In re SuperValu, Inc., Customer Data Security Breach Litigation
- Reporters:
- ,
- Before:
- Kelly, Loken, Colloton
In 2014, hackers accessed customer financial information from hundreds of retail grocery stores operated by SuperValu, Inc., AB Acquisition, LLC, and New Albertsons, Inc. A group of customers sued the stores. We previously affirmed dismissal of all but one of the suit‘s named plaintiffs for lack of standing. See In re SuperValu, Inc., 870 F.3d 763 (8th Cir. 2017). On remand, the district court1 dismissed the remaining plaintiff for failure to state a claim under
I
Our prior opinion summarizes the facts alleged in the consolidated amended complaint, which we accept as true. See id. at 766–67. We repeat here only the facts relevant to the instant appeal. In 2014, defendants’ grocery stores suffered two cyberattacks that allowed hackers to steal customers’ card information, including their names, credit or debit card account numbers, expiration dates, personal identification numbers, and card verification value codes. The stolen card information is distinct from the type of personally identifying information generally necessary to open a new fraudulent account, “such as social security numbers, birth dates, or driver‘s license numbers.” Id. at 770. Defendants notified customers of the first attack, which occurred in late June and early July 2014, via a press release on August 14, 2014. On September 29, 2014, they announced a second attack, which took place in late August or early September 2014. Plaintiffs allege that the two data breaches were connected and resulted from the stores’ failure to properly safeguard their customers’ personal information.
Plaintiffs then filed a motion to alter or amend the judgment under
On appeal, we affirmed the district court‘s dismissal of all of the named plaintiffs for lack of standing, except for David Holmes. We concluded that no plaintiff had alleged a prospective injury in fact because, as pleaded, the likelihood of future identity theft was purely speculative. In re SuperValu, 870 F.3d at 768–72. But we found that Holmes, the only plaintiff who alleged that he experienced an unauthorized charge to his account, had alleged a present injury in fact. Id. at 772. According to the complaint, Holmes used his credit card at a Shop ‘n Save store operated by SuperValu in Belleville, Illinois, on an unspecified date. “On
On remand, defendants renewed their motion to dismiss. A week later, plaintiffs filed a second motion for leave to amend. This time, plaintiffs included a proposed amended complaint that added general allegations about the likelihood of identity theft following a data breach. Many of these allegations were based on the same three affidavits plaintiffs had attached to their earlier
II
We first address the district court‘s denial of plaintiffs’ second motion for leave to amend. As an initial matter, the parties dispute which rules govern this motion. Defendants argue that, because the district court initially dismissed the complaint and entered judgment on January 7, 2016, plaintiffs cannot seek leave to amend their complaint unless that judgment is first set aside or vacated under
We have repeatedly explained that “[a] motion for leave to amend after dismissal is subject to different considerations than a motion prior to dismissal.” Mountain Home Flight Serv., Inc. v. Baxter Cty., 758 F.3d 1038, 1045 (8th Cir. 2014). Leave to amend should be granted liberally under
The district court‘s original dismissal constituted a final, appealable order dismissing the entire action. Plaintiffs acknowledged as much by styling their initial motion to amend as a motion under
The district court did not abuse its discretion because plaintiffs’ postjudgment motion is untimely. Plaintiffs filed their motion on November 7, 2017, a year and ten months after the district court‘s original judgment. This puts the motion well outside the 28-day limitation in
III
We review a district court‘s dismissal for failure to state a claim under
A complaint‘s factual allegations do not need to be “detailed,” but they must be “more than labels and conclusions” or “a formulaic recitation of the elements of
Determining whether Holmes‘s well-pleaded allegations are sufficient to state a plausible claim for relief requires examination of the specific causes of action that he has asserted. Holmes brings four types of claims under Illinois law: negligence, consumer protection, implied contract, and unjust enrichment. We conclude that Holmes‘s allegations fall short of stating a claim for relief under each of these four theories.
