MEMORANDUM OPINION
Plaintiffs, seven current or retired District of Columbia employees, bring this purported class action on behalf of individuals whose private personal information, including Social Security numbers, was contained on the laptop computer of a representative of Defendant ING Life Insurance and Annuity Company (“ING”), which was stolen during a burglary of the representative’s home. Plaintiffs’ Complaint alleges two counts of invasion of privacy, one count of gross negligence, and one count of negligence. Defendant has moved to dismiss Plаintiffs’ Complaint pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6) on three grounds: (1) that Plaintiffs fail to allege any injury in fact and thus lack standing; (2) that Plaintiffs fail to state a claim on which relief can be granted; and (3) that Plaintiffs’ claims are moot because Defendant has already provided Plaintiffs all the relief they seek. Upon a searching review of Defendant’s Motion to Dismiss, Plaintiffs’ Opposition, Defendant’s Reply, and the relevant statutes and case law, the Court concludes that Plaintiffs lack standing because they fail to allege a cognizаble injury in fact. As such, the Court will not reach Defendants’ other arguments for dismissal, shall deny without prejudice Defendant’s Motion to Dismiss, and shall remand this case to the Superior Court for the District of Columbia, pursuant to 28 U.S.C. § 1447(c).
*3 I. BACKGROUND
Defendant ING Life Insurance and Annuity Company (“ING”) provides investment advice, administrative services, and record keeping to participants in the District of Columbia 457 Deferred Compensation Plan (the “Plan”). Compl. ¶ 16. Plaintiffs allege that they are seven of more than 13,000 current and former District of Columbia employees who, in connectiоn with their participation in the Plan, provided ING with their private personal information, including their names, addresses, and Social Security numbers (hereinafter “Plaintiffs’ Information”). Id. ¶¶ 2, 17. 1 Plaintiffs further allege that, on or around June 12, 2006, “a low-ranking data analyst and long time ING employee,” removed files containing Plaintiffs’ Information from an ING facility and took the files to his home, where he copied them onto his laptop computer. Id. ¶ 19. 2 The ING employee’s laptop computer— containing Plaintiffs’ Information — were subsequently stolen during a burglary of the reрresentative’s home, id., and on or around June 19, 2006, ING publicly announced that the private information of 13,000 District of Columbia workers and retirees had been disclosed as a result of the burglary. Id. ¶ 18.
Plaintiffs do not allege that the burglary was anything other than a common burglary or that it was undertaken for the purpose of accessing Plaintiffs’ Information. Rather, Plaintiffs allege that the ING employee in question “was able to easily access computer files containing” Plaintiffs’ Information to copy the files onto his personal laptop, and “had been removing thе data from [sic] ING facility for a significant period of time in a practice expressly or implicitly ratified by ING.” Id. ¶ 20. Plaintiffs assert that the ING employee’s access to and duplication of Plaintiffs’ Information violated Plaintiffs’ right to privacy, and was “the result of ING’s grossly negligent and/or willful and intentional failure to establish appropriate safeguards to ensure the security and confidentiality of District of Columbia employee records and to protect against any anticipated threats or hazards to the security and integrity of those records.” Id. Furthermore, Plaintiffs allege that ING knew about the burglary within hours of its occurring, but did not inform Plaintiffs of the burglary until seven days later, “despite knowledge of the imminent and substantial risk of serious harm to the personal security of the affected employees.” Id. ¶21. Finally, Plaintiffs allege upon information and belief, that the stolen laptop computer has not been recovered and can easily be accessed and duplicated because it is not encrypted or password protected. Id. ¶ 19. 3 *4 Plaintiffs assert that the “unauthorized and unconsented disclosure of an individu-aTs name, address, date of birth and Social Security number creates a substantial risk of identity theft,” id. ¶ 23, and that “nationwide studies confirm that, on average, victims of identity theft spend hundreds of hours in personal time and hundreds of dollars in personal funds to resolve their credit issues,” id. ¶ 24. Significantly, however, none of the Plaintiffs assert that they have actually been the victim of identity theft. Instead, Plaintiffs allege that the disclosure of their Information raises concerns about Plaintiffs’ safety because, for example, Plaintiffs’ Information could be used to find out where police personnel live. Id. ¶ 26. Specifically, Plaintiffs allege that as a “direct and proximate result” of [ING’s] acts and omissions, they “have been exposed to a risk of substantial harm and inconvenience, and have incurred or will incur actual damages in purchasing comprehensive credit reports and/or monitoring of their identity and credit for the indefinite future.” Id.
