In re Union Home Mortgage Corp. Data Breach Litig.

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF OHIO

EASTERN DIVISION

) Case No.: 1:25 CV 1874 )

IN RE UNION HOME MORTGAGE ) CORP. DATA BREACH LITIGATION ) JUDGE SOLOMON OLIVER, JR.

) ) ) ) ) ORDER

Currently pending before the court in the above-captioned case are Defendant Union Home

Mortgage Corp.’s (“Defendant”) Motion to Dismiss (ECF No. 15) and Motion for Leave to File

Supplemental Exhibit in Support of Motion to Dismiss (ECF No. 25). For the following reasons, the

court grants the Motion for Leave to File Supplemental Exhibit in Support of Motion to Dismiss and

grants in part and denies in part the Motion to Dismiss.

I. BACKGROUND

A. Factual Background

This case arises from a data breach to Defendant’s computer network and subsequent harms

alleged by Plaintiffs. On June 25, 2025, Defendant learned that a third party accessed its network.

(Consol. Class Action Compl. at PageID 115, ECF No. 12.) Defendant subsequently began to

investigate the data breach. (Id.) On August 26, 2025, Defendant determined that as early as May 27,

2025, the third party — a ransomware group known as Qilin — gained access to personally

identifiable information (“PII”) of Defendant’s customers and employees. (Id.; Mem. Supp. Def.’s

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 1 of 31. PageID #: <pageID>

Mot. Dismiss at PageID 216, ECF No. 15-1.) According to Defendant, it paid a ransom in exchange

for a guarantee that Qilin would delete the data it acquired and Qilin subsequently “provided logs

proving the deletion.” (Mot. Dismiss at PageID 216–17, ECF No. 15-1.)

Three days later, Defendant issued a public disclosure about the data breach and began

sending notice letters to impacted individuals. (Compl. at PageID 115, ECF No. 12.) Notice letters

sent to Plaintiffs warned that their Social Security numbers, dates of birth, passport numbers, driver’s

licenses, state identification numbers, and names were potentially compromised in the data breach.

(See id. at PageID 104–111.) Upon Plaintiffs’ information and belief, their email addresses and

phone numbers were also compromised, “given that this data is commonly included in the same files

that contain other PII.” (Id. at PageID 115.) These letters additionally offered temporary credit

monitoring at no charge. (See id. at PageID 116.)

At some time thereafter, Plaintiffs allege that they were subjected to conduct traceable to the

data breach of Defendant’s computer network: All have received an increase in spam calls and text

messages. (Id. at PageID 122–23, 125–26, 128, 130, 132–33, 135, 137–38, 140, 142, 144.) One has

specifically received calls and texts regarding medical appointments with unfamiliar doctors. (Id. at

PageID 126.) Another has received emails for medical equipment and bills for medical appointments

she did not attend. (Id. at PageID 130.) Yet another received so many spam calls (up to 50 in a day)

that he changed his phone number. (Id. at PageID 142.)

Further, nine Plaintiffs attest to having received notifications that their confidential

information was shared on the dark web following the data breach. (Id. at PageID 123, 125–28, 130,

133, 137–38, 140.) One has observed an unexplained decline in her credit score. (Id. at PageID 130.)

Two have been made aware of unauthorized withdrawal attempts from their bank accounts. (Id. at

PageID 135, 144.) Another has received an alert from his bank notifying him of a potential fraud

-2-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 2 of 31. PageID #: <pageID>

attempt. (Id. at PageID 140.) And another began seeing fraudulent charges on his bank card, which

he specifically alleges occurred only after the data breach. (Id. at PageID 142.)

Broadly, Plaintiffs allege that, “[a]s a result of Defendant’s inadequate digital security and

notice process, Plaintiffs’ and Class Members’ Private Information was exposed to criminals.” (Id.

at PageID 112.) Plaintiffs further allege that they and the Class Members “have suffered and will

continue to suffer injuries including: financial losses caused by misuse of their Private Information;

the loss or diminished value of their Private Information as a result of the Data Breach; lost time

associated with detecting and preventing identify theft; and theft of personal and financial

information.” (Id. at PageID 113.) In addition to these injuries, Plaintiffs allege violations of their

privacy and out-of-pocket costs attempting to prevent, detect, and recover from identity theft and

fraud. (Id. at PageID 146.) One out-of-pocket cost — credit and identity theft monitoring — can cost

$200 or more a year per affected individual and, according to Plaintiffs, “is a future cost that

Plaintiffs and Class Members would not need to bear but for Defendant’s failure to safeguard their

Private Information.” (Id. at PageID 158.) Plaintiffs further allege that several Class Members had

to pay late fees and declined payment fees that were imposed due to failed automatic payments tied

to compromised cards that were cancelled as a result of the data breach. (Id. at PageID 147.)

B. Procedural Background

On September 8, 2025, Plaintiff Jed Rudd filed the initial Class Action Complaint (ECF No.

1) against Defendant. On September 16, 2025, Plaintiff Rudd and Mr. Dominic Brown jointly filed

a Motion to Consolidate and Appoint Interim Class Counsel (ECF No. 3), which would consolidate

this action with a similar action filed by Mr. Brown in this district. (Id. at PageID 51.) On

September 30, 2025, Defendant consented to the Motion for Consolidation, declined to oppose the

Motion to Appoint Interim Class Counsel, and made a Motion to Stay its deadline to respond to the

-3-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 3 of 31. PageID #: <pageID>

Complaint pending resolution of Plaintiff Rudd’s two motions. (ECF No. 7.) On October 2, 2025,

the court granted each of Plaintiff Rudd and Defendant’s motions. (ECF No. 9.) The October 2 ruling

ordered that new cases arising out of the same subject matter be consolidated with this action and

further permitted the filing of a single consolidated complaint.

On November 3, 2025, Plaintiffs filed their Consolidated Class Action Complaint (ECF No.

12) against Defendant. The Complaint comprises of claims for negligence, breach of implied

contract, unjust enrichment, and declaratory judgment and injunctive relief, as well as violations of

the California Consumer Privacy Act and the North Carolina Deceptive and Unfair Trade Practices

Act. (Id. at PageID 103–04.)

On December 18, 2025, Defendant filed its Motion to Dismiss (ECF No. 15) pursuant to

Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6), with four exhibits attached. On January 20,

2026, Plaintiffs filed their Memorandum in Opposition to Defendant’s Motion to Dismiss (ECF No.

20), and on February 19, 2026, Defendant filed its Reply (ECF No. 21). On May 19, 2026, following

the issuance of Munger v. Matco Tools Corp., No. 5:23-cv-00337, 2026 WL 1223399 (N.D. Ohio

May 5, 2026), Plaintiffs filed their Notice of Supplemental Authority in Opposition to Defendant’s

Motion to Dismiss (ECF No. 23), to which Defendant filed its Response (ECF No. 24) on June 2,

2026. On August 7, 2026, Defendant filed its Motion for Leave to File Supplemental Exhibit in

Support of Motion to Dismiss (ECF No. 25), which if granted would permit Defendant to admit a

supplemental expert report providing updated findings on the events surrounding the data breach.

(Id. at PageID 439–40.) On August 19, 2026, Plaintiffs filed their Opposition (ECF No. 27) to this

motion, and on August 26, 2026, Defendant filed its Reply (ECF No. 28).

II. ANALYSIS

A. Motion for Leave to File Supplemental Exhibit

-4-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 4 of 31. PageID #: <pageID>

Defendant seeks leave to file a supplemental exhibit in support of its Motion to Dismiss.

(Mot. Leave File Suppl. Ex. Supp. Mot. Dismiss at PageID 439, ECF No. 25.) The supplemental

exhibit, an expert report, provides updated findings to offer further assurance that the data breach

did not result in the spread of Plaintiffs’ PII. (Def.’s Ex. 4: Supplemental Expert Report of Adam

Hart at PageID 445, ECF No. 25-1.) Plaintiffs oppose such filing at this time “because it will not

assist the Court in its analysis at this stage.” (Pls.’ Mem. Opp’n Def.’s Mot. Leave File Suppl.

