Angus v. Flagstar Bank, FSB
2:21-cv-10657
| E.D. Mich. | Mar 27, 2025Background
- Plaintiffs, customers and employees of Flagstar Bank, allege that a 2021 data breach resulted in the exposure of personally identifiable information (PII) of over 1.4 million people when files were posted on the dark web.
- Plaintiffs claim Flagstar's continued use of a near-obsolete file sharing platform (Accellion FTA) was negligent and reckless despite warnings to discontinue it.
- Plaintiffs assert multiple common law and statutory claims under Michigan law and various state consumer protection statutes.
- Defendant Flagstar filed a motion to dismiss the Fourth Amended Complaint under FRCP 12(b)(6), challenging most claims as insufficiently pleaded.
- Court ruled on some issues at a hearing and took others under advisement, issuing this order to memorialize and supplement oral rulings.
- The case is at the motion to dismiss stage; the class status and merits of certain claims remain unresolved.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Negligence (MI) | Flagstar failed reasonable care in safeguarding PII | Not a cognizable claim under MI law for data breach | Dismissed |
| Breach of implied-in-fact contract | Flagstar contractually obligated to secure PII | No contract or consideration alleged | Not dismissed |
| Invasion of privacy: Intrusion upon seclusion | Inadequate security constitutes actionable intrusion | No intentional or reckless intrusion alleged | Dismissed |
| Invasion of privacy: Public disclosure of private facts | Reckless conduct warrants liability | No intentional public disclosure by Flagstar | Not dismissed; resolved at summary judgment |
| Breach of confidence | Flagstar disclosed confidential info unreasonably | No special relationship giving rise to such duty | Not dismissed |
| Unjust enrichment | Value conferred on Flagstar by PII retention | No inequitable benefit received | Dismissed |
| NJ Consumer Fraud Act | Unconscionable commercial practice/fraudulent omission | Acts not related to sale/advertisement, no intent pled | Dismissed |
| IN Deceptive Consumer Sales Act | Intentional misrepresentation during transaction | No intent or reliance pleaded | Dismissed |
| PA Unfair Trade Practices Act | Deceptive acts in connection with mortgage refinancing | No justifiable reliance alleged | Dismissed |
| MI Consumer Protection Act | Misrepresentations/omissions/material facts/Identity Theft | No reliance, no basis for omission claim | Dismissed |
| CA statutory claims (UCL, CCPA, CCRA) | Flagstar violated CA privacy statutes | Multiple complex arguments raised | Not decided, further briefing allowed |
Key Cases Cited
- Ashcroft v. Iqbal, 556 U.S. 662 (pleading standard for plausibility)
- Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (pleading requirement of factual content)
- Dix v. American Bankers Life Assurance Co. of Florida, 415 N.W.2d 206 (class actions under MCPA reliance requirement)
- Cox v. Sears Roebuck & Co., 647 A.2d 454 (liberal construction of NJCFA)
- Roberts v. Auto-Owners Ins. Co., 374 N.W.2d 905 (recklessness may satisfy intent in some MI torts)
- Beaumont v. Brown, 257 N.W.2d 522 (disclosure to "particular public" sufficient for public disclosure of private facts)
- D’Agostino v. Maldonado, 78 A.3d 527 (NJCFA's scope in sales/advertising context)