UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

CRYSTAL MALVITZ AND CHRISTOPHER FREDRICKSON,

Plaintiffs, Civil Action No. 24-cv-238 (TSC) v.

FINCANTIERI MARINE GROUP, LLC.

Defendant.

MEMORANDUM OPINION

Plaintiffs Crystal Malvitz and Christopher Fredrickson bring this class action, as

individuals and on behalf of all others similarly situated, against Defendant Fincantieri Marine

Group, LLC (“Defendant”), a company that builds and repairs maritime vessels. Plaintiffs assert

claims for negligence, breach of implied contract, and unjust enrichment. Am. Compl., ECF No.

8. Defendant moves to dismiss for lack of subject matter jurisdiction under Federal Rule of Civil

Procedure 12(b)(1) and failure to state a claim under Federal Rule of Civil Procedure 12(b)(6).

Def.’s Mot. to Dismiss Am. Compl., ECF No. 9-1 (“MTD”). For the reasons set forth below, the

court will GRANT in part and DENY in part Defendant’s motion.

I. BACKGROUND

A. Defendant’s Cybersecurity Practices and Data Breach

Plaintiffs are Defendant’s former employees or benefit recipients. Am. Compl. ¶ 25. They

provided personally identifiable information (“PII”) to Defendant as a condition of employment

and/or employment-related benefits. Id. ¶ 2. Defendant allegedly made “promises and

representations” that PII would be “kept safe, confidential, and that the privacy of that information

Page 1 of 22 would be maintained, and that Defendant would delete any sensitive information after it was no

longer required to maintain it.” Id. ¶ 28. Defendant’s website stated that it stored PII “behind

secured networks,” only provided access to “a limited number of persons,” and “encrypted” PII

“via Secure Socket Layer (‘SSL’) technology.” Id. ¶ 29. Defendant also represented that it “use[d]

regular Malware Scanning” to identify “security holes and known vulnerabilities.” Id.

On or about April 12, 2023, however, Defendant became “aware of a cyberattack” on its

computer systems. Id. ¶ 36. It determined that “there was unauthorized access to certain systems

. . . between April 6, 2023, and April 12, 2023,” resulting in “unauthorized acquisition” of more

than sixteen thousand individuals’ PII. Id. ¶¶ 36, 46. The data stolen during the attack included

Plaintiffs’ “name[s] . . . date[s] of birth, Social Security number[s], date[s] of service, [insurance]

participant ID[s], and member number[s].” Id. ¶ 36. Defendant sent a “Notice of Security Incident

letter” (the “Notice Letter”) to Plaintiffs on January 5, 2024, which offered “24 months of identity

monitoring services.” Id. ¶¶ 36–37, 63, 139, 149.

Plaintiffs allege that, despite Defendant’s “promises and representations,” id. ¶ 28, it failed

to implement “reasonable security procedures and practices” to prevent or promptly detect the

cyberattack and stored data in unencrypted files, id. ¶¶ 37–40, 67. Plaintiffs contend that

Defendant’s practices did not comply with the Federal Trade Commission’s (“FTC”) guidelines

for protecting personal information, such as using “an intrusion detection system” to promptly

identify a breach, monitoring suspicious activity or large data transmissions, developing a data-

breach response plan, “properly dispos[ing] of [PII] that is no longer needed,” limiting “access to

sensitive data[,]” using “industry-tested methods for security[,]” and verifying the security

measures used by third-party service providers. Id. ¶¶ 81–83, 86. Plaintiffs also allege that

Defendant “failed to follow [] industry best practices,” such as “strong passwords;” “firewalls,

Page 2 of 22 antivirus, and anti-malware software; encryption, making data unreadable without a key;

multifactor authentication; backup data and limiting which employees can access sensitive data.”