A
To state a claim for negligence under Illinois law, a complaint must allege “facts that establish the existence of a duty of care owed by the defendant to the plaintiff, a breach of that duty, and an injury proximately caused by that breach.” Marshall v. Burger King Corp., 856 N.E.2d 1048, 1053 (Ill. 2006). Holmes‘s claim is primarily premised on the view that SuperValu, as a retailer, had a duty to safeguard his credit-card information from cyberattacks. Whether a defendant owes a legal duty to the plaintiff is a question of state law. See Iseberg v. Gross, 879 N.E.2d 278, 284 (Ill. 2007). In Illinois, generally there is no affirmative duty to protect another from a criminal attack unless one of four historically recognized “special relationships” exists between the parties. See id. at 284–85.
The parties agree that the Illinois Supreme Court has not yet addressed whether a retailer has a qualifying special relationship with its customers such that it is
In the alternative, Holmes argues that his negligence claim is premised on a duty imposed by federal statute, specifically the Federal Trade Commission Act (FTCA). The FTCA gives the Federal Trade Commission the authority to, among other things, enforce against “unfair or deceptive acts or practices in or affecting commerce.”
Illinois courts have held that statutes “designed to protect human life or property” can establish the “standard of conduct required of a reasonable person” and therefore “fix the measure of legal duty” in a negligence action. Noyola v. Bd. of Educ., 688 N.E.2d 81, 84–85 (Ill. 1997). If a defendant violates such a statute, a right of action may be implied in tort if four conditions are met: (1) the plaintiff is a member of the class for whose benefit the statute was enacted, (2) the right of action
Several of these conditions are absent here. Congress empowered the Commission—and the Commission alone—to enforce the FTCA. Implying a cause of action would be inconsistent with Congress‘s anticipated enforcement scheme. Holmes points to nothing suggesting that the Commission‘s enforcement efforts have been inadequate to redress violations of the statute in this area. At least one court has expressly rejected the proposition that § 45(a) creates a duty enforceable through an Illinois negligence action. See Cmty. Bank of Trenton v. Schnuck Mkts., Inc., 210 F. Supp. 3d 1022, 1041 (S.D. Ill. 2016). Holmes cites no authority to the contrary. We conclude that Illinois is unlikely to recognize a legal duty enforceable through a negligence action arising from the FTCA. The district court‘s dismissal of this claim was proper.
B
The district court also dismissed Holmes‘s consumer-protection claims brought under the Illinois Consumer Fraud and Deceptive Business Practices Act (ICFA), the Illinois Personal Information Protection Act (PIPA), and the Illinois Uniform Deceptive Trade Practices Act (UDTPA). The only way to pursue a claim under PIPA is by satisfying ICFA‘s requirements because PIPA does not create a separate cause of action. See
A claim under ICFA requires the plaintiff to have suffered “actual damage” as a result of the defendant‘s conduct.
Holmes‘s alleged injuries—the expenditure of time monitoring his account, the single fraudulent charge to his credit card, and the effort expended replacing his card—do not constitute actual damage. The time Holmes spent protecting himself against the threat of future identity theft does not amount to an out-of-pocket loss. We previously held that the risk of future identity theft was too speculative to create standing in this case. In re SuperValu, 870 F.3d at 771. A purely speculative injury is by definition not “real and measurable” and cannot constitute actual damage. See N. Ill. Emergency Physicians v. Landau, Omahana & Kopka, Ltd., 837 N.E.2d 99, 107 (Ill. 2005) (“Where the mere possibility of harm exists or damages are otherwise speculative, actual damages are absent . . . .“).
Holmes does not directly allege that the fraudulent charge to his credit card resulted in any pecuniary loss. Instead, he asserts that we must presume that he was required to pay the fraudulent charge even though he has not directly alleged that fact. As the nonmovant, Holmes is entitled to the benefit of all reasonable inferences that may be drawn from the complaint‘s allegations. Martin v. Iowa, 752 F.3d 725, 727 (8th Cir. 2014). But the inference Holmes seeks is not a reasonable one. The complaint alleges that Holmes “immediately” reported the suspicious charge and was issued a new credit card. In such a situation, federal law and card-issuer contracts ordinarily absolve the consumer from any obligation to pay the fraudulent charge. See Schnuck Mkts., 887 F.3d at 807. Holmes asks us to draw from his conspicuous omission an inference that runs counter to established law and common experience.
