Civ. Code § 56.101
(West 2024); § 56.36 (West 2024) (providing for actual and statutory damages). It also prohibits any “provider of health care, health care service plan . . . or contractor” from “disclos[ing] medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization.” § 56.10(a) (West 2024). The Defendants seeks dismissal of both the section 56.101 and 56.10(a) claims. As to section 56.101, both Defendants argue that the Complaint fails to plausibly allege that “an unauthorized person” actually “viewed” the Plaintiffs’ medical information or that the alleged viewing resulted from the Defendants’ negligence. (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 23 (first citing ,227 Cal. App. 4th 1546, 1555
(Cal. Ct. App. 2014); and then citing ,220 Cal. App. 4th 549, 564
(Cal. Ct. App. 2013)); Br. in Supp. of Def. Young
Consulting’s Mot. to Dismiss, at 40–41.) As to section 56.10(a), Blue Shield
argues that it did not “disclose” the Plaintiffs’ medical information within the
meaning of the statute because it did not “affirmative[ly]” disclose the
information; rather, a third-party stole the information. ( at 21–22.)
64
The Court quickly disposes with the Plaintiffs’ CMIA claim under
section 56.10(a). The Plaintiffs concede that section 56.10(a) governs
affirmative disclosures, which are inapplicable to the Defendants. (Pls.’ Joint
Resp. Br. in Opp’n to Defs.’ Mots. to Dismiss, at 46 n.19.) The Court agrees; the
Plaintiffs’ data was allegedly stolen rather than affirmatively shared by the
Defendants. The section 56.10(a) claim is therefore dismissed.
As to the section 56.101 claim, the Court denies dismissal. The
California Supreme Court recently rejected the “actually viewed” criterion
espoused by the Defendants and set out by and .
, 19 Cal. 5th 705
, 720–21 (2026). It held that “the key
criterion” for a section 56.101 claim is “whether the [medical] information is
exposed to a significant risk of unauthorized access or use,” not whether the
information “is actually viewed by an unauthorized person.” at 721;
at 722 (“[A]n ‘actually viewed’ standard would pose difficult problems of
pleading and proof. Victims of data breaches are unlikely to know what an
unauthorized party has done with their data unless they suffer actual damages
. . .”). Here, the Plaintiffs allege that a ransomware group stole their medical
information and posted it on the dark web for over a year, with a “a directory
listing each stolen file by name.” (CAC ¶¶ 44–57.) They further point to Young
Consulting and Blue Shield’s notice letter, which stated that “an unauthorized
actor gained access to [Young Consulting’s] network . . . and downloaded copies
65
of certain files.” ( ¶ 46.) Given the wrongful download of the Plaintiffs’
medical information, the prolonged availability of the information on a public
internet platform, and the Court’s duty to construe the allegations in the light
most favorable to the Plaintiffs, the Court finds it plausible that the data
breach created a “significant risk of unauthorized access [to] or use [of]” the
Plaintiffs’ medical information. , 19 Cal. 5th at 723.
Other courts have made similar inferences, albeit before the California
Supreme Court opinion clarified the CMIA standard. , , 501 F.
Supp. 3d at 923–24 (“Given that Plaintiffs allege that Inmediata posted their
information on the internet, making it searchable, findable, viewable,
printable, copiable, and downloadable by anyone in the world with an internet
connection, it can be reasonably inferred that someone viewed it.” (citation
omitted)); , 2024 WL 3678984
, at *14
(E.D. Pa. Aug. 6, 2024) (inferring that the plaintiffs’ data “had been wrongfully
viewed or accessed” based on allegations that a ransomware group posted and
sold the data on the dark web and that the defendants’ notice letter stated that
the group “accessed” the files).
N. California Customer Records Act (Count XV)
The California Plaintiffs allege two violations of the California
Customer Records Act (“CCRA”) against Blue Shield, pursuant to
sections 1798.81.5(b) and 1798.82(a)(1) of the California Civil Code.
66
Section 1798.81.5(b) provides that “[a] business that owns, licenses, or
maintains personal information about a California resident shall implement
and maintain reasonable security procedures and practices appropriate to the
nature of the information, to protect the personal information from
unauthorized access, destruction, use, modification, or disclosure.” Cal. Civ. Code § 1798.81.5
(b) (West 2024). At the time of the breach, section 1798.82(a) provided that “[a] . . . business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California [ ] whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.” § 1798.82(a) (West 2024). That version of the CCRA generally required disclosure “in the most expedient time possible and without unreasonable delay.”19 (noting exceptions for law enforcement involvement). The CCRA creates a private right of action to any “customer” injured by a business’s failure to comply with the statute. § 1798.84(b) (West 2024). The statute defines a “customer” as “an individual who provides personal information to a business for the purpose of purchasing 19 This language was effective through December 31, 2025. The Court notes that the California legislature has since revised the language to require disclosure within thirty calendar days.Cal. Civ. Code § 1798.82
(a)(2)(A) (West
2026).