Id. ¶ 90. According to Plaintiffs, Defendant knew or should have known that their PII “would be

targeted by cybercriminals” because data breaches are “widespread” and a dark web marketplace

exists for PII, particularly social security numbers. Id. ¶¶ 41, 56–60, 69–73. Plaintiffs also

challenge Defendant’s response to the cyberattack because the Notice Letter failed to disclose the

“root cause” of the breach or “the remedial measures” taken to prevent another breach. Id. ¶¶ 37–

39.

B. Plaintiffs’ Alleged Injuries

Plaintiffs claim that, as a result of Defendant’s insufficient cybersecurity practices and the

data breach, they suffered “actual injuries and damages.” Id. ¶ 94. Specifically, “(i) invasion of

privacy; (ii) theft of their PII; (iii) lost or diminished value of PII; (iv) lost time and opportunity

costs associated with attempting to mitigate the actual consequences of the Data Breach; (v) lost

opportunity costs associated with attempting to mitigate the actual consequences of the Data

Breach; (vi) statutory damages; [and] (vii) nominal damages.” Id.

Malvitz and Fredrickson each identify their own harms. Malvitz receives benefits from

Defendant because her spouse is a current employee. Id. ¶ 135. In general, she is “very careful

about sharing her sensitive” information and “never knowingly” provides her unencrypted PII over

the internet. Id. ¶ 137. Defendant obtained and retained her PII in connection with “employment-

related benefits.” Id. ¶ 135. After receiving the Notice Letter, she experienced “an increase in

spam calls, texts, and/or emails.” Id. ¶¶ 139, 142. She took steps to mitigate the harms from the

data breach, such as monitoring her accounts and purchasing mitigation tools. Id. ¶¶ 139–40. She

claims she has suffered “fear, anxiety, and stress . . .” from the increased exposure of her PII. Id.

¶ 142–44. Page 3 of 22 Fredrickson worked for Defendant intermittently from 2016 to 2023. Id. ¶ 147. He was

very “cautious” and “careful about sharing his PII.” Id. ¶ 153. After he received the Notice Letter,

he “suffered actual fraudulent misuse of his PII.” Id. ¶¶ 149–51. On or around April 18, 2024,

“third party criminal actors” used his credit card for a “fraudulent purchase of $1,145.13 . . .” Id.

¶ 151. Fredrickson had to acquire “a new credit card” and “anticipates spending considerable time

and money” to monitor his accounts and address any future harms. Id. ¶¶ 151–152, 158.

Frederickson alleges that, as a result of the data breach, he “suffered injury from a loss of privacy”

and “fear, anxiety, and stress.” Id. ¶¶ 155–159.

C. Procedural History

Malvitz filed the Complaint on January 26, 2024, and amended as of right on May 2, 2024.

ECF Nos. 2, 8. Fredrickson “voluntarily dismissed” a separate class action that he had filed against

Defendant and joined as a named Plaintiff in the Amended Complaint. MTD at 3 (citing

Fredrickson v. Fincantieri Marine Grp., LLC, Case No. 1:24-cv-0037-TSC (D.D.C. Feb. 7, 2024),

ECF No. 1). Plaintiffs sue on behalf of themselves and a nationwide class of individuals, pursuant

to Federal Rule of Civil Procedure 23. Am. Compl. ¶ 164. Plaintiffs proposed class definition is:

“All individuals in the United States whose PII was impacted as a result of the Data Breach

announced by Defendant in January 2024.” Id. Plaintiffs have not yet moved for class

certification. Their Amended Complaint asserts claims for negligence, breach of implied contract,

and unjust enrichment stemming from Defendant’s failure to protect Plaintiffs’ PII. Id. ¶¶ 176–

241. Defendant moves to dismiss under Federal Rule of Civil Procedure 12(b)(1) for lack of

subject matter jurisdiction and Rule 12(b)(6) for failure to state a claim. MTD at 1.