Expert Report at PageID 450, ECF No. 27.) Plaintiffs contend that filing this expert report would

improperly “inject[] facts and expert testimony into the record that have not been previously

disclosed or tested through discovery,” which “is not what the pleading stage is for.” (Id.) Defendant

maintains that as it has raised a factual challenge to standing, “[t]he Court must consider [this]

evidence since it goes to the fundamental question of whether the Court has the authority to hear this

case.” (Reply Supp. Def.’s Mot. Leave File Suppl. Ex. Supp. Mot. Dismiss at PageID 454, ECF No.

28.)

When evaluating a factual attack on subject-matter jurisdiction, “a trial court has wide

discretion to allow affidavits, documents and even an evidentiary hearing to resolve disputed

jurisdictional facts.” Abbott v. United States, 78 F.4th 887, 903 (6th Cir. 2023) (quoting Ohio Nat’l

Life Ins. Co. v. United States, 922 F.2d 320, 325 (6th Cir. 1990)). In mounting such an attack, a

defendant is not barred from introducing evidence outside the pleadings. See Gaetano v. United

States, 994 F.3d 501, 505 (6th Cir. 2021) (citing, inter alia, Gentek Bldg. Prods., Inc. v.

Sherwin–Williams Co., 491 F.3d 320, 330 (6th Cir. 2007)).

The court agrees that, for the purpose of assessing Defendant’s factual attack on subject-

matter jurisdiction, it is empowered to consider evidence beyond the pleadings and it should look

to such evidence in making its determination. However, evidence not tested through discovery

-5-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 5 of 31. PageID #: <pageID>

should be closely scrutinized for both its contents and its veracity and is, at best, persuasive — not

authoritative — in resolving any factual dispute. Moreover, such evidence should not be considered

for the purpose of assessing Defendant’s facial attack on subject-matter jurisdiction or Defendant’s

12(b)(6) motion. Accordingly, the court grants Defendant’s Motion for Leave to File Supplemental

Exhibit in Support of Motion to Dismiss (ECF No. 25), and it considers the supplemental expert

report of Mr. Adam Hart in the context of Defendant’s factual attack on subject-matter jurisdiction.

B. Motion to Dismiss

Defendant’s Motion to Dismiss contends that Plaintiffs’ action must be dismissed for lack

of standing and, independently, for failure to state a claim. After discussing the relevant legal

standards, the court considers each challenge in turn.

1. Legal Standards

Pursuant to the Federal Rules of Civil Procedure, a district court must dismiss an action if

the court lacks jurisdiction, FED. R. CIV. P. 12(b)(1), or if the court finds that the action fails to state

a claim for which relief can be granted, FED. R. CIV. P. 12(b)(6).

A motion to dismiss for lack of jurisdiction succeeds if the plaintiff lacks standing: for a court

to have jurisdiction to hear an action, the action must be filed by a plaintiff with standing to sue. See

Spokeo, Inc. v. Robins, 578 U.S. 330, 337–38 (2016) (citing, inter alia, Raines v. Byrd, 521 U.S. 811,

818, 820 (1997)). The plaintiff bears the burden of establishing the elements required to satisfy

standing. Id. at 338. When a motion to dismiss attacks the face of a complaint, the plaintiff need only

show that the complaint “contain[s] non-conclusory facts which, if true, establish . . . the district

court[’s] jurisdiction.” Stout v. United States, 721 F. App’x 462, 465 (6th Cir. 2018) (second

alteration in original) (quoting Carrier Corp. v. Outokumpu Oyj, 673 F.3d 430, 440 (6th Cir. 2012)).

However, when a motion to dismiss attacks the factual basis for jurisdiction, the court has “broad

-6-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 6 of 31. PageID #: <pageID>

discretion over what evidence to consider and may look outside the pleadings.” Adkisson v. Jacobs

Eng’g Grp., Inc., 790 F.3d 641, 647 (6th Cir. 2015) (citing Cartwright v. Garner, 751 F.3d 752, 759

(6th Cir. 2014)).

When considering a factual challenge, the “intertwinement rule” precludes courts in certain

contexts “from making factual findings with respect to a jurisdictional issue when such a finding

would adversely affect the merits of the plaintiff’s case.” Carrier Corporation, 673 F.3d at 443–44

(citing Gentek, 491 F.3d at 331); see Arbaugh v. Y&H Corp., 546 U.S. 500, 514 (2006) (“[I]n some

instances, if subject-matter jurisdiction turns on contested facts, the trial judge may be authorized

to review the evidence and resolve the dispute on her own. If satisfaction of an essential element of

a claim for relief is at issue, however, the jury is the proper trier of contested facts.” (citations

omitted)). However, in Moore v. Lafayette Life Insurance Co., 458 F.3d 416 (6th Cir. 2006), the

Sixth Circuit contextualized the intertwinement rule as applicable only “where the same statute

provides both the basis of federal court subject matter jurisdiction and the cause of action.” Id. at

444. Subsequently, courts in the Sixth Circuit have interpreted the intertwinement rule not to apply

where the Class Action Fairness Act is the basis for the court’s jurisdiction. See, e.g., In re Flagstar

Dec. 2021 Data Sec. Incident Litig., No. 22-cv-11385, 2024 WL 5659583, at *8 (E.D. Mich. Sep.

30, 2024); Myslivecek v. FCA US LLC, No. 21-10346, 2022 WL 17904526, at *7 (E.D. Mich. Dec.

23, 2022). Because the Class Action Fairness Act provides the basis for the court’s jurisdiction here,

it concludes that the intertwinement rule is inapplicable.

A motion to dismiss for failure to state a claim is held to a higher bar. The defendant bears

the burden of showing that the plaintiff failed to state a plausible claim for relief. Taylor v. City of

Saginaw, 922 F.3d 328, 331–32 (6th Cir. 2019) (citing Directv, Inc. v. Treesh, 487 F.3d 471, 476

(6th Cir. 2007)). Moreover, the court must construe the complaint in the light most favorable to the

-7-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 7 of 31. PageID #: <pageID>

plaintiff and accept all factual allegations as true. Bassett v. Nat’l Collegiate Athletic Ass’n, 528 F.3d

426, 430 (6th Cir. 2008) (citing Treesh, 487 F.3d at 476). The court must then dismiss an action if

the complaint does not contain “enough facts to state a claim to relief that is plausible on its face.”

Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). And a court is “not bound to accept as true

a legal conclusion couched as a factual allegation.” Papasan v. Allain, 478 U.S. 265, 286 (1986).

2. Standing

Article III standing consists of three elements: “a plaintiff must show (i) that he suffered an

injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely

caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.”

TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021) (citing Lujan v. Defs. of Wildlife, 504 U.S.

555, 560–61 (1992)). By requiring a plaintiff to demonstrate these three elements, a federal court

ensures that it does not “adjudicate hypothetical or abstract disputes.” Id.

Defendant mounts both a facial challenge and a factual challenge to Plaintiffs’ standing with

respect to the first two elements, contending that the alleged harms do not rise to the level of an

injury-in-fact, and that even if they do, they are not traceable to the data breach. The court considers

these challenges for each element in turn.

a. Injury-in-Fact

Plaintiffs present various theories of injury, each of which Defendant challenges. Because

“standing is not dispensed in gross,” a plaintiff “must demonstrate standing for each claim [and] .

. . for each form of relief sought.” Universal Life Church Monastery Storehouse v. Nabors, 35 F.4th

1021, 1031 (6th Cir. 2022) (first quoting Lewis v. Casey, 518 U.S. 343, 358 n.6 (1996), then quoting

DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 352 (2006)). However, a plaintiff need not prove

multiple theories of injury for a single claim. See, e.g., In re Bon Secours Mercy Health Data Breach

-8-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 8 of 31. PageID #: <pageID>

Litig., No. 1:24-cv-594, 2025 WL 1827804, at *5 & n.3 (S.D. Ohio July 2, 2025). Based on the

pleadings, the court understands the alleged increases in spam calls and texts and privacy violations

to, together, provide an injury for every claim. Because, as discussed below, the court finds that each

of these harms constitutes an injury-in-fact, the court declines to consider the other theories disputed

by Defendant.

i. Spam Communications

Defendant argues that the use of Plaintiffs’ PII by adverse actors in the form of unsolicited

communications does not rise to the level of an actual injury. However, this is not a correct statement

of the law in the Sixth Circuit. Courts in the Sixth Circuit have found that an increase in spam calls,

texts, or emails following a data breach is sufficient to establish a concrete injury. In re Ohio

Mariuana Card Data Breach Litig., No. 1:25-cv-01765, 2026 WL 2634838, at *12 (N.D. Ohio Sep.

