Johnson v. Cornerstone National Insurance Company<b><font color="red"> This case has been consolidated with case number 2:22-cv-04140-WJE. All filings should be docketed in THIS CASE.</font></b>
2:22-cv-04135
| W.D. Mo. | Apr 29, 2024Background
- Plaintiffs (William Johnson, Joshua Kirk, Toni Reynolds) filed a putative class action over a data breach at Cornerstone National Insurance Company impacting nearly 300,000 individuals.
- The breach was caused by unauthorized third parties accessing Cornerstone’s systems via agents’ accounts, including that of defendant Reed-Williams Insurance Agency.
- Guidewire Software provided the subscription service connecting insurance agents to Cornerstone’s database, and helped design the system.
- Plaintiffs allege defendants’ failure to secure data led to the breach, and bring claims under the federal DPPA, California statutes (CCPA, UCL), negligence, negligence per se, and breach of contract (against Guidewire only).
- Defendants moved to dismiss for failure to state a claim; Reed-Williams also challenged plaintiffs’ standing.
- The court granted/dismissed some claims, deferred others, and requested further briefing on certain statutory and common law issues.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Standing/ Injury-in-fact | Significant risk of ID theft; incurred costs counts as injury | No concrete injury; misuse not traceable to breach | Plaintiffs have standing—alleged substantial risk & incurred costs suffice |
| DPPA (Federal law) | Defendants knowingly disclosed info via system access | No knowing/voluntary disclosure—info was stolen | Dismissed—complaint fails to allege “knowing” disclosure under DPPA |
| CCPA claim against Guidewire | Guidewire “collected” info as service provider | Guidewire did not “collect” or “access” consumer data | Dismissed—no plausible allegation Guidewire was a "business" under the CCPA |
| California UCL application (extraterritoriality) | Sought to apply UCL for conduct outside CA | Reed-Williams: UCL can't apply extraterritorially; Guidewire: wrongful acts not in CA | Deferred—parties must brief extraterritorial application issue |
| Common law claims (choice of law) | Argued for Missouri law; cited multiple states | Guidewire: California law; Reed-Williams: Missouri law; both disputed which state's law applies | Deferred—parties must file supplemental briefs on choice of law |
Key Cases Cited
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (standing requirements for federal litigation)
- Spokeo, Inc. v. Robins, 578 U.S. 330 (clarifies standing elements; injury-in-fact)
- Summers v. Earth Island Inst., 555 U.S. 488 (court’s obligation to examine standing)
- Susan B. Anthony List v. Driehaus, 573 U.S. 149 (future injury and substantial risk standard for standing)
- Ashcroft v. Iqbal, 556 U.S. 662 (Rule 12(b)(6) plausibility standard)
- Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (plausibility requirement for pleadings)
- Bennett v. Spear, 520 U.S. 154 (requires “causal connection” for traceability in standing analysis)
- Sullivan v. Oracle Corp., 254 P.3d 237 (California’s presumption against extraterritorial application of state statutes)