MEMORANDUM OPINION
This case comes before the Court on the motion of Defendant Michaels Stores, Inc. (“Michaels”) to dismiss the Consolidated Amended Class Action Complaint (the “Complaint”) pursuant to Federal Rule of Civil Procedure 12(b)(6). For the reasons stated below, the motion is granted in part and denied in part.
BACKGROUND
Michaels is a specialty arts and crafts retailer. Like many other retailers, Michaels uses PIN pads to process customers’ debit and credit card payments. To make a debit or credit card purchase through a PIN pad, a cardholder swipes his or her card through the PIN pad and, if necessary, inputs a personal identification number (“PIN”). A properly operating PIN pad encrypts the сardholder’s PIN, temporarily stores the encrypted PIN, and transmits the information to a transaction manager, card company, or bank for verification.
“Skimming” is the unauthorized capture of debit and/or credit card data by unauthorized persons, often referred to as “skimmers.” Skimmers use the information in a number of illegal ways, including selling the information or creating a fraudulent duplicate card. One method skimmers use to obtain debit and credit card information from retail stores is referred to as “PIN pad swapping.” Using this
Michaels accepts customer payments for purchases through credit and debit cards issued by members of the payment card industry (“PCI”), such as Visa USA (‘Visa”). Some card issuers, like Visa, contractually obligate merchants, like Michaels, to comply with various PIN pad security standards that protect customer financial information as a condition to processing transactions through the card issuer. In 2005, Visa issued a global mandate (‘Visa’s Global Mandate”) that required merchants to discontinue the use of PIN pad terminals that do not meet the Triple Data Encryption Standаrd by July 1, 2010. Visa also required merchants to implement certain operating regulations to protect the security of cardholder information (the “PCI PIN Security Requirements”). Among numerous other requirements, the PCI PIN Security Requirements direct merchants to ensure that a legitimate device has not been substituted with a counterfeit device. In 2006, Visa and other PCI members established the Security Standards Council (“PCI SSC”), which has developed stringent standards for PIN pad terminals. Additionally, PCI SSC, PIN pad manufacturers, and credit card processors have developed and implemented a series of best practices for merchants to prevent or identify instances of skimming, including PIN pad swapping.
On May 4, 2011, Michaels reported that PIN pad tampering may have occurred in its Chicago area stores. Michaels later revealed that between February 8, 2011, and May 6, 2011, skimmers placed approximately ninety tampered PIN pads in eighty Michaels stores across twenty states. At the time of the security breaches, Michaels was not in compliance with Visa’s Global Mandate or the PCI PIN Security Requirements.
On July 8, 2011, Plaintiffs Mary Allen, Kelly M. Maucieri, Brandi Ramundo, and Adrianna Sierra (collectively, “Plaintiffs”) filed the Complaint against Michaels individually and on behalf of all consumers whose financial information was stolen from Michaels. Plaintiffs allege that Michaels failed to adequately protect their financial information and failed tо promptly and properly notify consumers of the security breach. Plaintiffs further allege that the data breach resulted in unauthorized withdrawals from their bank accounts and/or bank fees. Plaintiffs assert claims under the Stored Communications Act, 18 U.S.C. § 2702, and the Illinois Consumer Fraud and Deceptive Business Practices Act, 815 111. Comp. Stat. 505/1, and for negligence, negligence per se, and breach of implied contract. Michaels now moves to dismiss the Complaint.
LEGAL STANDARD
A pleading must contain “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R.Civ.P. 8(a)(2). Rule 8 does not require detailed factual allegations, but requires more than legal conclusions or a formulaic recitation of the elements of a cause of action. Bell Atl. Corp. v. Twombly,
DISCUSSION
1. Stored Communications Act
The Stored Communications Act (“SCA”) states that “a person or entity providing an electronic communication service to the public shall not knowingly divulge to any person or entity the contents of a communiсation while in electronic storage by that service.” 18 U.S.C. § 2702(a)(1). The SCA further states that “a person or entity providing remote computing sexvice to the public shall not knowingly divulge to any person or entity the contents of any communication which is carried or maintained on that service.” 18 U.S.C. § 2702(a)(2). Michaels argues that the SCA does not apply because it does not provide electronic communication services or remote computing services.