8, 2026) (collecting cases); see, e.g., Ward v. NPAS, Inc., 63 F.4th 576, 580–81 (6th Cir. 2023)

(finding that even a “single unwanted phone call” is an Article III injury, id. at 580, because all that

is needed is “a close relationship ‘in kind, not degree’ to common law harms,” id. at 581 (quoting

Gadelhak v. AT&T Servs. Inc., 950 F.3d 458, 462 (7th Cir. 2020))); see also Dickson v. Direct

Energy, LP, 69 F.4th 338, 347–48 (6th Cir. 2023) (“[O]ther courts have determined that plaintiffs

had standing to sue after receiving unsolicited communications to their cell phones by analogizing

that harm to intrusion upon seclusion . . . .” (citing, inter alia, Gadelhak, 950 F.3d at 462)).

Defendant cites to a decision in the Eastern District of Louisiana for the proposition that, “[w]here

the plaintiff has suffered no actual misuse of his PII, . . . courts generally conclude that an increase

in spam calls, texts, and/or emails without more is not sufficient to support standing.” Bednyak v.

Fin. Risk Mitigation, Inc., 739 F. Supp. 3d 353, 370 (E.D. La. 2024). But courts in the Sixth Circuit

have come out the other way: an increase in unsolicited communications is itself “actual misuse” of

-9-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 9 of 31. PageID #: <pageID>

PII. Following precedent, the court finds that the increase in spam calls and texts alleged by each of

the Plaintiffs is an injury-in-fact. Because Defendant nowhere contradicts the allegation that

Plaintiffs endured an increase in unsolicited communications following the data breach, even under

a factual attack, Plaintiffs satisfy the first element of standing.

ii. Privacy

To the extent that any of Plaintiffs’ claims rely on a violation of privacy but not an increase

in spam calls or texts, the court considers whether a privacy violation as alleged in this action — the

dissemination of an individual’s PII on the dark web — is an injury-in-fact. Defendant asserts that

“[c]ourts routinely hold that the mere loss of privacy is not a concrete and particularized injury.”

(Mot. Dismiss at PageID 222, ECF No. 15-1.) For support, Defendant cites to Tate v. EyeMed Vision

Care, LLC, No. 1:21-cv-36, 2023 WL 6383467 (S.D. Ohio Sep. 29, 2023), as well as two cases

outside of the Sixth Circuit. The court in Tate declared without citation that “an intangible violation

of privacy” has been rejected as a theory of injury by the Supreme Court. Id. at *4. However, the

Tate court did not specify which Supreme Court precedent it relied on for that proposition. In

TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), the Supreme Court observed that disclosure of

private information and intrusion upon seclusion are “intangible harms” that are nevertheless

concrete for the purpose of satisfying standing. Id. at 425 (citing Davis v. Fed. Election Comm’n, 554

U.S. 724, 733 (2008); Gadelhak, 950 F.3d at 462). For its part, the Sixth Circuit has subsequently

found a violation of privacy to amount to an injury-in-fact. See, e.g., Salazar v. Paramount Global,

133 F.4th 642, 647–48, 647 n.5, 648 n.6 (6th Cir. 2025) (concluding that disclosure of viewing

history to Facebook was a concrete harm). This court has also so concluded, in the context of a data

breach similar to the one at the heart of this action. See, e.g., Allen v. Wenco Mgmt., LLC, 696 F.

Supp. 3d 432, 437 (N.D. Ohio 2023) (“[T]he weight of post-TransUnion authority establishes that

-10-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 10 of 31. PageID #: <pageID>

Allen’s alleged privacy injury is sufficiently concrete for Article III purposes.”) The court affirms

its earlier statement and concludes that, based on the pleadings, Plaintiffs’ alleged privacy violation

constitutes a sufficient injury-in-fact.

In its factual challenge, Defendant alleges that if Qilin did gain access to Plaintiffs’ PII, then

Qilin alone had unauthorized access because it deleted the data following payment of the ransom.

Defendant argues that if access were limited to Qilin, then the data breach would not constitute a

concrete injury because the closest harm at common law, public disclosure of private facts, requires

“disclosure to the ‘public at large.’” (Mot. Dismiss at PageID 229, ECF No. 15-1 (quoting Marlin

v. Associated Materials, LLC, No. 5:23CV1621, 2024 WL 2319115, at *5 (N.D. Ohio May 22, 2024)

(quoting Killilea v. Sears, Roebuck & Co., 499 N.E.2d 1291, 1294 (Ohio Ct. App. 1985))).) If

“access by a single, unauthorized third party, not widespread disclosure” were all that was plausibly

alleged, then Defendant’s argument might have merit. Marlin, 2024 WL 2319115, at *3. But since

Plaintiffs plausibly allege widespread disclosure, inferred by the increase in spam communications

received by Plaintiffs following the data breach, this line of reasoning is inapplicable. Plaintiffs

plausibly allege a violation of privacy that is sufficient to rise to the level of an injury-in-fact.

Defendant raises another point in its factual challenge: that much of Plaintiffs’ PII had been

previously shared on the dark web. It is unclear whether Defendant additionally contends that prior

releases of PII eliminate any injury flowing from a privacy violation. (See Mot. Dismiss at PageID

229, ECF No. 15-1.) For clarity’s sake, the court considers but rejects this theory.

In U.S. Department of Justice v. Reporters Committee For Freedom of Press, 489 U.S. 749

(1989), the Supreme Court reviewed whether a “privacy interest . . . approaches zero” where the

relevant information was previously disclosed through piecemeal form. Id. at 762–63. The Court

“reject[ed]” such a “cramped notion of personal privacy.” Id. at 763. First, the Court found that “the

-11-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 11 of 31. PageID #: <pageID>

compilation of otherwise hard-to-obtain information” was a distinct harm. Id. at 764. Independently,

the Court recognized a “privacy interest inherent in the nondisclosure of certain information even

where the information may have been at one time public.” Id. at 767. The Court affirmed “a privacy

interest in keeping personal facts away from the public eye,” id. at 769, which is eroded whenever

private information is shared. See id. at 769–70; Showing Animals Respect & Kindness v. U.S. Dep’t

of Interior, 730 F. Supp. 2d 180, 197 (D.D.C. 2010) (“Individuals have a privacy interest even as to

information that has been previously disclosed publicly.” (citing Reporters Committee, 489 U.S. at

763–64)); Detroit Free Press Inc. v. U.S. Dep’t of Just., 829 F.3d 478, 483 (6th Cir. 2016) (“Even

when information concerning an individual’s person becomes part of the public record, ‘one d[oes]

not necessarily forfeit a privacy interest,’ though the interest ‘diminshe[s].’” (quoting Reporters

Committee, 489 U.S. at 763 n.15)).

The principles elucidated in Reporters Committee are instructive here. First, in considering

various postings of PII to the dark web, not all postings are the same. A posting that offers a

combination of PII may be more damaging to the victim’s privacy than multiple postings that each

offer a single datum, insofar as the compilation holds value greater than the sum of its parts. See

Reporters Committee, 489 U.S. at 764–65. A posting without a paywall is likewise more violative

than one that offers PII only to those willing to pay. Second, even if an individual’s PII has

previously been compiled and made available for free on the dark web, a new posting of that

individual’s PII freshly disseminates it to adverse actors and increases the likelihood that it is brought

to their attention. In a landscape where millions of individuals’ PII are accessible, ripe for the taking,

any action that places an individual’s PII closer to the forefront damages that individual’s privacy.1

1 Courts have applied similar reasoning when determining whether to redact PII in court filings. See, e.g., In re Matter of Certain Claims & Noticing Agents’ Receipt of Fees in Connection With Unauthorized Arrangements With Xclaim Inc., 647

-12-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 12 of 31. PageID #: <pageID>

When someone posts a private video online without the subject’s consent, the subject’s privacy is

invaded, but not depleted: others who post the video, whether a week or a year later, still commit

independent intrusions. Because any dissemination of PII on the dark web constitutes a meaningful

violation of privacy, regardless of whether Plaintiffs’ PII were previously shared on the dark web,

any posting made possible by the data breach at issue here rises to the level of a concrete injury.

