Stern v. Academy Mortgage Corporation
2:24-cv-00015
| D. Utah | Jan 17, 2025Background
- Academy Mortgage Corporation suffered a significant data breach in March 2023, allegedly associated with the ransomware group BlackCat, exposing the personally identifiable information (PII) of approximately 284,443 individuals.
- Plaintiffs, comprising former customers and a former employee, filed a class action alleging various state law claims (negligence, breach of implied contract, unjust enrichment, etc.) and seeking monetary and injunctive relief.
- The court consolidated several related actions and addressed the Amended Complaint following Academy's motion to dismiss under Rules 12(b)(1) (lack of standing) and 12(b)(6).
- Plaintiffs claimed injuries including diminished PII value, increased risk, emotional harm, mitigation costs, and actual identity theft (for one plaintiff).
- The decision focused on whether plaintiffs had Article III standing, particularly whether they alleged an actual or imminent injury fairly traceable to Academy's conduct.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Injury-in-fact (Standing) | Suffered concrete harm/crime risk due to data breach and PII exposure | No actual misuse or imminent risk, only speculative harm | No standing, harm not concrete/particularized |
| Traceability of Injury to Data Breach | Identity theft of Smith occurred after the breach, breach caused injuries | No plausible allegation breach caused Smith's ID theft; no actual misuse of PII shown | No traceable causal connection; no standing |
| Risk of Future Harm/Fraud as Injury | Substantial risk of identity theft/fraud provides standing | Risk is speculative; PII has not been released or misused | Speculative risk isn't sufficient for standing |
| Mitigation Efforts/Time Spent as Injury | Time/effort to mitigate risk are actionable injuries | Voluntary actions responding to hypothetical harm do not confer standing | Expenditures based on hypothetical harm do not confer standing |
Key Cases Cited
- Spokeo, Inc. v. Robins, 578 U.S. 330 (standing requires concrete and particularized injury)
- Lujan v. Defs. of Wildlife, 504 U.S. 555 (plaintiff must show injury is fairly traceable to defendant’s conduct and is redressable)
- Clapper v. Amnesty Int’l USA, 568 U.S. 398 (allegations of possible future injury are insufficient for standing)
- TransUnion LLC v. Ramirez, 594 U.S. 413 (risk of future harm must be material and imminent for standing)