In re Drivestream, Inc. Data Breach Litigation

           IN THE UNITED STATES DISTRICT COURT                       
           FOR THE EASTERN DISTRICT OF VIRGINIA                      
                    Alexandria Division                              

                         )                                           
                         )                                           
In re Drivestream, Inc.       )                                           
Data Breach Litigation        )    Civil Action No. 1:26-cv-00713 (AJT/LRV)  
                         )                                           
                         )                                           
                         )                                           
                         )                                           
                         )                                           

            MEMORANDUM OPINION AND ORDER                             

Before the Court is a Motion to Dismiss by Defendant Drivestream Inc. (“Drivestream” or 
“Defendant”) [Doc. No. 15] (the “Motion”), in which it moves to dismiss the Amended Complaint 
under Rule 12(b)(1) for lack of Article III standing, and under Rule 12(b)(6) for failure to state a 
claim. The Court held a hearing on the Motion on August 5, 2026, following which it took it under 
advisement. Upon consideration of the Motion, the memoranda in support thereof, [Doc. Nos. 16, 
32] and in opposition thereto, [Doc. No. 25], and for the reasons stated below, the Motion is 
GRANTED under Rule 12(b)(1) for lack of jurisdiction.1                    
                       I.  BACKGROUND                                
Shayla  O’Connor  and  Charline  Bess  (“Plaintiffs”)  bring  this  putative  class  action 
Complaint against Drivestream for its alleged failure to protect their highly sensitive personal 
identifiable  information  (“PII”)  and  protected  health  information  (“PHI”).  The  Amended 
Complaint asserts seven causes of action: (1) negligence; (2) negligence per se; (3) breach of 
implied contract; (4) invasion of privacy; (5) unjust enrichment; (6) breach of fiduciary duty; and 

1 Because the Court grants Drivestream’s 12(b)(1) jurisdictional motion to dismiss, it need not address the merits of 
its Rule 12(b)(6) motion to dismiss for failure to state a claim.         
(7) requests a declaratory judgment. [Doc. No. 14]. The Amended Complaint alleges the following 
facts:                                                                    
Drivestream is a consulting firm that provides Oracle cloud consulting services. Id. ¶ 2. As 
part of its business, Drivestream receives and maintains employee data, including PII and PHI, 

from its customers. Id. ¶ 15. Drivestream’s customers in this case were Saint Mary’s College, 
Indiana (the former employer of Plaintiff Shayla O’Connor) and Virginia Wesleyan University 
(the employer of Plaintiff Charlene Bess). Id. ¶¶ 41, 59.                 
On or around December 9, 2024, Drivestream discovered suspicious activity within its data 
center and later determined that between December 4 and December 9, 2024, unauthorized actors 
accessed its files, which contained Plaintiffs’ and Class Members’ PII/PHI, and downloaded some 
of those files. Id. ¶¶ 19–23.                                             
On January 7, 2025, Akira, a cybercriminal group on which the FBI has issued public 
warnings, posted on the dark web that “Drivestream is a management and IT consulting firm 
specializing in migrating the enterprise business processes of large and medium sized businesses 

to the Cloud,” and that Akira is “ready to upload more than 80 GB of private corporate documents 
including:  SSNs,  family  contacts,  contact  numbers  and  e-mail  addresses  of  employees  and 
customers, driver licenses, passports etc.” Id. ¶¶ 35–37.                 
On January 15, 2026 and February 27, 2026, Plaintiffs O’Connor and Bess received their 
respective notices from Drivestream, in a letter stating that an unauthorized actor accessed its 
systems between December 4–9, 2024, and downloaded certain files. [Doc. Nos. 14-1, 14-2]. The 
letter noted that the following types of information related to Plaintiffs have been impacted by this 
incident: date of birth, Social Security number, financial account information, and health insurance 
information, but there was “no indication that [Plaintiffs’] information was subject to actual or 
attempted misuse as a result of this incident.” Id. The letter provided Plaintiffs “12 months of 
complimentary access to credit monitoring and identity protection services.” Id.  
Plaintiffs allege “on information and belief” that “Akira published the PII/PHI of Plaintiffs 
and Class Members on the dark web on or after January 7, 2025,” and “sold the PII/PHI of 