Plaintiffs satisfy the first element of standing with respect to their claims seeking damages. The court

next considers whether Plaintiffs satisfy the first element of standing with respect to any injunctive

relief sought.

iii. Injunctive Relief

To have standing for injunctive relief, a plaintiff must be able to show that future harm is

“certain or perhaps substantially likely to occur.” Mikel v. Quin, 58 F.4th 252, 258 (6th Cir. 2023)

(citing, inter alia, Clapper v. Amnesty Int’l USA, 568 U.S. 398, 401–02 (2013)); see TransUnion, 594

U.S. at 435–36 (observing standing for injunctive relief where “the risk of harm is sufficiently

imminent and substantial” (citing, inter alia, Clapper, 568 U.S. at 414 n.5; Los Angeles v. Lyons, 461

U.S. 95, 102 (1983))).

Defendant contends that Plaintiffs “have not pleaded facts showing that there is a ‘substantial

and imminent risk’ of a second data breach at UHM.” (Mot. Dismiss at PageID 227, ECF No. 15-1

B.R. 269, 288 (Bankr. 2022) (“Xclaim suggests that the email addresses should not be protected because it was able to locate most of the addresses on other parts of the internet. . . . Permitting Xclaim to post the PII of federal judges and court officials on the court docket would only exacerbate the problem.”); Doe v. Noem, 2:25-cv-00633, 2025 WL 1295664, at *3 (W.D. Wash. May 5, 2025) (“Defendants are correct that Plaintiff’s DUI docket is already public, so in a strict sense Plaintiff is no worse off being associated with the DUI charge in this case. However, this is a much higher-profile action than Plaintiff’s DUI case, so prospective employers and other interested parties would be more likely to discover that Plaintiff has been charged with a DUI if his name was disclosed here; as Plaintiff describes it, the DUI charge is ‘buried in a local docket.’”).

-13-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 13 of 31. PageID #: <pageID>

(citing, inter alia, Brooks v. Peoples Bank, 732 F. Supp. 3d 765, 776 (S.D. Ohio 2024); In re Bon

Secours Mercy Health, 2025 WL 1827804, at *7).) Further, Defendant submits that it “has instituted

additional security measures to bolster its already substantial security program, making any repetition

of the breach unlikely.” (Id. at PageID 228.)

In response, Plaintiffs quote a recent decision in this district for the proposition that “similar

allegations confer standing at the pleading stage after a data breach.” (Pls.’ Mem. Opp’n Def.’s Mot.

Dismiss at PageID 373, ECF No. 20.) The relevant language reads as follows:

In addition, Plaintiffs seek injunctive relief that is aimed at preventing or reducing the likelihood of future harm made possible by CBIZ’s alleged failures. When injunctive relief is sought, future injuries are cognizable as injuries in fact. Therefore, even if some, or all, of the alleged injuries fall away during the course of discovery and other pre-trial proceedings, the allegations are sufficient to establish standing at this point in the litigation.

In re CBIZ, 2025 WL 1557033, at *5. The court reads this language to confer standing not for all

forms of injunctive relief after any data breach, but only for those where the relevant “future injuries

are cognizable as injuries in fact.” Id. This standard — requiring a second data breach to be

exceptionally likely — aligns with other decisions in the Sixth Circuit. See Silveira v. Com. Specialty

Truck Holdings, LLC, 2025 WL 2323911, at *7 (E.D. Ky. Aug. 12, 2025) (collecting cases).

After considering evidence presented on the factual challenge, the court finds that the risk

of another data breach is not particularly high. Not only does Defendant attest to having already

taken steps to improve its security, but the circumstances leading to the data breach were not

sufficiently typical to cause the court to conclude that a second data breach is impending. However,

as noted by Plaintiffs, injunctive relief predicated on responding to the initial breach is permissible

so long as the future harms that such relief would avert are likely to occur. See In Bon Secours Mercy

Health, 2025 WL 1827804, at *7 (“Admittedly, the third version of injunctive relief Plaintiffs seek

-14-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 14 of 31. PageID #: <pageID>

— requiring Bon Secours to provide them with credit monitoring and identity theft protection for

life — could perhaps redress, to some extent, the imminent risk of identity theft that they face

because of the already-occurred data breach.”) The holding of Galaria v. Nationwide Mutual

Insurance Co., 663 F. App’x 384 (6th Cir. 2016), continues to be binding and decisive on the

question as to whether a data breach creates a substantial likelihood of future harm. Id. at 387–90;

see, e.g., Brickman v. Maximus, Inc., No. 2:21-cv-3822, 2022 WL 16836186, at *4 (S.D. Ohio May

2, 2022) (finding Galaria to control after TransUnion); Brooks, 732 F. Supp. 3d at 775 (same);

Munger v. Matco Tools Corp., No. 5:23-cv-00337, 2026 WL 1223399, at *5 (N.D. Ohio May 5,

2026) (same); Doe v. Mission Essential Grp., LLC, 2024 WL 3877530, at *4 n.3 (S.D. Ohio Aug.

20, 2024) (same). The court finds that Plaintiffs have standing for injunctive relief, but only limited

to forms that redress harms flowing from the initial data breach.

b. Causation

Satisfied that Plaintiffs have alleged injuries sufficient to meet the first element of standing

for their claims, limited only with respect to certain injunctive relief, the court turns to consider

whether any of Plaintiffs’ claims are halted by the second hurdle of causation.

Defendant presents the possibility that they never compromised Plaintiffs’ data. If so, then

any injuries endured by Plaintiffs could not be traceable to Defendant’s conduct. Attacking the face

of the Complaint, Defendant argues that Plaintiffs unwisely rely on the public disclosure and notice

letters sent by Defendant as support for the proposition that Plaintiffs’ PII were accessed by Qilin

in the data breach. (Mot. Dismiss at PageID 220–21, ECF No. 15-1.) After all, these letters state only

that the recipient’s PII was “potentially accessed” and maintain that Defendant has “no evidence of

the misuse, or attempted misuse, of any potentially impacted information.” (Id. at PageID 220.)

Defendant concludes that “the Court should disregard Plaintiffs’ conclusory, unsupported allegations

-15-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 15 of 31. PageID #: <pageID>

that their personal information was accessed.” (Id.)

The court agrees with Defendant that, if the Complaint relied on no more than the public

disclosure and notice letters to support the allegation that their PII were accessed by Qilin, the

Complaint would not sufficiently allege a traceable injury. See Strautins v. Trustwave Holdings, Inc.,

27 F. Supp. 3d 871, 875 (N.D. Ill. 2014) (“To the extent that [claims of injury] are premised on the

mere possibility that her PII was stolen and compromised, . . . [it] is too speculative to confer Article

III standing.”). Further, the court acknowledges the oft-uncertain tenor of claims accompanied by

the qualifier “upon information and belief.” However, context — and circumstantial evidence — can

offer fortification. A recent decision in this district concerning a similar matter offers guidance:

[Plaintiffs] allege that “on information and belief, Plaintiff’s Private Information has already been published — or will be published imminently — by cybercriminals on the Dark Web.” Although this allegation is made “on information and belief,” the Court finds that this allegation is plausible given the alleged increase in spam and Plaintiff Burgess’ alleged experience with identify theft.

In re Ohio Mariuana Card, 2026 WL 2634838, at *13 (citations omitted). As the increase in spam

communications received by Plaintiffs following the data breach is well-pleaded, the court finds the

allegation that Plaintiffs’ PII were leaked as a result of the data breach to be plausible. At least with

respect to Defendant’s facial attack on subject-matter jurisdiction, Plaintiffs sufficiently allege that

their PII were leaked.

