MEMORANDUM OPINION AND ORDER
Plaintiffs filed this purported class action against TransPerfect Global, Inc. (“TransPerfect” or “Defendant”) on February 27, 2017, stemming from a data breach of TransPerfect’s computer systems that disclosed Plaintiffs’ sensitive personally identifiable information (“PII”) to hackers. TransPerfect moves to dismiss the .Amended Complaint (“Complaint”) pursuant to Federal, Rules of Civil Procedure 12(b)(1) and 12(b)(6). As discussed below, the Rule 12(b)(1) motion is denied because Plaintiff has standing to sue. The Rule 12(b)(6) motion is granted in part, dismissing only the claim of breach of express contract.
I. BACKGROUND
The following facts are drawn from the Complaint and accepted as true for the purpose of this motion. Defendant employs over 4,000 individuals. The company maintains a corporate privacy policy and security manual that describes “robust procedures designed to protect the PII with which it is entrusted.” However, unlike other similarly situated companies, Tran-sPerfect did not train employees on data security; did not erect digital firewalls and did not maintain PII retention and destruction protocols.
Defendant understood the prevalence of cyber-attacks on corporate records and appreciated the gravity of the risk posed by such attacks. High-profile corporate data breaches dominated recent headlines, and 282 breaches, were publicly reported between 2014 and 2015. Defendant’s own website warns clients that cyber-attacks “are neither new nor infrequent.” The website cautions, “never send your credit card number, -.Social Security number, bank account number, driver’s - license number or similar details in an email,” because email “is generally not secure” and is the method of communication “most vulnerable to hacking.”
On or about January 17, 2017, at least one TransPerfect. employee received a “phishing” email. The email appeared to come from TransPerfect’s CEO, but actually was sent by unidentified cyber-crimi-nals. The email asked for the W-2 forms and payroll information of all current and former TransPerfect employees. Because TransPerfect’s cyber-security was not up to industry par, at least one TransPerfect employee sent the information to the hackers in an unencrypted format. As a result, cyber-criminals obtained Plaintiffs’ names, addresses, dates of birth, Social Security numbers, direct deposit bank account numbers and routing numbers.
Hackers can use PII to obtain by fraud employment, loans, credit cards and can file tax returns. Criminals can also use PII to steal government benefits and create false identification for -use in further schemes. Stolen PII is frequently bought and sold amongst various -criminals on “dark markets.” TransPerfect responded to the breach by offering Plaintiffs two free years of enrollment in an identity theft monitoring service. Plaintiffs purchased preventive services.
II. LEGAL STANDARDS
“A district court properly dismisses an action under Fed. R. Civ. P. 12(b)(1) for lack of subject matter jurisdiction if the court lacks the statutory or constitutional power to adjudicate it, such as when ... the plaintiff lacks constitutional standing to bring the action.” Cortlandt St. Recovery Corp. v. Hellas Telecomms., S.a.r.l.,
To survive a motion to dismiss under Rule 12(b)(6), “a complaint must contain sufficient factual matter; accepted as true, to state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal,
III. DISCUSSION
A. Subject Matter Jurisdiction
The motion to 'dismiss for lack of subject matter’ jurisdiction is denied because the Complaint “affirmatively and plausibly” alleges facts sufficient to establish standing. See HealthPort Techs,
“[T]he irreducible constitutional minimum of standing contains three elements.” Lujan v. Defenders of Wildlife,
To satisfy the injury-in-fact requirement, a plaintiff must allege “an invasion of a legally protected interest that is concrete and particularized and actual or imminent, not conjectural or hypothetical.” John v. Whole Foods Mkt. Grp.,
The harms alleged in the Complaint do not stretch imminence beyond its breaking point. The allegations that Defendant has provided Plaintiffs’ names, addresses; dates of birth, Social Security numbers and bank account information directly to cyber-criminals creates a risk of identity theft sufficiently acute so as to fall comfortably into the category of “certainly impending.” The most likely and obvious motivation for the hacking is to use Plaintiffs’ PII nefariously or sell it to someone who would. See Remijas v. Neiman Marcus Grp.,
While the Second Circuit has yet to address the question, two recent unreported decisions suggest that it will follow the lead of its sister circuits. See Katz v. Donna Karan Co.,
Whether the risk of identity theft is sufficiently material to create an injury in fact is “a question for lower courts to determine in the first instance, on a case- and fact-specific basis.” Id. Here, a case-specific analysis dictates that standing exists. The Complaint alleges that Defendant divulged information—including birth dates and social security numbers—far more sensitive than all or a portion of a credit card number, and that the PII here was provided directly to cybercriminals, and not merely printed on a store receipt.