II. LEGAL STANDARD

Federal courts are courts of limited jurisdiction. See Gen. Motors Corp. v. EPA,

(D.C. Cir. 2004). The law presumes that “a cause lies outside [the court’s] limited Page 4 of 22 jurisdiction” unless the plaintiff establishes otherwise. Kokkonen v. Guardian Life Ins. Co. of Am.,

(1994) (citing Turner v. Bank of N. Am.,

(1799)). When deciding

a Rule 12(b)(1) motion, the court must “assume the truth of all material factual allegations in the

complaint and ‘construe the complaint liberally, granting plaintiff the benefit of all inferences.’”

Am. Nat’l Ins. Co. v. FDIC,

(D.C. Cir. 2011) (quoting Thomas v. Principi,

(D.C. Cir. 2005)). Nevertheless, “the court need not accept factual inferences

drawn by plaintiffs if those inferences are not supported by facts alleged in the complaint, nor must

the Court accept plaintiff's legal conclusions.” Disner v. United States,

(D.D.C. 2012) (quoting Speelman v. United States,

(D.D.C. 2006)).

A motion under Rule 12(b)(6) “tests the legal sufficiency of a complaint.” Browning v.

Clinton,

(D.C. Cir. 2002). To survive, a “complaint must contain sufficient

factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft

v. Iqbal,

(2009) (quoting Bell Atl. Corp. v. Twombly,

(2007)).

In other words, the plaintiff must plead “factual content that allows the court to draw the reasonable

inference that the defendant is liable for the misconduct alleged.”

(citing Twombly,

). “Threadbare recitals of the elements of a cause of action, supported by mere conclusory

statements” are insufficient.

(citing. Twombly,

). While the court must assume

that any “well-pleaded factual allegations” in a complaint are accurate, conclusory allegations “are

not entitled to the assumption of truth.”

.

III. ANALYSIS

A. Standing

Article III of the Constitution confines federal judicial power to the resolution of “Cases”

and “Controversies.” TransUnion LLC v. Ramirez, 594 U.S. ---, ---,

(2021)

(citing Raines v. Byrd,

, 819–20 (1997)). For there to be a case or controversy under Page 5 of 22 Article III, the plaintiff must have a “personal stake” in the case—in other words, standing. Raines,

. Standing is a necessary predicate to any exercise of federal jurisdiction and,

without standing, the court lacks jurisdiction. Ariz. Christian Sch. Tuition Org. v. Winn,

, 129 (2011); Dominguez v. UAL Corp.,

(D.C. Cir. 2012). To demonstrate

standing at the motion to dismiss stage, a plaintiff must plausibly plead (1) an “injury in fact,” that

is (2) “fairly traceable to the challenged action of the defendant, and not the result of the

independent action of some third party not before the court,” and that is (3) “likely” to be

“redressed by a favorable decision.” Lujan v. Defs. of Wildlife,

, 560–61 (1992); see

also Jeffries v. Volume Servs. Am., Inc.,

, 1063 (D.C. Cir. 2019).

Defendant argues that Plaintiffs’ alleged injuries—the diminution in PII value, loss of the

benefit of the bargain, increased spam, and future risks of harm—are “common injuries” that do

not qualify as a concrete, particularized, and actual or imminent for standing purposes. MTD at

5–8, 10–13. And, even if the fraudulent purchase on Fredrickson’s credit card constitutes an injury

in fact, Defendant argues it is not “fairly traceable” to Defendant. Id. at 9.

1. Injury in Fact

An injury in fact is “‘an invasion of a legally protected interest’ that is ‘concrete and

particularized,’ and . . . ‘actual or imminent, not conjectural or hypothetical.’” Spokeo, Inc., v.

Robins,

(2016) (quoting Lujan,

). Tangible harm, such as a

physical or monetary injury, readily qualifies as concrete under Article III. TransUnion,

. When evaluating intangible harm, courts “should assess whether the alleged injury to the

plaintiff has a ‘close relationship’ to a harm ‘traditionally’ recognized as providing a basis for a

lawsuit in American Courts,” such as “reputational harms, disclosure of private information, and

intrusion upon seclusion.”