Plaintiffs and Class Members to other cybercriminals through the dark web on or after January 7, 
2025.” [Doc. No. 14] ¶¶ 38–39. Based on that allegation, Plaintiffs allege injuries stemming from 
Defendant’s alleged failure to maintain adequate cybersecurity safeguards, including spending 
time monitoring financial accounts, reviewing credit reports, and undertaking protective measures 
to mitigate the consequences of the data breach, and experiencing increased spam and scam 
communications causing them to suffer stress, anxiety, and concern regarding the misuse of their 
compromised PII/PHI. Id. ¶¶ 50–53; 69–72. Plaintiffs further allege that they suffered loss of 
privacy, loss of control over their PII/PHI, diminution in the value of their PII/PHI, and a 
substantial and ongoing risk of identity theft and fraud. Id. ¶¶ 48–58, 67–77, 149–150. Plaintiffs 
seek monetary damages, and declaratory and injunctive relief. Id. at 46.  

                    II.  LEGAL STANDARD                              
A motion to dismiss pursuant to Fed. R. Civ. P. 12(b)(1) challenges a court’s jurisdiction 
over the subject matter of the suit. The motion may attack the court’s subject matter jurisdiction 
either as a facial challenge by arguing that the “complaint simply fails to allege facts upon which 
subject  matter  jurisdiction  can  be  based,”  or  as  a  factual  challenge  by  arguing  “that  the 
jurisdictional allegations of the complaint are not true.” Kerns v. United States, 

585 F.3d 187, 192

 
(4th Cir. 2009). Where, as here, a defendant makes a challenge to the face of the complaint, the 
question  is  whether  “the  complaint  fails  to  allege  facts  upon  which  the  court  can  base 
jurisdiction.” Kuntze v. Josh Enterprises, Inc., 

365 F. Supp. 3d 630

, 635–36 (E.D. Va. 2019). 
Under that standard, a court is “required to accept all of the complaint’s factual allegations as 
true.” 

Id.

                                                                
                      III.  DISCUSSION                               
Drivestream moves to dismiss the Amended Complaint on the grounds that it fails to allege 

any concrete injuries that are fairly traceable to Drivestream’s data breach, and therefore Plaintiffs 
cannot establish the Article III standing necessary for the Court to exercise jurisdiction over their 
claims. [Doc. No. 16].                                                    
Article III of the Constitution “limits the jurisdiction of federal courts to ‘Cases’ and 
‘Controversies,’” U.S. Const. art. III, § 2, cl. 1, which requires plaintiffs to have a “personal 
stake”—known as “standing”—in the suit they bring. TransUnion LLC v. Ramirez, 

594 U.S. 413, 423

 (2021). To demonstrate standing, a plaintiff must sufficiently allege three elements: (1) they 
suffered an injury-in-fact that was concrete and particularized and either actual or imminent; (2) 
there was a causal connection between the injury and the defendant’s conduct (i.e. traceability); 
and (3) the injury was likely to be redressable by a favorable judicial decision. Lujan v. Defs. of 

Wildlife, 

504 U.S. 555

, 560–61 (1992). In a class action, the Court analyzes standing based on the 
allegations of personal injury made by the named plaintiffs. See Doe v. Obama, 

631 F.3d 157, 160

 
(4th Cir. 2011).                                                          
In the Fourth Circuit, three decisions clarify the contours of Article III standing in data 
breach cases. In Beck v. McDonald, the Fourth Circuit addressed incidents where a laptop and 
boxes—containing personal information concerning patients, including partial social security 
numbers, names, dates of birth, and physical descriptions—had been stolen. 