Plaintiffs filed their four-count Complaint in the Superior Court for the District of Columbia on June 27, 2006. Counts One and Two of Plaintiffs’ Complaint allege that ING’s acts and omissions violated Plaintiffs’ “clearly established right to privacy.” Id. ¶¶ 35-38. Counts Three and Four of Plaintiffs’ Complaint allege that ING’s acts and omissions constituted gross negligence and negligence, respectively. Id. ¶¶ 39^42. ING removed this action to the United States District Court for the District of Columbia on July 7, 2006, pursuant to 28 U.S.C. §§ 1441, 1446, and 1453. On September 1, 2006, ING filed its Motion to Dismiss Plaintiffs’ Complaint (hereinafter “ING’s Mot. to Dismiss”). Plaintiffs filed their Opposition to ING’s Motion to Dismiss on September 25, 2006, and ING filed its Reply on October 9, 2006. Thereafter, on October 13, 2006 and October 18, 2006, ING filed Notices of Supplemental Authority, advising the Court of decisions handed down after ING’s Motion to Dismiss was fully briefed, which ING believes provide additional support for its Motion to Dismiss. Plaintiffs filed a Response to ING’s Notices of Supplemental Authority on October 24, 2006, which ING subsequently moved to strike on October 27, 2006. Plaintiffs opposed ING’s Motion to Strike on November 6, 2007, and ING filed a Reply in support of its Motion to Strike on November 7, 2007.
II. LEGAL STANDARD
A. Federal Rule of Civil Procedure 12(b)(1)
Pursuant to Federal Rule of Civil Procedure 12(b)(1), a court must dismiss a case when it lacks subject matter jurisdiction. In general, a motion to dismiss under Federal Rule of Civil Procedure 12(b) should not prevail “unless plаintiffs can prove no set of facts in support of their
*5
claim that would entitle them to relief.”
Kowal v. MCI Commc’ns Corp.,
B. Federal Rule of Civil Procedure 12(b)(6)
“In evaluating a Rule 12(b)(6) motion to dismiss for failure to state a claim, unlike resolving a motion under Rule 12(b)(1), the court must construe the complaint in a light most favorable to the plaintiff and must accept as true all reasonable factual inferences drawn from well-pleaded factual allegations.”
In re United Mine Workers of Am. Employee Benefit Plans Litig.,
III. DISCUSSION
ING argues that Plaintiffs’ Complaint should be dismissed for three separate and *6 independent reasons: (1) pursuant to Federal Rule of Civil Procedure 12(b)(1), ING argues that Plaintiffs fail to plead a recognized injury and therefore lack standing, see ING Mot. to Dismiss at 6-11; (2) pursuant to Federal Rule of Civil Procedure 12(b)(6), ING argues that Plaintiffs fail to state a claim upon which relief can be granted, see id. at 11-13; and (3) ING argues that this case is moot because ING has already taken steps to eliminate any risk that Plaintiffs may suffer injury as a result of the theft of the laptop computer, see id. at 14-17. The Court agrees with ING that Plaintiffs lack standing because they have failed to plead an injury in fact. The Court therefore does not reach ING’s other arguments in favor of dismissal, but instead shall remand this case to the Superior Court for the District of Columbia, pursuant to 28 U.S.C. § 1447(c).
A. Plaintiffs Lack Standing Because They Fail to Plead an Injury in Fact
As an Article III court, this Court’s judicial power is limited to adjudicating actual “cases” and “controversies.”
Allen v. Wright,
Standing is an “irreducible constitutional minimum.”
Lujan,
In arguing that Plaintiffs fail to plead an injury in fact, ING points to a number of recent “lost data” cases from federal courts, in which a plaintiffs private personal information has been exposed to a third party as the result of theft or unlawful access.
See
ING Mot. to Dismiss at 8-11 (citing
Giordano v. Wachovia Sec., LLC,
No. 06-476,
The most analogous of these “lost data” cases are
Giordano
and
Key.
In
Giordano,
plaintiff, a customer of Wachovia Securities, LLC, filed a class action lawsuit on behalf of a class of individuals whose private personal information (names, addresses, and Social Security numbers) was included in a printed report that was lost in shipping.