A. Electronic Communication Services
The first issue is whether Michaels provides electronic communication sexvices under the SCA. An “electronic communication sexvice” is “any sexvice which provides to users the ability to send or receive wire or electrоnic communications.” 18 U.S.C. §§ 2510(15), 2711(1). According to the SCA’s legislative history, telephone companies and electronic mail companies provide electronic communication sexvices. S.Rep. No. 99-541 (1986), reprinted in 1986 U.S.C.C.A.N. 3555, 3558. Since the enactment of the SCA, coxxrts have consistently acknowledged that internet service providers, e-mail sexvice providers, and telecommunication companies also provide electronic communication sexvices under the SCA. Steinbach v. Village of Forest Park,
When determining whether an entity provides electronic communication services, courts consider whether the entity is in the business of providing electronic communication sexvices. See, e.g., In re Jetblue Airways Corp. Privacy Litig.,
Here, Plaintiffs allege that Michaels provides electronic communication services because Michaels, through its PIN pads, enables consumers to pay with credit and debit cards and send or receive electronic communications concerning their account data and PINs to transaction managers, card companies, or banks. Significantly, Plaintiffs do not allege that Michaels provides the internet or phone service through which the PIN pad communicates. This insufficiency is fаtal to Plaintiffs’ claim that Michaels provides electronic communication services under the SCA. Further, Michaels, a retailer of specialty arts and crafts, is not in the business of providing electronic communication services, even though it maintains PIN pads, a necessary tool for almost any retailer today. See, e.g. Andersen Consulting,
B. Remote Computing Services
Although the Court finds that Michaels does not provide electronic communication services, the SCA nevertheless applies if Michaels provides remote computing services. A “remote computing service” is “the provision to the public of computer storage or processing services by means of an electronic communications system.” 18 U.S.C. § 2711(2). Remote computing services exist to provide sophisticated and convenient computing services to subscribers and customers from remote facilities. S.Rep. No. 99-541 (1986), reprinted in 1986 U.S.C.C.A.N. 3555, 3564. Some businesses use remote computing services to process data remotely on someone else’s equipment rather than in-house. Id.
Plaintiffs allege that Michaels provides remote computing services because the PIN pads electronically store and remotely process consumers’ payment information. While Plaintiffs artfully tailor their allegations to the language of the SCA, Michaels does not provide remote computing services as contemplated by the statute. In particular, Plaintiffs’ allegations fail to demonstrate that Michaels, a retailer of specialty arts and crafts, provides any off-site computer storage or computer processing services. Accordingly, Michaels does not provide remote computing services under the SCA.
Because Michaels provides neither electronic communication services nor remote computing services, the Court dismisses Plaintiffs’ SCA claim. The Court thus
II. Illinois Consumer Fraud and Deceptive Business Practices Act
To state a claim under the Illinois Consumer Fraud Act (“ICFA”), a plaintiff must allege that (1) the defendant engaged in a deceptive or unfair practice, (2) the defendant intended for the рlaintiff to rely on the deception, (3) the deception occurred in the course of conduct involving trade or commerce, (4) plaintiff sustained actual damages, and (5) such damages were proximately caused by the defendant’s deception. Martis v. Pekin Mem’l Hosp. Inc.,
A. Deceptive Practice
Michaels arguеs that Plaintiffs’ allegations fail to demonstrate that Michaels engaged in a deceptive practice. The Illinois Supreme Court has declared that a plaintiff cannot maintain an action under the ICFA for a deceptive practice absent some communication from the defendant, either a communication containing a deceptive misrepresentation or a deceptive omission. De Bouse v. Boyer,
This case is strikingly similar to Ciszewski. Like the allegedly deceptive omission in Ciszewski, Plaintiffs allege that they were deceived by Michaels’ failure to disclose that it had not implemented adequate security measures. Also, as in Ciszewski, Plaintiffs identify no communication by Michaels which contained this allegedly deceptive omission. The Court thus follows the holding in Ciszewski, and finds that Plaintiffs fail to allege that Michaels engaged in a deceptive practice. Accordingly, the Court declines to address Michaels’ additional argument that Plaintiffs’ deception claim improperly relies on the same factual foundation as Plaintiffs’ implied contract claim.
B. Unfair Practice
Michaels also argues that Plaintiffs’ allegations cannot show that Michaels engaged in an unfair practice. To determine whether a practice is unfair under the ICFA, the court considers whether the practice offends public policy, whether it is immoral, unethical, oppressive, or unscrupulous, and whether it causes substantial injury to consumers. Robinson v. Toyota Motor Credit Corp.,
The First Circuit, in a case also involving the hacking of customer credit and debit card information due to a company’s failure to follow security protocols, found that the plaintiffs stated a claim for unfair practices under Massachusetts law. In re TJX Cos. Retail Sec. Breach Litig.,
Here, Plaintiffs allege that Michaels failed to comply with Visa’s Global Mandate, requiring the use of tamper-resistant PIN pads, and with the PCI Pin Security Requirements. Plaintiffs further allege that Michaels failed to promptly notify consumers of the security breach. As determined by the First Circuit in TJX, such conduct could constitute an unfair practice because it causes substantial injury to consumers.