848 F.3d 262

, 267–
268 (4th Cir. 2017). However, the missing data was never misused, and there was no evidence that 
a thief intentionally targeted the personal information on the laptops or even accessed it. 

Id. at 274

. 
As a result, the Fourth Circuit affirmed the district court’s dismissal of one category of plaintiffs 
on the pleadings, finding that they lacked standing because allegations of an enhanced risk of 
future identity theft were “too speculative” without evidence of misuse. 

Id.

 Accepting as true the 
allegations that the laptop and pathology reports had been stolen, the court reasoned that the data 

breaches had occurred three to four years before and there was no allegation that the information 
contained on the stolen laptop had been accessed or misused or that the plaintiffs suffered identity 
theft, or that the thief even stole the laptop with the intent to steal the plaintiffs private information. 

Id. at 275

. For these reasons, the Fourth Circuit reasoned that for the Plaintiffs to suffer the harm 
of identity theft that they feared, the chain of possibilities was too “attenuated” to confer standing. 
Nor were Plaintiffs’ allegations sufficient to establish a “substantial risk” of harm. 

Id.

  
In Hutton v. Nat’l Bd. of Exam’rs in Optometry, Inc., the Fourth Circuit reached the 
opposite result, clarifying Beck’s holding and providing further guidance for data breach actions. 

892 F.3d 613

, 621–22 (4th Cir. 2018). In contrast to the plaintiffs in Beck, the Hutton complaint 
alleged that they had already suffered actual harm in the form of identity theft and credit card 

fraud. For these reasons, the Fourth Court held that the plaintiffs had been concretely injured by 
the data breach because the fraudsters used—and attempted to use—the Plaintiffs’ personal 
information to open credit card accounts without their knowledge or approval. 

Id.

  
And most recently, in Holmes v. Elephant Insurance Company, the Fourth Circuit held 
“that the public disclosure of private information tort makes concrete the intangible harm suffered 
when information that the plaintiff would justifiably prefer to tightly control is released into the 
open.” Holmes v. Elephant Ins. Co., 

156 F.4th 413

, 425 (4th Cir. 2025), cert. dismissed, No. (R46-
15 / OT 2025), 

2026 WL 1729979

 (U.S. May 22, 2026). Nevertheless, while finding one’s private 
information on the dark web is a cognizable injury since it is analogous to the common law tort of 
public disclosure of private information, the Fourth Circuit held that any claim alleging future 
misuse of that data is not cognizable as an injury absent an allegation that the data had been 
obtained and misused by hackers. 

Id.

 at 428–29. In that respect, the Fourth Circuit held that 
plaintiffs’ claim that further future misuse was imminent was too speculative because even though 

the plaintiffs found their driver’s license numbers listed on the dark web, thereby alleging a 
cognizable injury that their private information had been disclosed, they had not alleged that their 
driver’s license numbers had been misused by the hackers, and any future harm would come from 
the intervening actions of independent malicious actors. 

Id. at 430

. The Fourth Court further 
reasoned that the plaintiffs’ alleged injuries rested on a “speculative chain of possibilities” because 
“no particular piece of personal information is guaranteed to be seen or sold” and there was the 
further link in the chain that even if the bad actor obtained the hacked driver’s license numbers, 
the hackers would need to aggregate that information with other data in order to impersonate them. 

Id. at 431

. In sum, plaintiffs’ alleged injuries would take place “only if other intervening malicious 
actors acquire[d] their driver’s license numbers from the dark web and also acquire[d] other pieces 

of their personal information and [did] so before their driver’s license numbers change[d],” and 
therefore fell “far short of establishing a ‘substantial risk’ of harm.” 

Id.