See Giordano,
The
Giordano
court’s decision was grounded, in part, on the fact that “[pjlain-tiff failed to allege even that her financial information was stolen or ended up in the possession of someone who might potentially misuse it.”
Id.
at *5. In contrast, here Plaintiffs allege that they have been informed by ING that their Information was contained on the stolen laptop. Compl. ¶¶ 9-15. Still, Plaintiffs do not allege “that the purpose of the burglary was to obtain their personal information, that they have actually suffered from identity theft, or that they have suffered actual losses.” ING Mot. to Dismiss at 10. As such, the instant case is similar to
Key,
in which “unauthorized persons obtained access to and acquired the information of approximately 96,000 customers,” including the plaintiff.
Key,
Similarly, Plaintiffs in the instant action allege that they “have been placed at a substantial risk of harm in the form of identity theft.” Compl. ¶ 5. They fail, however, to allege any injury that is “actual or imminent, not conjectural or hypothetical.”
Lujan,
While the focus of Plaintiffs’ Complaint is on their allegedly increased risk of identity theft, Plaintiffs аlso allege that they “have incurred and will incur actual damages in an attempt to prevent identity theft by purchasing services to monitor their credit information.” Compl. ¶ 5. Plaintiffs do not specifically allege which, if any, of them have actually purchased and paid for credit monitoring services, or which services those individuals have purchased and paid for.
Id.
Nor do Plaintiffs specifically request that this Court reimburse them for any out-of-pocket losses incurred.
See
Compl. at 10-11. In any event, even if individual Plaintiffs have purchased and paid for credit monitoring services, the “lost data” cases cited by ING clearly reject the theory that a plaintiff is entitled to reimbursement for credit monitoring services or for time and money spent monitoring his or her credit.
See Giordano,
B. Plaintiffs’ Complaint Does Not Allege a Breach of Fiduciary Duty of Confidentiality or a Statutory Violatiоn
In their Opposition, Plaintiffs do not identify any case in which a court has determined that an allegedly increased risk of identity theft constitutes a sufficiently “actual or imminent” injury in fact. Instead, Plaintiffs attempt to distinguish the “lost data” eases cited by ING on the ground that those cases did not involve allegations of a “breach of confidentiality” or “breach of fiduciary duty.” Pis’ Opp’n at 8-10. As an initial matter, Plaintiffs are absolutely wrong in this assertion.
Forbes
involved a claim for breach of fiduciary duty,
see
Moreover, Plaintiffs’ attempt to distinguish the “lost datа” cases on this ground is entirely unavailing because Plaintiffs’ Complaint does not assert a claim for either breach of the duty of confidentiality or breach of fiduciary duty. In contrast, Plaintiffs’ Complaint includes four Counts, two claims for invasion of privacy, one claim for gross negligence, and one claim for negligence.
See
Compl. ¶¶ 35-42. Nevertheless, in their Opposition, Plaintiffs assert that their Complaint supports an “avenue for recovery” for “an unwarranted invasion of privacy or more specifically stated, the breach of a fiduсiary duty.” Pis’ Opp’n at 7. In support of this argument, Plaintiffs cite to
Vassiliades v. Garfinckel’s,
Nor does Plaintiffs’ Complaint provide any indication, even under the liberal notice pleading standard, that they seek relief based on a provision of the D.C.Code. In their Opposition, Plaintiffs cite to two civil enforcement provisions of the D.C.Code and assert that, based on these provisions, they “clearly have standing to bring this lawsuit as they are all participants in either the District Retirements Benefit Program D.C.Code § 1-626.05 (District employees) or the District of Columbia Retirement Program (Police, Firefighters, Teachers and Judges)
*10
D.C.Code § 1-702.” Pis’ Opp’n at 8. However, Plaintiffs Complaint contains absolutely no reference to any of those provisions, and certainly does not indicate that Plaintiffs intend to state a claim based on those provisions. Plaintiffs have not offered to amend or moved to amend their Complaint to include claims of breach of fiduciary duty or a statutory violation.
