Holmes v. Elephant Insurance Company FILE IN THIS CASE ONLY, 3:22-cv-00487

Background

In May 2022 Elephant Insurance disclosed a network Data Breach in which unauthorized actors viewed or copied customers' personal information, including names, driver's license numbers, and dates of birth.
The consolidated complaint names four plaintiffs (Holmes, Bias, Cardenas, Shaw) who were current, prior, or prospective Elephant customers whose PI was exposed via an auto-quote tool.
Plaintiffs asserted eight claims: Drivers' Privacy Protection Act, negligence, negligence per se, unjust enrichment, Texas Consumer Protection Act, Illinois Consumer Fraud Act, Illinois Deceptive Trade Practices Act, and requests for declaratory and injunctive relief.
Elephant moved to dismiss under Fed. R. Civ. P. 12(b)(1) for lack of Article III standing and under 12(b)(6) for failure to state a claim; the court focused on standing.
The court held that mere exposure of PI, absent concrete misuse or a non-speculative, imminent risk of identity theft, does not constitute an injury-in-fact for monetary or injunctive relief and dismissed the complaint for lack of standing.

Issues

Issue	Plaintiff's Argument	Defendant's Argument	Held
Whether plaintiffs allege an injury-in-fact sufficient for Article III standing to pursue monetary damages	Exposure of PI creates heightened risk of identity theft, loss of privacy, emotional distress, diminution in value of PI, and costs/time spent monitoring accounts	Mere compromise of data without concrete misuse or certainly impending harm is not a cognizable Article III injury	Majority: Heightened risk, emotional distress, diminished PI value, and mitigative efforts are speculative and do not establish injury-in-fact for three plaintiffs; only Holmes alleged plausible loss of privacy but other defects remained
Whether alleged identity theft (driver's license numbers on dark web) establishes injury-in-fact	Dark-web appearance of license numbers shows actual identity theft risk and misuse	License numbers alone, without alleged misuse or accompanying PI, are insufficient; value arises only when combined into a "fullz" and actually misused	Court: Two plaintiffs reported license numbers on dark web but pleaded no misuse or resulting harm; allegations track a speculative risk and fail to show injury-in-fact
Whether Holmes' asserted loss of privacy (spam texts/calls) is traceable to Elephant (causation/traceability)	Holmes attributes uptick in spam calls/texts to the Data Breach and seeks damages	Plaintiff must plausibly allege that Defendant's breach caused the spam; no allegation that breach exposed phone numbers or that downstream actors linked the breach to the spam	Court: Holmes adequately pleaded loss-of-privacy injury but failed to plausibly trace the spam to Elephant, so lacks standing for damages
Whether plaintiffs may seek declaratory and injunctive relief absent imminent and substantial risk of future harm	Plaintiffs seek an order requiring enhanced security because the risk of another breach is real, immediate, and substantial	An injunction requires a sufficiently imminent and substantial risk of future harm; conclusory allegations are insufficient	Court: Plaintiffs' conclusory claims of future risk are inadequate; they lack standing for injunctive or declaratory relief

Key Cases Cited

Spokeo, Inc. v. Robins, 578 U.S. 330 (U.S. 2016) (Article III requires a concrete injury even for statutory violations)
Lujan v. Defenders of Wildlife, 504 U.S. 555 (U.S. 1992) (three standing elements: injury-in-fact, causation, redressability)
TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (U.S. 2021) (statutory harms must resemble historical common-law injuries to satisfy concreteness)
Clapper v. Amnesty Int'l USA, 568 U.S. 398 (U.S. 2013) (threatened injury must be certainly impending; speculative chains of possibility fail)
Beck v. McDonald, 848 F.3d 262 (4th Cir. 2017) (data-breach plaintiffs must plead a nonspeculative, increased risk of identity theft; mitigative costs alone do not confer standing)
Hutton v. Nat'l Bd. of Exam'rs in Optometry, Inc., 892 F.3d 613 (4th Cir. 2018) (mere compromise of PI, without more, fails to establish injury-in-fact absent identity theft)
Garey v. Farrin, 35 F.4th 917 (4th Cir. 2022) (loss of privacy can be a cognizable injury where facts resemble recognized privacy torts)
O'Leary v. TrustedID, Inc., 60 F.4th 240 (4th Cir. 2023) (reiterating that a data breach alone is insufficient to establish Article III standing)