Michaels contends that Plaintiffs’ allegations are deficient because they fail to identify which PCI Pin Security Requirements Michaels violated and how Michaels did not adhere to the industry’s best practices. However, Plaintiffs allege that thе PCI PIN Security Requirements and the industry’s best practices obligated Michaels to implement procedures and practices to ensure that a legitimate device had not been substituted with a counterfeit device. Since Plaintiffs allege that the skimmers did, in fact, substitute legitimate devices with counterfeit devices, Plaintiffs’ allegations show that Michaels ignored its obligation to implement procedures and practices preventing the criminal conduct. Plaintiffs thus sufficiently allege that Michaels engaged in an unfair practice under the ICFA.
C. Actual Damage
Michaels further argues that Plaintiffs fail to allege they suffered actual damage under the ICFA. Only a person who suffers actual damage may bring an action under thе ICFA. 815 111. Comp. Stat. 505/10a(a). The plaintiff must allege a purely economic injury, measurable by the plaintiffs loss. Morris v. Harvey Cycle & Camper, Inc.,
Plaintiffs maintain that they suffered actual damages in many forms. First, Plaintiffs argue that they suffered actual damages because of the costs associated with the increased risk of identity theft, including the present and future costs of credit monitoring services. However, under the ICFA, a plaintiff does not suffer actual damage simply because of the increased risk of future identity theft or because the plaintiff purchased credit monitoring services. Cooney v. Chi. Public Sch,
Second, Plaintiffs argue that they suffered monetary losses from unauthorized bank account withdrawals and/or related bank fees charged to their accounts. Miсhaels contends that such allegations are insufficient because Plaintiffs failed to allege that they paid the charges or were not reimbursed for the charges. Michaels is correct that Plaintiffs suffered no actual injury under the ICFA if Plaintiffs were reimbursed for all unauthorized withdrawals and bank fees and, thus, suffered no out-of-pocket losses. See, e.g., Clark v. Experian Information Solutions, Inc.,
D. Illinois Personal Information Protection Act
Michaels argues that Plaintiffs cannot establish an ICFA claim based on the Illinois Personal Information Protection Act (“PIPA”). A violation of PIPA constitutes an unlawful practice under the ICFA. 815 111. Comp. Stat. 530/20. PIPA requires data collectors who own personal information concerning an Illinois resident to notify the resident of a data breach “in the most expedient time possible and without unreasonable delay .... ” 815 Ill. Comp. Stat. 530/10.
Plaintiffs allege that Michaels violated PIPA by failing to timely notify affected customers of the nature and extent of the security breach. Michaels responds that it timely notified consumers of the security breach and properly provided consumers with substitute notice. However, a disputed issue of facts exists regarding when Michaels first learned of the data breach and, thus, whether Michaels timely notified consumers. Michaels cannot over
III. Negligence & Negligence Per Se
To state a claim for negligence, a plaintiff must allege that the defendant owed a duty to the plaintiff, the defendant breached that duty, and the breach caused injury to the plaintiff. Cooney,
Michaels argues that Plaintiffs’ negligence claims fail for two reasons. First, Michaels contends that the intervening acts of criminals broke the causal chain. Generally, a defendant will not be held liable for negligence if an intervening criminal act causes the plaintiffs injury. Rowe v. State Bank of Lombard,
Here, Plaintiffs allege that Michaels failed to comply with various PIN pad security requirements, which were specifically designed to minimize the risk of exposing their financial information to third parties. Because the security measures could have prevented the criminal acts committed by the skimmers, Michaels failure to implement such measures created a condition conducive to a foreseeable intervening criminal act. Accordingly, the skimmers’ reasonably foreseeable intervening criminal act did not sever the causal chain.