See Belizan v. Hershon,
Moreоver, Plaintiffs’ attempt to rechar-acterize their Complaint is of absolutely no consequence to the Court’s conclusion that they lack standing because they fail to allege a sufficiently “actual or imminent” injury in fact. As noted above, standing is an “irreducible constitutional minimum,”
Lujan,
C. The Court Shall Remand This Case to the Superior Court for the District of Columbia
In light of the Court’s conclusion that Plaintiffs lack Article III standing, the Court need not reach ING’s other jurisdictional argument and cannot reach ING’s merits argument.
See DEK Energy Co. v. Fed. Energy Regulatory Comm’n,
In addition, ING argues that remand would be a “futile waste of judicial resources,” because the standing rules applicable to federal courts apply equally to the Superior Court for the District of Co
*11
lumbia. ING Reply at 8-9 (citing
Friends of Tilden Park, Inc. v. District of Columbia,
As a result, the Court declines to recognize a futility exception, especially in light of the D.C. Circuit’s instruction- — which is binding on this Court — that “[w]hen it appears that a district court lacks subject matter jurisdiction over a case that has been removed from a state court, the district court
must
remand the case.”
Republic of Venezuela,
IV. CONCLUSION
For the foregoing reasоns, the Court concludes that Plaintiffs have failed to allege an injury in fact and thus lack Article III standing. The Court shall deny without prejudice Defendant’s Motion to Dismiss. However, as this Court finds itself without subject matter jurisdiction over the instant case, the Court shall remand this case to the Superior Court for the District of Columbia pursuant to 28 U.S.C. § 1447(c).
Notes
. Plaintiffs Regina A. Randolph and Tony' Giles are District of Columbia Police Officers; Plaintiffs Tonia Robinson, Darlene V. Fields, Marthine Bartee, and Tamonica Heard are District of Columbia employees; and Plaintiff Don Pope is a retired District of Columbia Police Officer. Compl. ¶¶ 9-15. All Plaintiffs allege that they have been notified by ING that their personal data was contained on the stolen laptop computer. Id.
. Plaintiffs’ Complaint generally describes Plaintiffs’ Information as having been contained on a computer and/or external disks, which were stolen from the ING employee’s home. See, e.g., Compl. ¶ 19. More specifically, the Complaint indicates that each Plaintiff “has been notified by the Defendant that [his or her] personal data was contained on the subjeсt laptop.” Id. ¶¶ 9-15. As ING’s Motion to Dismiss confirms that Plaintiffs’ Information was contained on a laptop stolen from the home of an ING employee, see ING Mot. to Dismiss at 2-4, for ease of reference, the Court shall describe Plaintiffs’ Information as having been contained on a stolen laptop computer.
.In connection with its Motion to Dismiss, ING submitted the Declaration of J. Robert Bolchoz, which details the steps taken by ING in the wake of the burglary. ING Mot. to
*4
Dismiss at AU. 1 (Bolchoz Decl.). The Bol-choz Declaration is offered in support of ING's argument that Plaintiffs’ сlaims are moot because ING has already provided Plaintiffs all the relief they seek.
See
ING Mot. to Dismiss at 14-17. As noted below, in resolving a motion to dismiss made pursuant to Rule 12(b)(1), the Court may “consider the complaint supplemented by undisputed facts evidenced in the record, or the complaint supplemented by undisputed facts plus the court's resolution of disputed facts.”
Coalition for Underground Expansion v. Mineta,
.
Giordano, Bell,
and
Key
determined that an increased risk of identity theft failed to demonstrate an injury in fact sufficient to ground Article III standing,
see Giordano,
. Subsequent to ING’s filing of two Notices of Supplemental Authority, on October 24, 2006, Plaintiffs filed a Response to ING’s Notices. A reviеw of Plaintiffs six-page Response reveals that only the first page of the Response actually addresses the cases cited by ING as supplemental authority, asserting that ”[t]he problem with the alleged supplemental authorities is twofold.” Pis’ Resp. at 1. The remainder of Plaintiffs' Response consists of attempts to rebut ING’s Reply in support of its Motion to Dismiss.
See id.
at 2-6. As a result, on October 27, 2006, ING moved to strike Plaintiffs’ Response as an improper sur-reply,
see
ING Mot. to Strike, an effort that Plaintiffs oppose,
see
Pis’ Resp. to Def's Mot. to Strike. “A surreply may be filed only by leave of Court, and only to address new matters raised in a reply to which a party would otherwise be unable to respond.”
United States ex rel. Pogue v. Diabetes Treatment Ctrs. of Am., Inc.,
