523 F.Supp.3d 464
S.D.N.Y.2021Background
- On April 1, 2019, hackers breached Mediant Communications’ email/server environment and stole personal information for over 200,000 individuals, including the named plaintiffs.
- Mediant provided investor/ proxy communication services and received plaintiffs’ data in the course of providing those services.
- Donnelley Financial Solutions (Donnelley) and Mediant marketed themselves as a joint or “perfect partnership” for proxy services; Donnelley contracted directly with certain funds in which the named plaintiffs invested.
- Plaintiffs allege Donnelley failed to supervise Mediant’s cybersecurity, failed to ensure adequate security, and failed to timely disclose the breach; they assert negligence, negligence per se, breach of contract (as third‑party beneficiaries), unjust enrichment, declaratory relief, and state‑law claims.
- Defendants moved to dismiss under Fed. R. Civ. P. 12(b)(1), arguing plaintiffs lack Article III standing because their injuries are not fairly traceable to Donnelley (and that Mediant cannot be party to breach claims without a contractual relationship or partnership).
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Standing: Are plaintiffs’ injuries fairly traceable to Donnelley? | Donnelley contracted with funds, provided data to Mediant, failed to supervise security and to timely disclose the breach — linking Donnelley to plaintiffs’ injury. | Donnelley says intervening acts by Mediant break traceability unless plaintiffs plead Donnelley was a partner or had coercive/determinative control over Mediant. | Denied dismissal: at pleading stage allegations suffice to show injury is fairly traceable to Donnelley; intervening acts do not defeat standing here. |
| Must plaintiffs plead a legal partnership to establish standing/vicarious liability? | Plaintiffs allege a partnership and direct oversight authority. | Donnelley contends plaintiffs must plead all elements of a legal partnership to hold Donnelley liable/traceable. | Court: partnership is a merits question; not required to plead full partnership elements to establish Article III standing. |
| Standing to sue for breach of contract as third‑party beneficiaries (against Mediant and Donnelley)? | Plaintiffs allege specific contracts with Donnelley (and in some instances Mediant), provisions requiring protection of investor data, and that contracts were intended to benefit investors (alleged on information and belief). | Mediant argues no contract with plaintiffs and that "information and belief" allegations are insufficient to plead third‑party beneficiary status. | Denied dismissal: allegations (including those on information and belief) are adequate at the pleading stage because contract terms are within defendants’ control. |
| Proper pleading standard on a Rule 12(b)(1) facial standing challenge | Plaintiffs: pleading‑stage traceability standard is modest (possible/de‑facto causality), lower than proximate cause. | Defendants urge a higher causation standard (akin to proximate cause or determinative/coercive effect). | Court: applies the lower, pleading‑stage standard; traceability requires less than proximate cause and defendants’ proposed heightened standard is rejected. |
Key Cases Cited
- Carter v. Healthport Techs., LLC, 822 F.3d 47 (2d Cir. 2016) (pleading‑stage standing standard; accept general factual allegations and draw reasonable inferences)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (U.S. 1992) (Article III standing fundamentals)
- Spokeo, Inc. v. Robbins, 136 S. Ct. 1540 (U.S. 2016) (plaintiff bears burden to establish standing elements)
- Rothstein v. UBS AG, 708 F.3d 82 (2d Cir. 2013) (traceability is a lesser burden than proximate cause; intervening causes do not automatically defeat standing)
- Bennett v. Spear, 520 U.S. 154 (U.S. 1997) (injury produced by a defendant’s determinative or coercive effect on a third party can establish causation)
- Simon v. Eastern Kentucky Welfare Rights Org., 426 U.S. 26 (U.S. 1976) (standing defeat where causation rests on pure speculation about third‑party actions)
- U.S. Dep’t of Commerce v. New York, 139 S. Ct. 2551 (U.S. 2019) (distinction between legal cause and traceability/de‑facto causality)
- Carver v. City of New York, 621 F.3d 221 (2d Cir. 2010) (analyzing degree to which defendant constrained or influenced third‑party decision)
- Warth v. Seldin, 422 U.S. 490 (U.S. 1975) (standing is threshold question; complainant must clearly allege facts showing proper party to invoke judicial resolution)
- Arista Recs., LLC v. Doe 3, 604 F.3d 110 (2d Cir. 2010) (permitting "information and belief" allegations when facts lie peculiarly within defendant’s control)