(citing Spokeo,

). Because Plaintiffs seek

Page 6 of 22 prospective, injunctive relief, they must also establish “material risk of future harm” that is

“sufficiently imminent and substantial.” Id. at 2210 (citations omitted).

Defendant argues that Plaintiffs’ “mere increased risk of identity theft and mitigation

efforts are insufficient.” MTD at 10. The court disagrees. The D.C. Circuit has determined that

“identity theft . . . constitute[s] a concrete and particularized injury.” In re U.S. Off. of Pers. Mgmt.

Data Sec. Breach Litig.,

(D.C. Cir. 2019) (quoting Attias v. Carefirst Inc.,

(D.C. Cir. 2017) (“Attias I”)). Spending financial resources or time on mitigation

efforts in “response to a data breach . . . may create a concrete Article III injury when paired with

a risk of future identity theft.” Attias v. Carefirst Inc.,

, 47 (D.D.C. 2023) (“Attias

III”). Both Plaintiffs adequately allege such mitigation measures. For instance, Malvitz spent time

“monitoring her financial accounts for any indication of fraudulent activity,” and Fredrickson

pursued similar “mitigation measures.” Am Compl. ¶¶ 134–162; see Keown v. Int’l Ass’n of Sheet

Metal Air Rail Trans. Workers, No. 23-cv-3570 (CRC),

, at *3 (D.D.C. Sept.

19, 2024).

The court further agrees that Plaintiffs have shown that “their harm has a close relationship

to the harm to privacy vindicated by the common-law tort of intrusion upon seclusion.” All. for

Retired Ams. v. Bessent, --- F. Supp. 3d ----,

, at *15–16 (D.D.C. Mar. 7, 2025).

Intrusion upon seclusion at common law requires that the “defendant intentionally intruded ‘upon

the solitude or seclusion of another or [their] private affairs or concerns,’” and that the intrusion

would be “highly offensive” to a reasonable person.

at *16 (quoting Restatement (Second) of

Torts § 652B). Publicity is not required. Pileggi v. Washington Newspaper Publ'g Co., LLC, No.

CV 23-345 (BAH),

, at *6 (D.D.C. Jan. 29, 2024); see Restatement (Second) of

Torts § 652B. The harm need not perfectly align with the common law action. Courts “look for a

Page 7 of 22 close relationship” to a traditional harm, “not an exact duplicate.” All. for Retired Ams.,

, at *17 (internal quotation marks and citations omitted). At the pleading stage, Plaintiffs

have set forth sufficient facts for the court to infer that a reasonable person would find it offensive

that a third party obtained Plaintiffs’ “private and personal details,”, such as social security

numbers. Pileggi,

, at *8 (internal quotation marks and citation omitted).

Therefore, Plaintiffs satisfy the injury in fact requirement for standing.

2. Causation

Causation or traceability requires that Defendant is responsible for Plaintiffs’ injury. See

Lujan, 504 U.S. at 560–61. The injury must be fairly traceable “to the challenged action of the

defendant, and not . . . th[e] result [of] the independent action of some third party not before the

court.” Citizens for Resp. and Ethics in Wash. v. U.S. Dep’t of Treasury,

(D.D.C. 2014) (quoting Lujan,

). Defendant argues that Plaintiffs’ injuries “are

not plausibly connected” to the data breach, MTD at 4, and any injuries suffered by Plaintiffs stem

from “unknown cybercriminal[s],” which breaks the causal chain, Def.’s Reply in Support of MTD

at 2, ECF No. 11 (“Def.’s Reply”). This argument is unavailing.

At the motion to dismiss stage, Plaintiffs need only “show that injuries claimed—

substantial risk of identity theft and Plaintiff’s [] mitigation measures—are ‘fairly traceable’ to the

data breach.” Keown,

, at *3 (citing Attias I,

). Plaintiffs allege

that Defendant failed to “implement adequate and reasonable security procedures and protocols.”