We also reject Holmes‘s argument that the collateral source doctrine saves his ICFA claim‘s failure to allege pecuniary loss. “Under the collateral source rule, benefits received by the injured party from a source wholly independent of, and collateral to, the tortfeasor will not diminish damages otherwise recoverable from the tortfeasor.” Wills v. Foster, 892 N.E.2d 1018, 1022 (Ill. 2008) (quoting Arthur v. Catour, 833 N.E.2d 847, 851 (Ill. 2005)). The rule is ordinarily applied in negligence actions where the injured party obtains benefits from an external source, such as an insurance policy. The justification for the rule is that “the wrongdoer should not benefit from the expenditures made by the injured party or take advantage of contracts or other relations that may exist between the injured party and third persons.” Id. at 1030 (emphasis removed) (quoting Arthur, 833 N.E.2d at 852).
Holmes cites no case applying the doctrine to an ICFA claim and we are skeptical that the Illinois Supreme Court would find it applicable to these circumstances. If Holmes was indemnified from any liability arising from the suspicious charge, it was through operation of federal law and his contract with the financial institution that issued his card. That contract is connected to SuperValu through a network of other agreements. See generally Schnuck Mkts., 887 F.3d at 807–09. Under those agreements, card-issuing banks generally bear the initial cost of “indemnifying their customers for unauthorized transactions and issuing new cards,” but may seek to recoup losses from retailers through a cost recovery process. Id. at 809. Holmes‘s indemnity was not “wholly independent” from the alleged tortfeasor; it was an integral component of the card payment system that allowed him to shop at the affected store in the first place. Because his indemnity came from “a source related to [SuperValu] through contract,” the collateral source doctrine does
We conclude that Holmes‘s UDTPA claim also fails. The only remedy available for a UDTPA claim is injunctive relief. See Glazewski v. Coronet Ins. Co., 483 N.E.2d 1263, 1267 (Ill. 1985). To obtain an injunction, Holmes must show that he is “likely to be damaged” by SuperValu‘s practices in the future.
C
The district court properly dismissed Holmes‘s claim for breach of an implied contract. We previously held that “the complaint does not sufficiently allege that plaintiffs were party to [an implied] contract” with SuperValu, id. at 771 n.6; therefore it does not state a plausible implied-contract claim.
D
Holmes‘s remaining claim is for unjust enrichment. To state a claim of unjust enrichment in Illinois, “a plaintiff must allege that the defendant has unjustly retained a benefit to the plaintiff‘s detriment, and that defendant‘s retention of the benefit violates the fundamental principles of justice, equity, and good conscience.” HPI Health Care Servs., Inc. v. Mt. Vernon Hosp., Inc., 545 N.E.2d 672, 679 (Ill. 1989). According to the complaint, the benefit that SuperValu unjustly retained is the money that Holmes expended on his groceries. Holmes alleges that SuperValu‘s inadequate security practices resulted in an unreasonable delay between the time that the data breaches occurred and the time that the public was notified of the attacks. Had
Common sense counsels against the viability of Holmes‘s theory of unjust enrichment. Holmes paid for groceries, the price of which would have been the same whether he paid with cash or a credit card. He did not pay a premium “for a side order of data security and protection.” Irwin v. Jimmy John‘s Franchise, LLC, 175 F. Supp. 3d 1064, 1072 (C.D. Ill. 2016) (applying Arizona law). Because Holmes does not allege that any specific portion of his payment went toward data protection, he has not alleged a benefit conferred in exchange for protection of his personal information nor has he shown how SuperValu‘s retention of his payment would be inequitable. Carlsen v. GameStop, Inc., 833 F.3d 903, 912 (8th Cir. 2016) (applying Minnesota law). We therefore conclude that Holmes has failed to state a plausible claim of unjust enrichment.
IV
The district court properly denied plaintiffs’ motion for leave to amend their complaint and properly dismissed Holmes‘s claims under