When a future harm is sufficiently imminent to support standing, a plaintiffs expenses in taking reasonable measures to prevent the harm’s fruition also may be viewed as an injury in fact. See Hedges v. Obama,
In an effort to circumvent the appellate decisions cited above, Defendant cites a handful of distinguishable cases in which courts found standing to be lacking when a plaintiffs PII was on a stolen computer, and the plaintiffs did not allege or could not show that obtaining their PII was the motivation for the theft. See, e.g., Beck v. McDonald,
As the allegations of the risk of identity theft and related mitigating expenses are sufficient to allege injury in. fact and thereby confer standing, the Court has subject matter jurisdiction. The motion to dismiss based on Rule 12(b)(1) is denied.
B. Failure to State a Claim
The Complaint pleads five causes of action: (1) common law and statutory negligence; (2) breach of express contract; (3) breach of implied contract; (4) unjust enrichment and (5) violations of N.Y. Labor Law 203-d.
1. Negligence
“Under New York law, in order to recover on a claim for negligence, a plaintiff must show (1) the existence of a duty on defendant’s part as to plaintiff; (2) a breach of this duty; and (3) injury to the plaintiff as a result thereof.” Caronia v. Philip Morris USA, Inc.,
a) Breach of Common law Duty
The Complaint alleges a cognizable legal duty—that Defendants had a duty to safeguard Plaintiffs’ and class members’ PII. “The definition and scope of an alleged tortfeasor’s duty, owed to a plaintiff is a question of law.” Pasternack v. Lab. Corp. of Am. Holdings,
Applying these factors, employers have a duty to take reasonable precautions- to protect the PII that they require from employees. Employees ordinarily have no means" to' protect' that information in the hands of the employer, nor is withholding their PII a realistic option. The employer is “best positioned to avoid the harm in question ....” Id.,
The Complaint also sufficiently alleges that TransPerfect violated its duty to take reasonable steps to protect its employees’ PII. The Complaint alleges that TransPer-fect was aware of the sensitivity of PII and the need to protect it; TransPerfect’s website warns, “never send ,.. credit card number[s], Social Security number[s], bank account number[s] ... or similar details in an email,” because email “is generally not secure” and is “vulnerable to hacking.” The Complaint also alleges that, despite this knowledge, Defendant failed to take reasonable steps to prevent the wrongful dissemination of Plaintiffs’ PII— including erecting a digital firewall, conducting data security training and adopting retention and destruction policies— such that a TransPerfect employee responded to a phishing email by sending Plaintiffs’ PII to cyber-criminals. These allegations are sufficient to state a claim for negligence.
b) Breach of Statutory Duty
The Complaint sufficiently alleges negligence per se. “Under the rule of negligence per se, if (1) a statute is designed to protect a class of persons, (2) in which the plaintiff is included, (3) from the type of harm which in fact occurred as a result of its violation, the issues of the defendant’s duty of care to the plaintiff and the defendant’s breach of that duty are conclusively established upon proof that the statute was violated.” German by German v. Fed. Home Loan Mortg. Corp.,
The Complaint sufficiently alleges breach of a statutory duty. First, New York Labor Law makes it illegal for an employer to “communicate an employee’s personal identifying information to the general public.” N.Y. .Lab. Law § 203-d(l)(d) (McKinney 2009). The statute defines “personal identifying information” to include: the employee’s “social security number, home address or telephone number, personal electronic mail address, Internet identification name or password, parent’s surname prior to marriage, or drivers’ license number.” Id. § 203-d(l)(c). Second, Plaintiffs are within the class of persons—employees—the law is designed to protect. Third, exposure of PII is precisely the harm that the statute seeks to prevent. Even the alleged method of Defendant’s breach is contemplated by the statute, which states, “It shall be presumptive evidence that a violation ... was knowing if the employer has not .put in place policies or procedures to safeguard against” the disclosure of PII. Id. § 203-d(3). ... .
c) Injury
Defendant’s 12(b)(6) motion is somewhat duplicative of its 12(b)(1) motion, because both rely heavily on a claimed lack of injury. Defendant argues that the negligence claim is deficient because “Plaintiff does not properly plead that he suffered any actual cognizable injury.” This argument is unpersuasive;, the Complaint sufficiently alleges injuries stemming from Defendant’s breach' of dpty.
As discussed above, the Complaint adequately alleges that Plaintiffs face an imminent threat of identity theft and have purchased preventive services to mitigate the threat. These mitigation expenses satisfy the injury requirements of negligence; otherwise Plaintiffs would face an untenable Catch-22. Under New York’s “doctrine of avoidable consequences,” a plaintiff, must “minimize damages” caused by a defendant’s tortious conduct, and can recover mitigation costs for any “action [ ] reasonable under the circumstances .... ” Revelations Perfume & Cosmetics, Inc. v. Nelson, No. 603350/2008, 35 Misc.3d 1216A,
The economic loss rule—which in the “absence of any personal injury or property damage ' precludes plaintiffs’ claims for economic injury” in negligence cases—does not bar Plaintiffs’ negligence claim, as Defendant suggests, for two reasons. 532 Madison Ave. Gourmet Foods, Inc. v. Finlandia Ctr., Inc.,
2. Breach of Contract
“Under New York law, a breach of contract claim requires (1) the existence of an agreement, (2) adequate performance of'the contract by the plaintiff, (3) breach of contract by the defendant, and (4) damages.” Balk v. N.Y. Inst. of Tech.,
a) Breach of Express Contract
The Complaint fails to allege a sufficient claim for breach of express contract. It alleges that Plaintiffs’ employment contracts “involved a mutual exchange of consideration whereby TransPerfect entrusted Plaintiffs and Class Members with particular job duties and responsibilities in furtherance of TransPerfect’s services, in exchange for the promise of employment, with salary, benefits and secui’e PII.”