However, the court must also assess Defendant’s factual attack on subject-matter jurisdiction.

Defendant cites to declarations and expert reports that purportedly establish that Qilin deleted all PII

that it initially acquired in the data breach, that Qilin “has a solid reputation for keeping its word

when a victim pays a ransom,” and that no data held by Defendant and accessed in the data breach

has been made available. (Id. at PageID 228.) Defendant also references these declarations to assert

that Plaintiffs’ PII “from other, prior data breaches at other entities” is available on the dark web.

-16-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 16 of 31. PageID #: <pageID>

(Id.) On the basis of this evidence, Defendant asserts that Plaintiffs’ PII, even if made available to

Qilin in the initial data breach, were never further shared and thus Defendant could not be

responsible for any subsequent harms alleged by Plaintiffs.

The court looks to the attached exhibits. Defendant’s Chief Information Officer, Mr. Mark

Langhans, declares that Qilin “provided logs showing” that PII accessed in the data breach had been

deleted. (Def.’s Ex. 1: Declaration of Mark Langhans at PageID 249, ECF No. 15-2.) Mr. Langhans

also declares that Defendant, in gathering the PII in its possession for review by an investigative

firm, determined that it does not have a valid email address for three Plaintiffs and lacks one

Plaintiff’s phone number. (Id. at PageID 250.)

A representative from that investigate firm, Mr. Adam Hart, opines in an expert report as to

the typical conduct of Qilin, with which he has previously communicated. (Def.’s Ex. 2: Expert

Report of Adam Hart at PageID 274, ECF No. 17.) Mr. Hart observes that Qilin’s standard practice

is to extort targeted companies for payment and, “in some cases,” to post data on a website that it

maintains. (Id. at PageID 276.) Mr. Hart attests that, after the firm “searched the ‘dark web’ and

other locations to see if any data from the UHM breach had been made public,” it concluded that

Qilin has not posted any PII from the data breach on its website and that “no evidence has been

observed to indicate that the data has been posted in other locations where data would commonly

be posted by Qilin threat actors.” (Id. at PageID 277.) Mr. Hart expressed that, “[a]lthough there is

no way to verify that Qilin deleted all copies of the data following the event, in the world of

ransomware, reputation is vitally important as it allows threat actors to leverage the trust and brand

name to demand high ransoms in the future.” (Id.) Mr. Hart further attests that several of the

Plaintiffs — twelve of fourteen — had at least some PII leaked in prior data breaches of other

companies. (Id. at PageID 279–82.) Mr. Hart’s supplemental expert report states that in a second

-17-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 17 of 31. PageID #: <pageID>

investigation conducted from July 17, 2026 to August 6, 2026, he did not observe PII from the data

breach posted on Qilin’s website “or other major ransomware sites.” (Def.’s Ex. 4: Supplemental

Expert Report of Adam Hart at PageID 443–44, ECF No. 25-1.)

The court finds that, even in the aggregate, these exhibits do not eliminate the possibility that

Plaintiffs’ PII were leaked as a result of the data breach. While Mr. Langhans declares that Qilin

offered Defendant evidence that it deleted all PII acquired in the data breach, Mr. Hart states that

such evidence is unverifiable. Although Mr. Langhans declares that Defendant lacks the email

addresses of three Plaintiffs, those three Plaintiffs have not alleged an increase in spam emails

following the data breach. (See Compl. at PageID 128, 137, 142, ECF No. 12.) Mr. Langhans

declares that Defendant lacks the phone number of one Plaintiff, and this Plaintiff has alleged

increased spam calls and text messages. (See id. at PageID 137.) While this may undermine the

extent of that Plaintiff’s injuries, it does not eliminate standing for this action. Mr. Hart synthesizes

a lack of any relevant PII discovered on the dark web with the typical conduct of groups such as

Qilin to conclude that Qilin did not and would not leak data for which a ransom was paid. However,

as Plaintiffs note, the absence of relevant PII on the dark web today “does not mean it was not

previously published on the dark web, or that it will not be in the future.” (Opp’n Mot. Leave at

PageID 451, ECF No. 27.) And no matter how standard of a practice it is for ransomware groups to

delete data following receipt of a ransom, Plaintiffs have provided evidence that, in this instance,

their PII were leaked as a result of the data breach. Even if twelve of the fourteen Plaintiffs’ harms

were traceable only to prior data breaches — an argument that the court does not find persuasive,

as addressed below — Mr. Hart’s limited research suggests that two of the Plaintiffs did not have

any of their relevant PII leaked in other major data breaches before the data breach relevant to this

action. This negative inference, in conjunction with the alleged increase in spam communications

-18-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 18 of 31. PageID #: <pageID>

received by Plaintiffs following the data breach, suggest that Plaintiffs’ PII were in fact leaked as a

result of the data breach. Thus, even with respect to the factual attack on subject-matter jurisdiction,

the court finds that Plaintiffs sufficiently allege that their PII were compromised in the data breach.

This satisfies the causation element of standing. Because Defendant does not challenge the third

element of standing, the court finds that Plaintiffs have demonstrated standing for all of their claims

except with respect to injunctive relief intended to avert future data breaches.

3. Failure to State a Claim

The court turns to consider Defendant’s 12(b)(6) motion, which asserts that none of

Plaintiffs’ causes of action state a claim upon which relief can be granted. As discussed above, the

court must accept well-pleaded allegations as true. Several decisions from district courts in the Sixth

Circuit have found that plaintiffs in similar circumstances successfully pled similar claims; while

the court must independently consider the sufficiency of Plaintiffs’ claims in this action, prior

decisions offer assurance that, as a matter of law, most of the following claims can be stated with

comparable facts that are adequately pled.

a. Negligence

A claim for negligence under Ohio law is found where a plaintiff demonstrates “(1) the

existence of a legal duty owed to the injured party, (2) the defendant’s breach of that duty, and (3)

that an injury proximately resulted from the defendant’s breach of duty.” Snay v. Burr, 189 N.E.3d

758, 762 (Ohio 2021) (citing Mussivand v. David, 544 N.E.2d 265, 270 (Ohio 1989)). Defendant

argues that the Complaint fails to plausibly state each of these elements.

i. Duty of Care

Under Ohio law, a duty of care can be established through common law. Previous decisions

of lower courts in the Sixth Circuit have repeatedly found a common law duty to protect PII. See,

-19-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 19 of 31. PageID #: <pageID>

e.g., In re Ohio Mariuana Card, 2026 WL 2634838, at *15–17, (“[A]bsent any contrary guidance

from Ohio courts or the Sixth Circuit, the Court likewise concludes that Ohio law recognizes a

common law duty to safeguard PII.”); In re CBIZ, 2025 WL 1557033, at *6 (“[T]his Court sees no

reason to exempt businesses who collect PII from the general duty of reasonable care under common

law negligence standards.”); In re Flagstar, 2024 WL 5659583, at *10 (“‘Companies have a duty

to take reasonable precautions’ to protect users’ PII ‘due to the reasonably foreseeable risk of danger

of a data breach incident.’” (quoting Lochridge v. Quality Temporary Servs., Inc., No. 22-cv-12086,

2023 WL 4303577, at *6 (E.D. Mich. June 30, 2023))); Brooks, 732 F. Supp. 3d at 779 (concluding

that, under Kentucky law, there is a common law duty to safeguard customers’ PII); In re Bon

Secours Mercy Health, 2025 WL 1827804, at *9 (concluding that, under Ohio law, an employer has

a duty to protect an employee’s PII at least in the context of data breaches (citing, inter alia, Clemens

v. ExecuPharm Inc., 48 F.4th 146, 158–59 (3d Cir. 2022); Savidge v. Pharm-Save, Inc., No. 3:17-

CV-186, 2025 WL 964446, at *8 (W.D. Ky. Mar. 31, 2025))). The court concurs with these past

holdings and finds that Defendant owed Plaintiffs a duty to safeguard Plaintiffs’ PII.

ii. Breach of Duty

In previous rulings in data breach proceedings, lower courts in the Sixth Circuit have found

a plausible breach of the duty to safeguard PII where that PII was not encrypted. See, e.g., In re Ohio

Mariuana Card, 2026 WL 2634838, at *17; In re CBIZ, 2025 WL 1557033, at *7; In re Flagstar,

2024 WL 5659583, at *11. Here, Plaintiffs allege that Defendant did not encrypt their PII and

otherwise failed to adequately safeguard their PII. (Compl. at PageID 102, ECF No. 12.) The court

credits Plaintiffs’ allegations as more than a “conclusory assertion,” (Mot. Dismiss at PageID 233,

ECF No. 15-1), and observes that not only was there a data breach, but Defendant responded to that

breach by implementing measures to improve its security. (See id. at PageID 228.) Accordingly, the

-20-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 20 of 31. PageID #: <pageID>

court finds that Plaintiffs plausibly allege a breach of Defendant’s duty to safeguard Plaintiffs’ PII.

iii. Proximate Injury

As “standing . . . is closely related to damages,” Allen, 696 F. Supp. 3d at 437, when a

plaintiff satisfactorily alleges an injury-in-fact sufficient for standing, she likely states a claim for

damages. See Munger, 2026 WL 1223399, at *6. Such is the case here: as addressed above, Plaintiffs

ably allege harms flowing from the data breach.