 (emphasis in original). 
Plaintiffs Beck and O’Connor assert Article III standing on the grounds that the data breach 
of Drivestream’s network inflicted six injuries-in-fact: (1) the public disclosure of private facts; 
(2) targeted scam messages and phone calls; (3) the “increased risk” of future misuse of their 
personal information by other malicious actors; (4) the lost time and effort spent trying to mitigate 
the fallout of the data breach; (5) the emotional distress and time spent monitoring their financial 
records to mitigate the likelihood of future harm; and (6) the lost benefit of the bargain. [Doc. No. 
25] at 7–17. The Court addresses each alleged injury below.               
(1) Public Disclosure of Private Facts                               
Plaintiffs’ claim that they have suffered a  concrete privacy injury is based on their 
allegation that their PII/PHI was published and sold on the dark web. [Doc. No. 25] at 9–11. The 
sole support for that claim is an allegation that “[o]n information and belief, Akira published the 

PII/PHI of Plaintiffs and Class Members on the dark web on or after January 7, 2025,” which, in 
turn, appears to be based on the letters they received from Drivestream, stating that an unauthorized 
actor accessed its systems that contained Plaintiffs’ information, and Akira’s post on the dark web 
that it was “ready to upload more than 80 GB of private corporate documents [obtained from 
Drivestream]  including:  SSNs,  family  contacts,  contact  numbers  and  e-mail  addresses  of 
employees and customers, driver licenses, passports etc.” [Doc. No. 14] ¶¶ 19–20, 34–40. But the 
relied  upon  letter  from  Drivestream  states  that  there  was  “no  indication  that  [Plaintiffs’] 
information was subject to actual or attempted misuse as a result of this incident[],” [Doc. Nos. 
14-1; 14-2]; and the Amended Complaint contains no allegation that Plaintiffs in fact located their 
private information on the dark web despite the Amended Complaint’s reference to a unique site 

on the dark web maintained by Akira which “name[s] victims and post[s] sample data to prove the 
validity of the breach.” [Doc. No. 14] ¶ 36. Plaintiffs also do not allege finding their data on this 
repository, or anywhere else. Nevertheless, they argue that they are not required “to plumb the 
dark web’s depths to find their data before they can establish standing,” [Doc. No. 25] at 10.  
The  Fourth  Circuit  made  clear  in  Holmes  that  for  the  public  disclosure  of  private 
information to constitute a concrete injury to confer standing, the plaintiffs must plausibly allege 
that their private information is “generally accessible.” Holmes, 156 F.4th at 425. In Holmes, the 
Fourth Circuit declined to find a concrete injury-in-fact for two of the named plaintiffs who, unlike 
the other plaintiffs who had alleged actually finding their driver’s license numbers listed on the 
dark web, had “not provide[d] any reason to think that their driver’s license numbers [were] now 
generally accessible, and therefore the harm allegedly suffered by those two plaintiffs “does not 
bear a close relationship to the harm addressed by the public-disclosure tort.” Id. The Plaintiffs’ 
allegation “on information and belief” that their PII/PHI has been posted on the dark web, without 

more, does not plausibly allege a concrete injury sufficient to establish standing. 
(2) Increase in Spam Text Messages and Phone Calls                   
Plaintiffs next argue that the alleged increase in spam text messages and phone calls that 
they experienced is a concrete injury. [Doc. No. 25] at 11. The Fourth Circuit has recognized that 
receiving unsolicited mail, which closely parallels the tort of loss of privacy, is a cognizable injury 
to confer standing. Garey v. James S. Farrin, P.C., 