Second, Michaels asserts that Illinois’ economic loss rule bars Plaintiffs’ negligence claims. The economic loss rule bars a plaintiff from recovering for purely economic losses under a tort theory of negligence. Moorman Mfg. Co. v. Nat'l Tank Co.,
Illinois law recognizes three exceptions to the economic loss rule: (1) where plaintiff sustains personal injury or property damage resulting from a sudden or dangerous occurrence; (2) wherе plaintiffs damages were proximately caused by defendant’s intentional, false representation; and (3) where plaintiffs damages were proximately caused by the negligent misrepresentation of a defendant in the business of supplying information for the guidance of others in business transactions. Moorman,
Because the economic loss rule and its exceptions have been applied inconsistently by federal courts in Illinois, the Court examines the evolution of the doctrine in the Illinois Supreme Court. The Illinois Supreme Court first applied the economic loss rule in the context of a product liability action. In Moorman, where a defective
Just a few years after Moorman, the Illinois Supreme Court extended the doctrine and held that the economic loss rule bars a claim that a defendant negligently performed services. Anderson Elec. v. Ledbetter Erection Corp.,
Over the next few years, the Illinois Supreme Court dealt with the applicability of the economic loss rule to claims of professional malpractice against a defendant providing services. The court held that the economic loss rule did not apply to a plaintiff asserting a professional malpractice claim against an attorney or an accounting firm. Collins v. Reynard,
Following the analysis set forth in Congregation of the Passion, the Illinois Supreme Court later found that the economic loss doctrine bars recovery in tort against engineers for purely economic losses because the ultimate result of an engineer’s work is a tangible product. Fireman’s Fund Ins. Co. v. SEC Donohue, Inc.,
Here, Plaintiffs do not dispute the fact that they seek to recover in tort solely for economic losses. The economic loss rule bars Plaintiffs’ negligence and negligence per se claims unless Plaintiffs satisfy an exception to the rule. Plaintiffs do not argue that they satisfy any of the three exceptions set forth in Moorman. Rather, Plaintiffs argue that the economic loss rule does not apply because Michaels breached a duty owed to Plaintiffs independent of any contractual obligation or warranty. However, the exception to which Plaintiffs refer, as announced in Congregation of the Passion, only applies to professional malpractice claims where the ultimate result of the defendant’s work is intangible. See Congregation of the Passion,
Plaintiffs also attempt to avoid the economic loss rule by arguing that it does not apply to Michaels’ willful conduct. Aside from the intentional misrepresentation exception identified in Moorman, no such exception exists. Indeed, the Illinois Supreme Court barred an action for purely economic losses allegedly due to the defendant’s “negligent or willful” conduct. In re Ill. Bell Switching Station Litig.,
For these reasons, the Court dismisses Plaintiffs’ negligence and negligence per se claims.
IV. Breach of Implied Contract
An implied in fact contract is created by the parties’ conduct and contains all of the elements of an express contract—offer, acceptance, and consideration—as well as a meeting of the minds. Brody v. Finch Univ. of Health Scis./Chi. Medical Sch.,
Michaels argues that Plaintiffs’ implied contract claim fails because Plaintiffs have not alleged facts showing the existence of an implied contract. Specifically, Michaels, without relying on any particular case, contends that the facts alleged do not demonstrate that the parties intended to create a contract governing how Michaels would safeguard Plaintiffs’ financial information and when Michaels would notify consumers of a security breach.
The First Circuit recently evaluated an implied contract claim in a similar case involving the unauthorized use of plaintiffs’ credit and debit card data after hackers breached the defendant’s electronic payment system. Anderson v. Hannaford Bros.,
CONCLUSION
For the foregoing reasons, the Court grants in part and denies in part Michaels’ motion to dismiss and dismisses Plaintiffs’ SCA claim and negligence claims.
Notes
. For purposes of the motion to dismiss, we accept the allegations of the Complaint as true. Warth v. Seldin,
. Because a plain reading of the statute yields support for both parties' positions, the Court finds that the statute is ambiguous and refers to the legislative intent to aid its interpretation. See United States v. Hudspeth,
. For this reason, Plaintiffs properly allege a compensable injury for all of their claims and the Court need not address Plaintiffs' remaining contention that they suffered actual injury because Michaels damaged Plaintiffs' property rights in their personal information.
. It is unclear whether the independent duty exception is a fourth exception to the economic loss rule or part of the negligent misrepresentation exception. Compare Congregation of the Passion,
. Plaintiffs cite several non-binding cases where courts have interpreted Congregation of the Passion as simply holding that the economic loss rule does not apply if the defendant breached a duty owed to the plaintiff independent of any contract. See, e.g., Choi v. Chase Manhattan Mortg. Co.,
. Michaels broadly contends that "[c]ourts routinely reject consumer breach of implied contract claims in data exposure cases,” and cites Pisciotta v. Old National Bancorp,
However, as discussed above, the Plaintiffs in this case allege that criminals have misused their financial information and caused Plaintiffs to lose money from unauthorized withdrawals and/or related bank fees.