The Complaint fails to allege any facts to support the conclusion that Defendant expressly contracted to protect employees’ PII. The Complaint does not describe any express agreement to that effect, nor does the Complaint attach or quote any contract. In adjudicating express contract claims, “[a] court cannot supply a specific obligation the parties themselves did not spell out.” Wallert v. Atlan,
By failing to allege any facts upon which a finding of express contract regarding PII could be predicated, the Complaint engages in the type of “[t]hreadbare recital[ ] of the elements of a cause of action” that Iqbal warned against.
b) Breach of Implied Contract
The Complaint states a claim for breach of implied contract. “Under New York law, a contract implied in fact paay result as an inference from the facts pid circumstances of the case, though not formally stated in words, and is derived from the presumed intention of the parties as indicated by their conduct.” Leibowitz v. Cornell Univ.,
Plaintiffs allege conduct and a course of dealing- that raise a strong inference of implied contract. TransPerfect required and obtained the PII as part of the' employment relationship, evincing an implicit promise by TransPerfect to act reasonably to keep its employees’ PII safe. TransPerfect’s privacy policies and security practices manual—which states that the company “maintains robust procedures designed to carefully protect the PII with which it [is] entrusted”—further supports a finding of an implicit promise. Enslin v. The Coca-Cola Co.,
c) Damages
Defendant reframes the no-injury argument asserting the failure to plead “actual damages arising from the purported breach.” The argument is unpersuasive in this context as well. As discussed above, the Complaint adequately pleads a “certainly impending” injury, as well as preventive economic injury. Similar to the tort context, the complaint alleges that Plaintiffs acted “consistent with the general contract principle! ] that ... the injured party has a duty to mitigate.” White v. Farrell,
3. Unjust Enrichment
The claim of unjust enrichment is sufficiently pleaded. “[I]n order to adequately plead such a claim, the plaintiff must allege that (1) the other party was enriched, (2) at that party’s expense, and (3) that it is against equity and good conscience to permit the other party to retain what is sought to be recovered.” Ga. Malone & Co. v. Rieder,
The unjust enrichment claim is not precluded by the contract claim. New York law “precludes unjust enrichment claims whenever there is a valid and enforceable contract governing a particular subject matter, whether that contract is written, oral, or implied-in-fact.” Green Tree Servicing, LLC v. Christodoulakis,
4. N.Y. Labor Law § 203-d
Plaintiffs assert that N.Y. Labor Law § 203-d not only provides a basis for negligence per se, but also affords them a private right of action. The text of the statute is silent on private causes of action; however, that silence does not settle the issue. “In the absence of an express private right of action, plaintiffs cdh seek civil relief in a plenary action based on a violation of the statute only if a legislative intent to create such a,right of action is. fairly implied in the statutory provisions and their legislative history.” Nat'l Convention Servs., L.L.C. v. Applied Underwriters Captive Risk Assurance Co.,
All three factors demonstrate that N.Y. Labor Law § 203-d implies a private right ,of action. First, Plaintiffs are within the class the statute is designed to protect: employees who suffered the precise type of harm that the statute is designed to prevent. Second, an implied right of action is consistent with § 203-d’s legislative purpose. In general, New York Labor Law reflects “a strong legislative policy aimed at redressing. the power imbalance between . employer and employee.” Chu Chung v. New Silver Palace Rest.,
Third, an implied cause of action is consistent with the legislative scheme. Section 203-d provides for administrative enforcement: the “commissioner may impose a civil penalty of up to five hundred dollars on any employer for any knowing violation An implied private right of action is appropriate to imply in addition to administrative enforcement where “the determination of a violation and the calculation of resulting damages do not require any special agency expertise.” Maimonides Med. Ctr. v. First United Am. Life Ins.,
IV. CONCLUSION
For the foregoing reasons, TransPer-fect’s motion to dismiss for lack of subject matter jurisdiction is DENIED. TransPer-feet’s motion to dismiss for failure to state a claim is GRANTED -with respect to Plaintiffs’ express contract cause of action, and otherwise DENIED. The Clerk of Court is respectfully directed to close Dkt. #20. Defendant’s request for oral argument (Dkt. 29) is DENIED as moot.
SO ORDERED.
Notes
. New York law applies as the parties assume that it does. “The parties’ briefs assume that [New York] state law governs this case, and ‘such implied consent is ... sufficient to establish the applicable choice of law.” Trikona Advisers Ltd. v. Chugh,