35 F.4th 917, 922

 (4th Cir. 2022). But while 
the alleged increase in spam text messages and phone calls can similarly invade an individual’s 
privacy to constitute an injury-in-fact, Plaintiffs have not pleaded any facts that plausibly connect 
this alleged increase to Drivestream. See Lujan, 504 U.S. at 560–61. Indeed, the letters Plaintiffs 
received from Drivestream following the data breach, attached to the Complaint, do not mention 

phone numbers among the categories of information that may have been impacted by the data 
breach, See [Doc. Nos. 14-1; 14-2] (“Our investigation determined that the following type of 
information . . . may have been impacted by this incident: date of birth, Social Security number, 
financial  account  information,  and  health  insurance  information,  in  combination  with  your 
name.”). Confronting this precise scenario in Holmes, where the plaintiffs had not alleged that the 
compromised information in the data breach included cell phone numbers, the Fourth Circuit 
affirmed  the  district  court’s  determination  that  the  plaintiff  had  failed  to  adequately  allege 
traceability for his alleged injury that he experienced an uptick in spam texts and calls to his phone. 
Holmes, 156 F.4th at 420 n.3.2                                            
(3) Future Injury                                                    
Plaintiffs also argue that they “face a substantial risk of future injury stemming from the 

Data Breach, and that risk establishes a concrete injury-in-fact” to support Article III standing. 
[Doc. No. 25] at 12. In support of this claim, Plaintiffs point to their allegation that “Akira is an 
especially notorious cybercriminal group” on which the FBI released a joint report warning the 
public about Akira’s nefarious practices, which includes maintaining “a dark web leaks blog where 
they  name  victims  and  post  sample  data  to  prove  the  validity  of  the  breach,”  and  often 
“publish[ing] the data on their site which other criminals can use to exploit.” [Doc. No. 14] ¶¶ 34–
36. But while the Fourth Circuit has recognized that a future risk of injury can provide an injury 
in fact to support standing if there is a “substantial risk” of future harm, see Beck v. McDonald, 

848 F.3d at 430

, it has also made clear that Plaintiffs must plausibly allege that future misuse of 
that data is imminent. See

Holmes, 156

 F.4th at 428–29 (absent allegations that hackers actually 

obtained information from the dark web, any future harm is “speculative” and cannot supply the 
injury-in-fact needed for Article III standing).                          
Here, the Amended Complaint contains no allegation that Plaintiffs’ data was ever obtained 
by Akira or any other hacker, let alone misused by malicious actors in the one-and-a-half years 
since the data breach took place. In sum, any future injury to Plaintiffs requires the Court to take 
several inferential leaps: (1) Plaintiffs’ specific PII/PHI was actually downloaded by Akira; (2) 
Akira’s announcement on the dark web reliably indicated its intent to leak and sell data to hackers; 


2 Further undercutting the adequacy of Plaintiffs’ standing based on an “increase” in spam texts and phone calls is 
the lack of information concerning how the post-data breach level of spam texts and phone calls compared to the 
pre-breach level of spam texts and phone calls Plaintiffs had been receiving.  
(3) Plaintiffs’ specific PII/PHI was among the data actually published by Akira; (4) that data was 
sold to a hacker; and (5) a hacker actually used that information to impersonate Plaintiffs. The 
Fourth Circuit on a similar fact pattern found this precise chain of possibilities too “speculative” 
to confer standing for the alleged injury of future misuse of data, reiterating the rule that “plaintiffs 

cannot just assert that all this might happen; they must allege facts allowing us to conclude that for 
some  particular  plaintiff,  the  combined  probability  of  that  speculative  chain  materializing 
surpasses at least 33%.” 

Id.

 at 430–32 (emphasis in original) (“To be sure, hackers list personal 
information on the dark web in the hope that someone will buy it. But no particular piece of 
personal information is guaranteed to be seen or sold, just as no particular item on Craigslist or 
eBay is guaranteed to be seen or sold.”); see also Beck, 