67
or leasing a product or obtaining a service from the business.” § 1798.80(c)
(West 2024). According to the Plaintiffs, they were Blue Shield customers who
were harmed by the company’s failure to “implement and maintain reasonable
security procedures,” (CAC ¶¶ 89, 92, 458), and provide timely and sufficient
notice of the breach, ( ¶465–66).
Blue Shield seeks dismissal on four grounds. First, the company argues
that the California Plaintiffs are not “customers” because “the Complaint
pleads (at most) a transactional relationship between Blue Shield and
nonparty employers/plan sponsors . . . , not that Plaintiffs went into the
marketplace to . . . obtain a service from Blue Shield.” (Br. in Supp. of Def. Blue
Shield’s Mot. to Dismiss, at 24.) Second, the company argues that the
Complaint fails to plead facts as to its supposed failure to “implement and
maintain reasonable security procedures” under section 1798.81.5(b). ( at
24.) Third, Blue Shield suggests that Young Consulting’s notice letter satisfied
its notice obligations and that the Complaint nonetheless fails to allege how
the notice was “untimely or inaccurate.” (Br. in Supp. of Def. Blue Shield’s Mot.
to Dismiss, at 24–25.) Fourth, the company contends that the “Plaintiffs also
fail to allege the required incremental harm resulting from any purported
delay.” ( at 25.)
Finding that each of these grounds fail, the Court denies Blue Shield’s
Motion to Dismiss this CCRA claim. As an initial matter, the Plaintiffs have
68
alleged that they are “customers” within the meaning of the CCRA. CCRA
customers include “individual[s] who provide[ ] personal information to a
business for the purpose of . . . obtaining a service from the business.” Cal. Civ. Code § 1798.80
(c) (West 2024). Here, the California Plaintiffs allege that they provided their personal information to Blue Shield to obtain its health insurance services. (CAC ¶¶ 124, 132, 156.) That the Plaintiffs obtained these insurance services via an employer-sponsored plan does not change this fact, contrary to Blue Shield’s position, (Reply Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 14–15). The Court is further unpersuaded by Blue Shield’s reliance on ,742 F. Supp. 3d 1304
(N.D. Ga.
2024) to argue that the Plaintiffs are not customers. (Br. in Supp. of Def. Blue
Shield’s Mot. to Dismiss, at 23–24.) is inapposite as to Blue Shield
since it did not concern a healthcare provider but rather an “information
technology company” that received the plaintiffs’ information in the course of
providing software services to healthcare providers. at 1313. In that case,
this Court held that the plaintiffs were not customers of the software company
because the plaintiffs “did not provide their private information to NextGen in
exchange for NextGen’s software” but rather provided their information to
their healthcare provider in exchange for its services. at 1321;
, 713 F. Supp. 3d 623
, 629 (N.D. Cal. 2024)
(dismissing a CCRA claim against a software company on similar grounds).
69
The Court easily dispenses with the remaining three arguments. The
Plaintiffs have adequately pleaded that Blue Shield failed to implement and
maintain reasonable oversight of its vendor’s security procedures. (CAC ¶¶ 37,
73.) As to delayed notice, the Court is satisfied with the Plaintiff’s allegations
of a four-month delay between discovery of the breach and notice, ( ¶ 3),
which plausibly speaks to unreasonable delay. , 567 F. Supp.
3d at 1150 (declining to dismiss a CCRA claim where the plaintiffs alleged a
three-month delay). Lastly, the Plaintiffs have plausibly pleaded incremental
harm in so far as they were prevented from taking timely protective measures
to avoid harm. (CAC ¶¶ 122, 467.)
IV. Conclusion
For the reasons set forth above, the Court GRANTS in part and DENIES
in part Defendant California Physicians’ Service’s d/b/a Blue Shield of
California Motion to Dismiss [Doc. 43] and GRANTS in part and DENIES in
part Defendant Young Consulting, LLC’s d/b/a Connexure Motion to Dismiss
[Doc. 45]. The Court GRANTS Defendant Blue Shield’s Motion to Dismiss
[Doc. 43] as to Count VII (breach of fiduciary duty), Count XI (declaratory and
injunctive relief) to the extent the Amended Complaint seeks a declaration
regarding the Defendants’ duties to safeguard and notify and their past breach
of these duties, Count XII (California Consumer Privacy Act), and Count XIV
(California Confidentiality of Medical Information Act) as to violations of
70
section 56.10(a). The Court GRANTS Defendant Young Consulting’s Motion to
Dismiss [Doc. 45] as to Count VI (breach of fiduciary duty), Count XI
(declaratory and injunctive relief) to the extent the Amended Complaint seeks
a declaration regarding the Defendants’ duties to safeguard and notify and
their past breach of these duties, Count XII (California Consumer Privacy Act),
Count XIII (California Unfair Competition Law), and Count XIV (California
Confidentiality of Medical Information Act) as to violations of section 56.10(a).
The Court DENIES the Motions as to all other relief requested therein.
SO ORDERED, this 15th day of September, 2026.
A termcen. Fehon
THOMAS W. THRASH, JR.
United States District Judge
71