Cabezas v. Mr. Cooper Group Inc, 3:23-cv-02453

Background

Plaintiffs, a putative class of Mr. Cooper Group Inc. customers, allege their personal identifying information (PII) was compromised in an October 2023 ransomware cyberattack that exposed sensitive data for over 14 million individuals.
Plaintiffs assert their PII (including names, Social Security numbers, bank account info) was accessed, exfiltrated, and is now believed to be available on the dark web, resulting in identity theft, fraud, and increased spam communications.
Plaintiffs allege direct damages (fraudulent transactions, theft, credit issues) and indirect damages (time spent, emotional distress) tied to the breach and Mr. Cooper’s alleged cybersecurity failures.
Defendants moved to dismiss, arguing lack of standing and failure to state a claim on various causes of action (breach of contract, negligence, unjust enrichment, invasion of privacy, breach of confidence, among others).
The Court assessed Article III standing in the data breach context, applied the McMorris factor test from the Second Circuit, and addressed Texas causes of action and defenses.

Issues

Issue	Plaintiff's Argument	Defendant's Argument	Held
Standing (injury-in-fact from data breach)	Direct and imminent risk of harm from data theft, actual misuse of PII, emotional distress, mitigation costs	Harms are speculative, no actual misuse or theft linked to breach	Plaintiffs have standing—concrete injury and risk of harm established
Breach of Express Contract	Mr. Cooper’s Privacy Policy forms an enforceable contract for data protection	Privacy policy is not a binding contract, but only a statement of policy	Dismissed: Privacy policy is not an enforceable contract
Breach of Implied Contract	Agreement for services implied promise to safeguard PII	Plaintiffs’ contracts are with mortgage originators; no implied contract exists	Motion to dismiss denied: Sufficiently alleged implied contract to safeguard PII
Negligence	Mr. Cooper owed and breached duty to safeguard PII, leading to damages	No special duty exists to protect customer PII from criminal acts; economic loss rule bars tort	Motion to dismiss denied: Sufficiently alleged duty, breach, causation, and damages outside economic loss rule
Unjust Enrichment	Defendants benefited by saving on data security and using PII for marketing	No unjust enrichment—Plaintiffs didn’t pay specifically for data security; benefit not unjust	Dismissed: Elements of unjust enrichment not met
Invasion of Privacy	Negligent security was intrusion on seclusion	Must be intentional, not mere negligence	Dismissed: No intentional intrusion alleged
Breach of Confidence	Defendants breached duty to keep PII confidential	Breach of confidence only applies to trade secrets	Dismissed: Not actionable for non-trade-secret information
State law & negligence per se claims	Should proceed, law varies by state	Should be dismissed for same reasons as above	Deferred: Decision postponed until class certification
Standing for injunctive relief	Need court order to mandate better data security	Risk of future breach is too speculative	No standing for injunctive relief on speculative future harm

Key Cases Cited

Ashcroft v. Iqbal, 556 U.S. 662 (discusses pleading standard for plausible claims)
Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (establishes heightened pleading standard)
Summers v. Earth Island Inst., 555 U.S. 488 (injury-in-fact requirement for standing)
Simon v. Eastern Ky. Welfare Rts. Org., 426 U.S. 26 (causation requirement for standing)
Lujan v. Defenders of Wildlife, 504 U.S. 555 (redressability and constitutional requirements for standing)
TransUnion LLC v. Ramirez, 594 U.S. 413 (risk of future harm and concrete injury in data privacy)
Smith Int’l, Inc. v. Egle Grp., LLC, 490 F.3d 380 (elements of breach of contract under Texas law)
W. Invs., Inc. v. Urena, 162 S.W.3d 547 (elements of negligence under Texas law)
Chapman Custom Homes, Inc. v. Dallas Plumbing Co., 445 S.W.3d 716 (economic loss rule for tort and contract)