Defendant introduces a second challenge to the third element for negligence, asserting that

the economic loss doctrine bars recovery for purely economic injuries. (Mot. Dismiss at PageID 234,

ECF No. 15-1 (citing, inter alia, Corporex Dev. & Constr. Mgmt., Inc. v. Shook, Inc., 835 N.E.2d

701, 704 (Ohio 2005)).) But this doctrine is not “a blanket prohibition on the recovery of any

‘economic losses’ under Ohio tort law.” In re CBIZ, 2025 WL 1557033, at *8. Rather, it restricts tort

claims for economic loss where the loss was sustained under a contract. Id.; Allen, 696 F. Supp. 3d

at 438–39 (citing, inter alia, Corporex, 835 N.E.2d at 705); Tate, 2023 WL 6383467, at *7 (citing

Chemtrol Adhesives, Inc. v. Am. Mfrs. Mut. Ins. Co., 537 N.E.2d 624, 630–31 (Ohio 1989)); In re

Ohio Mariuana Card, 2026 WL 2634838, at *18–20 (acknowledging “an obvious tension” among

lower-court decisions in the Sixth Circuit, but concluding that this approach is “more persuasive”).

Here, Plaintiffs have plausibly alleged a common-law duty owed to them independent of any

contractual duty, and thus the economic loss doctrine is inapplicable. Because Plaintiffs plausibly

allege all three elements for a claim of negligence under Ohio law, this claim survives the 12(b)(6)

motion to dismiss.

b. Breach of Implied Contract

A claim for breach of implied contract under Ohio law is found where a plaintiff

demonstrates “offer, acceptance, consideration, and a meeting of the minds.” Foster v. Health

-21-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 21 of 31. PageID #: <pageID>

Recovery Servs., Inc., 493 F. Supp. 3d 622, 640 (S.D. Ohio 2020) (quoting Randleman v. Fid. Nat’l

Title Ins. Co., 465 F. Supp. 2d 812, 818 (N.D. Ohio 2006)). Defendants assert that Plaintiffs fail to

meet the last two elements.

i. Consideration

Consideration is satisfied where there exists “either a detriment to the promisee or a benefit

to the promisor.” Williams v. Ormsby, 966 N.E.2d 255, 259 (Ohio 2012) (citing Irwin v. Lombard

Univ., 46 N.E. 63, 64–65 (Ohio 1987)). Defendant acknowledges that “valid consideration can be

small,” but maintains that it must have been bargained for. (Mot. Dismiss at PageID 235, ECF No.

15-1.) Plaintiffs persuasively argue that either their PII or the money they paid for services satisfies

consideration in this instance. (Opp’n Mot. Dismiss at PageID 384, ECF No. 20 (citing, inter alia,

Perry v. Bay & Bay Transp. Servs., Inc., 650 F. Supp. 3d 743, 757 (D. Minn. 2023); O’Byrne v.

Weyerhaueser Co., 2:19-CV-02493, 2020 WL 6445832, at *4 (S.D. Ohio Nov. 3, 2020)).) Other

decisions from district courts in the Sixth Circuit have similarly found that a plaintiff plausibly plead

a breach of implied contract following a data breach. See In re Bon Secours Mercy Health, 2025 WL

1827804, at *11 (collecting cases); see, e.g., Munger, 2026 WL 1223399, at *7; Foster, 493 F. Supp.

3d at 640–61; In re Ohio Mariuana Card, 2026 WL 2634838, at *21. The court finds that Plaintiffs

plausibly allege consideration.

ii. Meeting of the Minds

To determine whether there was a meeting of the minds between two parties, courts draw

inferences from “surrounding circumstances.” Dean v. Chamberlain Univ., LLC, No. 21-3821, 2022

WL 2168812, at *3 (6th Cir. June 16, 2022) (quoting Alpha Telecomm., Inc. v. Int’l Bus. Machs.

Corp., 241 F. App’x 301, 304 (6th Cir. 2007)). An expression of assent is “generally sufficient” to

demonstrate a meeting of the minds. Tagnetics, Inc. v. Kayser, 842 F. App’x 969, 972 (6th Cir.

-22-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 22 of 31. PageID #: <pageID>

2021). Defendant argues that Plaintiffs make no more than conclusory allegations regarding a

meeting of the minds. (Mot. Dismiss at PageID 236, ECF No. 15-1.) But Plaintiffs advance

allegations similar to those alleged by plaintiffs in another recent case in this district, which

“certainly go beyond” conclusory statements because they reference Defendant’s privacy policy and

articulate mutual assent underlying the disclosure of Plaintiffs’ PII to Defendant. See In re Ohio

Mariuana Card, 2026 WL 2634838, at *22. In line with recent decisions, the court finds that

Plaintiffs sufficiently plead a meeting of the minds. Because Plaintiffs plausibly allege all elements

of breach of an implied contract, this claim survives the 12(b)(6) motion to dismiss.

c. Unjust Enrichment

A claim for unjust enrichment under Ohio law is found where a plaintiff demonstrates “(1)

a benefit was conferred by the plaintiff on the defendant, (2) the defendant had knowledge of the

benefit, and (3) the defendant retained the benefit under circumstances in which it was unjust to do

so without payment.” Bunta v. Superior VacuPress, L.L.C., 218 N.E.3d 838, 848 (Ohio 2022) (citing

Hambleton v. R.G. Barry Corp., 465 N.E.2d 1298, 1302 (Ohio 1984)). Defendant challenges the first

and third elements. Because Defendant’s challenge to the first element succeeds, the court does not

consider the third element.

In regard to the conferral of a benefit, Defendant contends that Plaintiffs do not allege any

specific facts to explain why the Plaintiffs’ provision of PII to Defendant would have conferred a

benefit. (Mot. Dismiss at PageID 237, ECF No. 15-1.) Plaintiffs allege that “Defendant would not

be able to carry out an essential function of its regular business without the Private Information . .

. and derived revenue by using it for business purposes.” (Compl. at PageID 183, ECF No. 12.)

Lower courts in the Sixth Circuit have tended to find a plausibly conferred benefit in either

of two instances: where the plaintiff alleged that the value of data security was factored into the price

-23-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 23 of 31. PageID #: <pageID>

they paid the defendant, and where the plaintiff alleged that the defendant independently profited off

of plaintiff’s PII.. Compare, e.g., Tucker v. Marietta Area Health Care, Inc., Nos. 2:22-cv-184, 2:22-

cv-221, 2:22-cv-385, 2023 WL 423504, at *7 (S.D. Ohio Jan. 26, 2023) (declining to dismiss an

unjust enrichment claim where the plaintiffs alleged that they overpaid for services with the

expectation that, in return, their PII would be kept secure), and Foster, 493 F. Supp. 3d at 641

(“Plaintiff alleges that he conferred a benefit on Defendant by paying Defendant for health care

services pursuant to an implied contract which required Defendant to safeguard Plaintiff’s sensitive

medical information.”), and In re Ohio Mariuana Card, 2026 WL 2634838, at *23–24 (citing, inter

alia, Foster, 493 F. Supp. 3d at 641) (same), with Wehrle v. McLaren Health Care Corp., No. 25-cv-

11420, 2026 WL 2719088, at *7 (E.D. Mich. Sep. 15, 2026) (declining to dismiss claim alleging that

defendants “received direct and substantial benefits from the sharing of Plaintiffs’ PHI and PII with

third-parties, including . . . ‘substantial monetary compensation’”), and Jarrell v. Adena Health Sys.,

No. 2:24-cv-00282, 2025 WL 81305, at *8 (S.D. Ohio Jan. 13, 2025) (finding claim sufficiently

alleged where plaintiff attested that defendant “unjustly reaped that value by disclosing [PII], without

authorization, for ‘marketing and revenue generation’”). However, Plaintiff does not specifically

allege either of these circumstances.