848 F.3d at 267, 275

 (“[T]he mere theft of 
[] items, without more, cannot confer Article III standing.”). For these reasons, Plaintiffs have not 
plausibly alleged that they are at risk of an imminent injury.            
(4) Lost Time and Effort and Emotional Distress                      
Plaintiffs contend that their lost time and effort in mitigating the data breach consequences, 

and the associated emotional distress, confer standing. [Doc. No. 25] at 14–17. But these alleged 
injuries rise and fall on whether the data breach itself is a sufficiently concrete injury since the 
Fourth Circuit has held that the “lack of imminent injury prevents the plaintiffs from bootstrapping 
their way into standing for damages solely by expending time or alleging emotional distress.” 
Holmes, 156 F.4th at 428 (“We hold that if time spent and emotional distress felt are concrete 
injuries, they may serve as the sole basis for standing to recover damages only when incurred in 
response to a separate imminent harm. They do not suffice for standing on their own.”) (emphasis 
in original); Hutton, 

892 F.3d at 622

 (noting that costs incurred to mitigate or avoid future harm 
confer standing only when a substantial risk of harm exists). In sum, absent a separate concrete 
and imminent injury, neither the lost time and effort nor the emotional distress that Plaintiffs have 
allegedly experienced as a result of the data breach can confer standing on their own.  
(5) Lost Benefit of the Bargain                                      
Finally, Plaintiffs contend that they have plausibly alleged the breach of an implied contract 

to protect Plaintiffs’ PII/PHI, and therefore can establish an injury through their “lost benefit of 
the bargain.” [Doc. No. 25] at 16–17. As an initial matter, Plaintiffs do not cite, and the Court is 
not aware of any, Fourth Circuit authority on whether a plaintiff can establish standing in the data 
breach context based on the lost benefit of the bargain. However, this Court previously considered, 
and rejected, a similar theory of standing in Podroykin v. Am. Armed Forces Mut. Aid Ass’n, 
making clear that a benefit-of-the-bargain theory should be rejected “where plaintiffs have not 
alleged that the value of the goods and services they purchased was diminished as a result of the 
data breach.” 

634 F. Supp. 3d 265

, 272 (E.D. Va. 2022) (quoting Chambliss v. Carefirst, Inc., 

189 F. Supp. 3d 564, 572

 (D. Md. 2016)). The Court “rejected the proposition that an individual’s 
personal identifying information has an independent monetary value,” and further noted that “even 

courts that are willing to consider diminution in the value of PII as a basis for standing” only “do 
so when there are allegations of some concrete injury.” 

Id.

 (holding that plaintiff had failed to 
establish that his PII had been misused, let alone that the value of his PII had been diminished). 
Likewise, here, Plaintiffs do not allege any diminution in the value in their PHI/PII to confer 
standing under their lost benefit of the bargain theory. See In re Cap. One Consumer Data Sec. 
Breach Litig., 

488 F.Supp. 3d 374

, 403 (E.D. Va. 2020) (“Even assuming that Plaintiffs’ PII has 
monetary value, Plaintiffs do not allege any facts explaining how their PII became less valuable as 
a result of the breach.”) (emphasis in original). Accordingly, Plaintiffs cannot establish a concrete 
injury based on their alleged lost benefit of the bargain.                
 Stripped to their substance, Plaintiffs’ claims are based on essentially nothing more than 
the fact of a data breach into a system that contained their personal identifying information. As the 
Fourth Circuit and other courts have made clear, that fact alone is insufficient to establish Article 
III standing. 
 For the above reasons, Plaintiffs lack standing as to all Counts in the Amended Complaint, 
and the Court must dismiss the Amended Complaint for lack of jurisdiction. 
                           IV.    CONCLUSION 
 For the above reasons, it is hereby 
 ORDERED that the Motion to Dismiss be, and the same hereby is, GRANTED pursuant 
to Fed. R. Civ. P 12(b)(1) for lack of subject matter jurisdiction; and is otherwise DENIED as 
moot; and the Amended Complaint is DISMISSED. 
 The Clerk is directed to enter judgment in Defendant’s favor pursuant to Fed. R. Civ. P. 
58, forward copies of this Order to counsel of record, and close this civil action. 

Alexandria, Virginia                                         Sy 
August 21, 2026                                          Antho     renga 
                                                  United/Siptes District Judge 

                                 12