662 F.Supp.3d 338
N.D.N.Y.2023Background
- Miller, a Syracuse University student, sued after a September 2020 phishing-related data breach that exposed sensitive information (including Social Security numbers) of roughly 9,800–9,865 people; notices were sent in Feb. 2021.
- Miller filed a putative class action in New York state court alleging negligence, breach of express and implied contract, violations of N.Y. Gen. Bus. Law §§ 899-aa and 349, and a request for injunctive relief; defendant removed under CAFA.
- Syracuse moved to dismiss under Fed. R. Civ. P. 12(b)(6) and (in briefing) cast doubt on Article III standing, prompting the Court to order supplemental briefing on standing and jurisdiction.
- The Court found Miller has Article III standing (concrete injury from disclosure analogous to public-disclosure tort; attempted bank fraud and exposure support risk/imminence) and that CAFA jurisdiction exists (numerosity, minimal diversity, >$5M amount-in-controversy; mandatory exception not triggered).
- On the merits the Court: dismissed Miller’s GBL § 899-aa claim (no private right of action) and dismissed the independent CPLR § 6301 injunction claim (state procedural vehicle), but denied dismissal of negligence, breach of express and implied contract, and GBL § 349 claims and preserved Miller’s ability to seek federal injunctive relief under Rule 65.
Issues
| Issue | Miller's Argument | Syracuse's Argument | Held |
|---|---|---|---|
| Article III standing (monetary & injunctive relief) | Exposure of SSN and other PII, an attempted fraudulent charge, mitigation costs and ongoing risk show concrete, traceable, redressable injury and imminent risk for injunction | Breach-related harms speculative; relied on cases dismissing similar claims for lack of standing | Court held Miller has standing: disclosure is a concrete, intangible injury; attempted fraud + McMorris factors support imminence; injunctive relief plausible because of realistic threat of repeat breach |
| CAFA jurisdiction | (no remand motion) | Removal proper: >100 class members, minimal diversity, >$5M; mandatory CAFA exception not met | Court found CAFA jurisdiction satisfied and declined remand |
| GBL § 899-aa private right of action | Delay in notice violated statute and caused damages | Statute grants AG enforcement and prescribes remedies; courts have held no private right | Court dismissed § 899-aa claim for lack of an implied private right |
| Sufficiency of pleaded damages (12(b)(6)) | Alleged concrete harms: disclosure, mitigation costs, lost time, diminished value, benefit-of-the-bargain, delay-related losses | Plaintiffs failed to plead cognizable damages across claims | Court refused to dismiss on aggregate damages theory; movant must target defects claim-by-claim; denial on aggregate challenge |
| Negligence / economic-loss doctrine | Alleged non-speculative injuries tied to breach; negligence actionable | Economic-loss doctrine bars tort recovery for purely economic harm | Court declined to apply economic-loss bar in data-breach context; negligence claim survives |
| Injunctive relief (CPLR § 6301 vs. federal injunctive relief) | Seeks order compelling industry-standard cybersecurity | No irreparable injury; adequate remedy at law; CPLR 6301 is state procedure | Court dismissed independent CPLR § 6301 claim (federal court cannot grant CPLR relief) but preserved ability to seek injunctive relief under federal law and Rule 65; denied dismissal now |
Key Cases Cited
- Spokeo, Inc. v. Robins, 578 U.S. 330 (2016) (Article III standing: injury must be concrete and particularized)
- TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (2021) (concrete-harm requirement and limits on speculative future-risk injuries)
- McMorris v. Carlos Lopez & Assocs., LLC, 995 F.3d 295 (2d Cir. 2021) (three-factor test for assessing substantial risk of identity theft after data exposure)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) (standing elements: injury in fact, traceability, redressability)
- Blockbuster, Inc. v. Galeno, 472 F.3d 53 (2d Cir. 2006) (procedures for assessing CAFA prerequisites at removal)
- Dart Cherokee Basin Operating Co. v. Owens, 574 U.S. 81 (2014) (defendant’s notice need only plausibly allege amount in controversy on removal)
- Sackin v. TransPerfect Global, Inc., 278 F. Supp. 3d 739 (S.D.N.Y. 2017) (data-breach context: breach-of-contract and implied-contract analyses; discussion of economic-loss doctrine)