Conversely, lower courts in the Sixth Circuit have found unjust enrichment claims lacking

where PII were alleged to have conferred a benefit but such benefit was not articulated. See, e.g.,

Brooks, 732 F. Supp. 3d at 782 (“Beyond the threadbare allegation, Plaintiffs do not explain how

Limestone benefited from Plaintiffs’ PII. For example, Plaintiffs do not allege that Limestone used

or sold PII for a profit.”); In re Bon Secours Mercy Health, 2025 WL 1827804, at *12 (rejecting the

theory that the defendant “enriched itself through the inherent value of Plaintiffs’ PII”). But see

Munger, 2026 WL 1223399, at *7 (finding a plausible benefit conferred “because the PII is

-24-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 24 of 31. PageID #: <pageID>

valuable”). For the purpose of an unjust enrichment claim, Plaintiffs’ decision to share their PII does

not necessarily confer a benefit upon Defendant.

Plaintiffs argue that here, the conferred benefit to Defendant was the ability for Defendant

to take Plaintiffs on as customers — because Defendant allegedly needed Plaintiffs’ PII to operate.

But lower courts in the Sixth Circuit have found the provision of PII not to be an independent benefit

unjustly enriching a defendant where it was incorporated into the broader contractual relationship

between the parties. See, e.g., Polkowski v. Jack Doheny Cos., Inc., No. 2:25-cv-10516, 2025 WL

3079358, at *11 (E.D. Mich. Nov. 4, 2025); In re Grede Holdings LLC Data Breach Litig., 2026 WL

396292, at *4–5 (E.D. Mich. Feb. 12, 2026); In re Manpower of Lansing, MI, Inc., Data Breach

Litig., No. 1:25-cv-956, 2026 WL 1194822, at *7 (W.D. Mich. Mar. 19, 2026). Rather, in such cases,

the parties “got what they paid for.” Tate, 2023 WL 6383467, at *8; see In re CBIZ, 2025 WL

1557033, at *11 (“The fact that PII was required to process benefits and to allow CBIZ to fulfill its

contract with the third party employers does not mean that they benefitted in any concrete way from

the information.”). The court does not find Plaintiffs’ theory persuasive. Plaintiffs fail to plausibly

allege that a benefit was conferred upon Defendant, and thus Plaintiffs’ unjust enrichment claim

(Count III) must be dismissed.

d. California Consumer Privacy Act (“CCPA”)

Under the California Consumer Privacy Act (“CCPA”), “any consumer whose nonencrypted

and nonredacted personal information . . . is subject to an unauthorized access and exfiltration, theft,

or disclosure as a result of the business’ violation of the duty to implement and maintain reasonably

security procedures and practices appropriate to the nature of the information to protect the personal

information may institute a civil action.” CAL. CIV. CODE § 1798.150(a)(1). Such a civil action may

be for damages, injunctive or declaratory relief, or any other relief the court deems proper. Id. Before

-25-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 25 of 31. PageID #: <pageID>

initiating an action under the CCPA for statutory damages, a consumer must provide a business with

thirty days’ written notice identifying the “specific provisions” of the CCPA that the business

violated, unless the action is solely for actual pecuniary damages already suffered. Id. § 1798.150(b).

If the business cures the violation and provides an express written statement documenting this cure

alongside an attestation that no further violations shall occur, then no action for damages may be

brought against the business unless the business subsequently acts in breach of that statement. Id.

The court dismisses the CCPA claim to the extent that it seeks statutory damages. Defendant

alleges that Plaintiffs failed to provide the statutorily obligated thirty days’ notice before filing this

action. (Mot. Dismiss at PageID 240, ECF No. 15-1.). Plaintiffs attest that the notice letters were

mailed before Plaintiffs filed their Consolidated Complaint. (Opp’n Mot. Dismiss at PageID 389,

ECF No. 20.) While that is true, Plaintiffs did not let thirty days pass: the notice letters were mailed

on October 21, 2025, and the consolidated complaint was filed on November 3, 2025. (Compl. at

PageID 185, ECF No. 12.). Howeverr, this notice requirement extends only to actions with respect

to statutory damages sought. See, e.g., In re Young Consulting Data Breach Litig., No. 1:24-CV-

3938, 2026 WL 2719122, at *20 (N.D. Ga. Sep. 15, 2026).

Defendant contends that the CCPA claim should be dismissed in its entirety because

Plaintiffs fail in their Complaint to identify reasonable security procedures and practices that would

have prevented disclosure of their PII if taken by Defendant. (Mot. Dismiss at PageID 240–41, ECF

No. 15-1.). However, throughout their Complaint and incorporated by reference in their CCPA

claim, Plaintiffs identify several actions that Defendant could have taken to protect Plaintiffs’ PII.

(See, e.g., Compl. at PageID 102, 174, ECF No. 12.) The Complaint indicates that Defendant failed

to take these actions, as in addition to describing such actions it asserts that, “Defendant violated its

duty to implement and maintain reasonable security procedures and practices.” (Id. at PageID 174.)

-26-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 26 of 31. PageID #: <pageID>

At this stage, Plaintiffs need not furnish evidence conclusively proving that Defendant failed in this

regard; rather, the court finds it plausible that actions listed by Plaintiffs would have prevented the

disclosure of their PII, and, as above, the court draws a plausible inference from an increase in spam

calls and texts that Plaintiffs’ PII were disclosed, indicating that Defendant did not take the necessary

and sufficient steps to protect the PII in question. The court declines to dismiss the CCPA claim.

e. Declaratory and Injunctive Relief

Count V of the Complaint is for declaratory judgment and injunctive relief. Plaintiffs seek

relief in the form of a declaratory judgment that Defendant owes a legal duty to secure the PII of

Plaintiffs and Class Members, that Defendant breached its duty by allowing the data breach to occur,

that Defendant’s existing data monitoring measures do not comply with its duty of care, and that

Defendant’s ongoing breach of this duty continues to cause harm to Plaintiffs and Class Members.

(Id. at PageID 187.) Plaintiffs seek further relief in the form of an injunction ordering Defendant to

provide lifetime credit monitoring and identity theft insurance and protection services to Plaintiffs

and Class Members and to implement and maintain reasonable security and monitoring measures.

(Id. at PageID 188.) As discussed above, Plaintiffs lack standing to bring suit for declarations and

orders reliant on the risk of future data breaches. The court thus dismisses Count V with respect to

the third and fourth requested declarations as well as the second requested order.

With respect to the remaining requested declarations, Defendant contends that three of the

Grand Trunk factors — a set of five factors applied in the Sixth Circuit to determine whether a

district court should exercise jurisdiction under the Declaratory Judgment Act — are relevant and

guide the court to dismiss Count V. The court evaluates Count V with respect to all Grand Trunk

factors, ultimately concluding that the declaratory judgment claim here would be duplicative and

thus should be dismissed.

-27-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 27 of 31. PageID #: <pageID>

When assessing whether to exercise jurisdiction under the Declaratory Judgment Act in the

Sixth Circuit, courts consider the following factors:

(1) [W]hether the declaratory action would settle the controversy; (2) whether the declaratory action would serve a useful purpose in clarifying the legal relations in issue; (3) whether the declaratory remedy is being used merely for the purpose of “procedural fencing” or “to provide an arena for a race for res judicata;” (4) whether the use of a declaratory action would increase friction between our federal and state courts and improperly encroach upon state jurisdiction; and (5) whether there is an alternative remedy which is better or more effective.

