In re Target Corp. Customer Data Security Breach Litigation, 2014 U.S. Dist. LEXIS 175768

Background

Massive 2013 Target data breach compromised payment-card and personal data of ~110 million customers; putative class consists of consumers who used cards at Target during the breach period and allegedly suffered unauthorized charges, fees, monitoring costs, and loss of account access.
Judicial Panel consolidated related federal suits into MDL with separate tracks for financial institutions and consumers; this opinion addresses Target’s Rule 12(b)(6) motion to dismiss the Consumer Plaintiffs’ First Amended Consolidated Class Action Complaint.
Plaintiffs plead seven counts: (I) state consumer-protection statutes (49 states + D.C.), (II) state data-breach notice statutes (38 states), (III) negligence, (IV) breach of implied contract (non-REDcard users), (V) breach of contract (REDcard users), (VI) bailment, and (VII) unjust enrichment.
Target argued pervasive pleading defects: lack of Article III standing, insufficient particularity for omission-based consumer claims, absence of private rights of action/enforcement under many state statutes, economic-loss rule barring negligence, failure to plead contract terms, and no basis for bailment or unjust-enrichment theories.
The court applied Twombly/Iqbal plausibility standards, treated factual allegations as true at this stage, and granted dismissal in part and denial in part—dismissing specific statutory claims and causes of action while allowing most claims to proceed to discovery.

Issues

Issue	Plaintiff's Argument	Defendant's Argument	Held
Article III standing (injury)	Plaintiffs allege concrete injuries (unauthorized charges, fees, account access loss) fairly traceable to Target.	Plaintiffs lack actual or imminent injury; many claims speculative or reimbursed.	Plaintiffs plausibly allege injury at motion-to-dismiss stage; standing survives.
Standing to assert other states’ laws	114 named plaintiffs reside in most states; standing challenges premature until class certification.	Claims for states with no named plaintiffs (DE, ME, RI, WY, D.C.) should be dismissed now.	Court defers standing-of-named-plaintiffs issue until after class-certification; not dismissed now.
Injunctive-relief standing	Plaintiffs allege future risk and seek remedial measures (encryption, EMV, monitoring).	Plaintiffs lack certainly-impending threat required for injunctive relief.	Allegations suffice at pleading stage; injunctive-relief standing upheld pending discovery.
Consumer-protection (omission and injury)	Target failed to maintain/security, failed to disclose inadequate safeguards and delayed notice; plaintiffs suffered pecuniary and other cognizable injuries.	Many states require ascertainable/pecuniary loss; omissions require duty to disclose; Rule 9(b) pleading required.	Court finds plaintiffs plausibly alleged injury and duty; denies dismissal for most states but dismisses claims under DE UDTPA, OK DTPA, and WI statute; class action barred in several states per Shady Grove analysis.
Class action availability under state statutes	Class treatment appropriate for many states; Rule 23 governs.	Some state consumer statutes expressly prohibit class actions or otherwise bar class treatment.	Applying the controlling Shady Grove plurality/concurrence analysis, class actions are barred for eight named states and Utah; Ohio issue denied dismissal at this stage.
Data-breach notice statutes (private right & enforcement)	Plaintiffs pursue claims under 38 states’ notice statutes, sometimes via consumer-protection statutes where statutes allow.	Many statutes provide only AG/government enforcement or are silent; no private right in numerous states.	Court dismisses claims where statutes clearly limit enforcement to AG/government (e.g., AR, CT, ID, MA, MN, NE, NV, TX) and RI (no private right); allows claims to proceed in 26 states where private enforcement is plausible.
Negligence and economic-loss rule	Plaintiffs allege duties to safeguard data and to timely disclose; seek damages from misuse and delayed notice.	Economic-loss doctrine in many states bars tort recovery for purely economic loss; negligence damages insufficiently pleaded.	Negligence claims survive generally, but are dismissed with prejudice in AK, CA, IL, IA, and MA where economic-loss rule applies as interpreted. Other states’ negligence claims proceed.
Breach of implied contract	Plaintiffs allege an implied term that Target would protect payment data when customers used cards.	No meeting of the minds or enforceable implied term; dismissal warranted.	Court finds implied-contract issue factual and plausible; claim survives.
Breach of express REDcard contract (Count V)	REDcard plaintiffs allege Target promised to use security measures complying with federal law.	Complaint fails to specify which federal law was breached; no breach pleaded.	Breach-of-contract claim dismissed without prejudice; leave to amend in 30 days to plead the specific federal standard.
Bailment	Plaintiffs treat personal data as bailment property; Target had duty to return.	No agreement to return data; theft by third parties not improper retention by Target.	Bailment claim dismissed with prejudice.
Unjust enrichment	Overcharge theory (shoppers paid premium for security) and "would-not-have-shopped" theory.	Overcharge implausible because Target charges same prices regardless of payment method.	Overcharge theory dismissed; "would-not-have-shopped" theory survives as plausible.

Key Cases Cited

Lujan v. Defenders of Wildlife, 504 U.S. 555 (standing requires concrete, particularized, actual or imminent injury)
Bell Atl. Corp. v. Twombly, 550 U.S. 544 (complaint must state a plausible claim for relief)
Ashcroft v. Iqbal, 556 U.S. 662 (conclusory allegations insufficient under Twombly standard)
Shady Grove Orthopedic Assocs. v. Allstate Ins. Co., 559 U.S. 393 (Rule 23 v. state law conflict; plurality and controlling concurrence on class-action preclusion)
Whitmore v. Arkansas, 495 U.S. 149 (standing at motion-to-dismiss stage can be satisfied by attenuated allegations)
United States v. SCRAP, 412 U.S. 669 (standing allegations sufficient at pleading stage for some attenuated injuries)
In re TJX Cos. Retail Sec. Breach Litig., 564 F.3d 489 (data-breach negligence dismissed under economic-loss analysis in that circuit context)
Sovereign Bank v. BJ's Wholesale Club, 533 F.3d 162 (economic-loss rule barred negligence claims in a data-breach case)
Anderson v. Hannaford Bros. Co., 659 F.3d 151 (implied-contract theory in data-breach MDL survived as factual question)