United Specialty Ins. Co. v. Cole’s Place, Inc., 936 F.3d 386, 396 (6th Cir. 2019) (quoting Grand

Trunk W. R.R. Co. v. Consol. Rail Corp., 746 F.2d 323, 326 (6th Cir. 1984)). As noted by Defendant,

the third and fourth factors do not weigh against exercising jurisdiction in this instance, as Plaintiffs

do not appear to introduce Count V for the purpose of procedural fencing or encroaching upon state

jurisdiction. Defendant asserts that a declaratory judgment would not settle the controversy because

it would not resolve all of Plaintiffs’ substantive claims and that it would not serve a useful purpose

because an alternative remedy — namely, the substantive claims in the action — would be as or

more effective. The court agrees. A court may dismiss a declaratory judgment claim that is wholly

redundant. See, e.g., Malibu Media, LLC v. Redacted, 705 F. App’x 402, 405–07 (6th Cir. 2017)

(affirming dismissal of a claim seeking declaratory relief where “resolution of [the substantive] claim

would dispose of all factual or legal issues,” id. at 406); Living Hope Parma, Inc. v. Bhd. Mut. Ins.

Co., 1:26 CV 323, 2026 WL 1983108, at *3–5 (N.D. Ohio July 9, 2026) (dismissing a claim seeking

declaratory relief where “there is no doubt [it] will be rendered moot by adjudication of [substantive]

claims,” id. at *4). Because finding for Plaintiffs on the negligence claim would subsume declaratory

relief (that Defendant owes and breached a duty to protect the PII of Plaintiffs and Class Members),

-28-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 28 of 31. PageID #: <pageID>

the court concludes that Count V should be dismissed with respect to its declaratory judgment claim.

The last remaining component of Count V — a plea for injunctive relief in the form of

lifetime credit monitoring and identity theft insurance and protection services — should not be

dismissed at this stage. Defendant provides no rationale for why Plaintiffs lack standing for this

specific form of injunctive relief. (See Mot. Dismiss at PageID 242–43, ECF No. 15-1.) In their

Opposition to the Motion to Dismiss, Plaintiffs splice this form of injunctive relief from their

broader claim. (Opp’n Mot. Dismiss at PageID 373–74.) This distinction goes unanswered by

Defendant. Accordingly, the court dismisses Count V, except with respect to Plaintiffs’ request for

injunctive relief in the form of credit monitoring, identity theft insurance, and identity theft

protection services.

f. North Carolina Unfair and Deceptive Trade Practices Act (“NCUDTPA”)

The North Carolina Unfair and Deceptive Trade Practices Act (“NCUDTPA”) declares it

unlawful for businesses to engage in “unfair or deceptive acts or practices in or affecting commerce.”

N.C. GEN. STAT. § 75-1.1. An act is unfair “if it ‘offends established public policy’ or is ‘immoral,

unethical, oppressive, unscrupulous, or substantially injurious to consumers.’” Turpin v. Charlotte

Latin Schs., Inc., 933 S.E.2d 671, 685 (N.C. 2026) (quoting Bumpers v. Cmty. Bank of N. Va., 747

S.E.2d 220, 228 (N.C. 2013)). However, to avoid “merging contract law into tort law,” the Supreme

Court of North Carolina has clarified that “[c]onduct that amounts to a breach of contract is an unfair

or deceptive practice only if there are ‘substantial aggravating circumstances.’” Id. (quoting SciGrip,

Inc. v. Osae, 838 S.E.2d 334, 347 (N.C. 2020)). If “the contract cannot be breached without that

circumstance,” then no matter how offensive an act is, it cannot for the purpose of the NCUDTPA

be a substantial aggravating circumstance. Id. (citing SciGrip, 838 S.E.2d at 347).

Defendant contends that Plaintiffs have not identified any practice or conduct by Defendant

-29-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 29 of 31. PageID #: <pageID>

that could be construed as egregious or aggravating. (Mot. Dismiss at PageID 243.) To distinguish

between conduct necessary to the breach of implied contract and extrinsic conduct that in theory

could constitute substantial aggravating circumstances, the court looks to Plaintiffs’ theory of

implied contract. According to the Complaint, “Defendant agreed to . . . take reasonable measures

to protect the security and confidentiality of Plaintiffs’ and Class Members’ Private Information .

. . in compliance with federal and state laws and regulations and industry standards.” (Compl. at

PageID 179, ECF No. 12.) Plaintiffs further allege that, “Defendant’s implied promises are

evidenced by the language in its public facing privacy policy.” (Id.) Because Plaintiffs’ theory of

implied contract is so encompassing, so too is the conduct required to constitute a breach. Thus, most

of Defendant’s allegedly unfair and deceptive acts are inextricable from the breach itself. See Asby

v. Medtronic, Inc., 673 F. Supp. 3d 787, 798 (E.D.N.C. 2023) (“To the extent the [plaintiffs] cite the

alleged breach of warranty as the deceptive act, a breach of warranty claim does not suffice to state

a UDTPA claim.” (citing, inter alia, Sasso v. Tesla, Inc., 584 F. Supp. 3d 60, 80 (E.D.N.C. 2022))).

The only alleged conduct potentially extrinsic to the breach is that Defendant “omitt[ed],

suppress[ed], and conceal[ed] the material fact that Defendant did not reasonably or adequately

secure” the PII in question. (Compl. at PageID 190, ECF No. 12.) Looking to other jurisdictions, the

court observes that other federal courts addressing this issue have found it sufficient at the pleading

stage for a complaint to allege that the defendant engaged in “active concealment of the state of their

security, and [made] incomplete representations about the security and integrity of their computer

and data systems.” In re Fortra File Transfer Software Data Sec. Breach Litig., 749 F. Supp. 3d

1240, 1279 (S.D. Fla. 2024) (quoting In re Mednax Servs., Inc., Customer Data Sec. Breach Litig.,

603 F. Supp. 3d 1183, 1216 (S.D. Fla. 2022)); see also Midkiff v. Shoe Show, Inc., No. 1:24-cv-858,

2026 WL 880210, at *14 (M.D.N.C. Mar. 30, 2026) (deferring resolution of motion to dismiss

-30-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 30 of 31. PageID #: <pageID>

because the court could not identify precedent “that clarifies the ‘aggravating circumstances’ under

which . . . conduct leading up to or following a data breach amount[s] to ‘unfair’ or ‘deceptive’ acts

or practices” and because, at the pleading stage, the factual record was relatively sparse). Given the

current posture of these proceedings, the court views the evidence in the light most favorable to

Plaintiffs and finds it plausible that Defendant concealed the substandard nature of its security

measures. Thus, the court declines to dismiss Count VI.

IV. CONCLUSION

For the foregoing reasons, the court grants Defendant’s Motion for Leave to File

Supplemental Exhibit in Support of Motion to Dismiss (ECF No. 25) and grants in part and denies

in part Defendant’s Motion to Dismiss (ECF No. 15). With the exception of injunctive relief for

measures to mitigate harms to Plaintiffs and Class Members flowing from the initial data breach,

Counts III and V of Plaintiffs’ Consolidated Class Action Complaint (ECF No. 12) are hereby

dismissed.

The court will hold a telephonic status conference with counsel for the parties on

November 5, 2026, at 11:00 a.m., to discuss next steps, including the development of an appropriate

case management schedule. Counsel shall confer prior to the conference in an effort to develop

recommendations for the court.

IT IS SO ORDERED.

/s/ SOLOMON OLIVER, JR. UNITED STATES DISTRICT JUDGE

September 28, 2026

-31-

Case: 1:25-cv-01874-SO Doc #: 29 Filed: 09/28/26 31 of 31. PageID #: <pageID>

Superintendent of Documents 2026-11-04T16:25:47-0500 Government Publishing Office, Washington, DC 20401 U.S. Government Publishing Office Government Publishing Office attests that this document has not been altered since it was disseminated by Government Publishing Office