Am Compl. ¶ 7. They claim that because Defendant lacked sufficient cybersecurity protections,

third parties accessed Defendant’s systems, accessing Plaintiff’s PII, during the data breach. Id.

¶ 36. As a result of the data breach, Plaintiffs spent time and money on mitigation efforts and face

increased risks of financial fraud or identity theft. Id. ¶¶ 139–44, 149–59. The allegations

Page 8 of 22 sufficiently establish that Plaintiffs’ harms are fairly traceable to Defendant’s inadequate security

measures. See Keown,

, at *3.

3. Redressability

To satisfy redressability, Plaintiffs must allege that it is “substantially likely” they will

“obtain relief that directly redresses the injury suffered.” Reed v. Goertz, 598 U.S. ---, ---,

, 960 (2023). Courts may award damages for mitigation costs incurred because of a

“substantial risk that a harm will occur.” Attias I,

(quoting Clapper v. Amnesty

Int’l, USA,

, 414 n.5 (2013)). Plaintiffs assert that they “anticipate[] spending

considerable time and money on an ongoing basis to try to mitigate and address harms caused by

the Data Breach.” Am. Compl. ¶¶ 144, 158. Engaging in such mitigation efforts was reasonable

following the data breach. See Attias I,

. “The fact that plaintiffs have reasonably

spent money to protect themselves against a substantial risk creates the potential for them to be

made whole by monetary damages.”

In addition to compensatory damages, Plaintiffs seek “injunctive relief, including

improvements to Defendant’s data security systems, future annual audits, and adequate credit

monitoring services funded by Defendant.” Am. Compl. ¶ 16. Defendant argues the court cannot

redress Plaintiff’s “purported future risk of harm” because it “cannot control the actions of

unknown cybercriminals or compel [Defendant] to modify its cybersecurity defenses to address a

data breach that has already occurred.” Def.’s Reply at 1. But that is not the injunctive relief

Plaintiffs seek; rather, they ask for injunctive relief to prevent a future data breach and to address

ongoing harms from the past data breach. See Am. Compl. ¶¶ 16, 134. They allege that their PII

“remain[s] in Defendant’s possession” and “subject to further unauthorized disclosures so long as

Defendant fails to undertake appropriate and adequate measures to protect the PII.” Id. ¶ 208. The

Page 9 of 22 court may redress the “‘substantial risk’ that their personal information will be stolen from

[Defendant] again in the future.” Keown,

, at *4.

Courts also recognize that “nominal damages suffice for redressability purposes because

American courts always have recognized that plaintiffs may pursue constitutional or common-law

causes of action even when their only redress is the symbolic award of nominal relief.” Attias v.

CareFirst, Inc.,

, 9–10 (D.D.C. 2024) (“Attias V”) (citing Uzuebunam v. Preczewski,

592 U.S. ---, ---,

(2021)). Because Plaintiffs request nominal damages, and

other forms of relief, redressability is satisfied.

For the above reasons, Plaintiffs sufficiently allege an injury in fact caused by the

Defendant and redressable by the court, and therefore have standing.

B. Choice of Law

In addition to the constitutional limitations imposed by Article III, Congress further limits

the types of cases or controversies that district courts may hear. Federal district courts typically

derive jurisdiction from two statutory grants: federal question jurisdiction,

, and

diversity jurisdiction,

§ 1332. Here, Plaintiffs bring common-law claims based on diversity

jurisdiction over actions where the amount in controversy exceeds $5,000,000 and there is minimal

diversity between the named parties pursuant to the Class Action Fairness Act of 2005. Am.

Compl. ¶¶ 18–21;

(d). When exercising diversity jurisdiction, the court must

determine the law that applies to common-law claims. Klaxon Co. v. Stentor Elec. Mfg. Co.,

(1941). Courts “must apply the choice-of-law rules of the jurisdiction in which [it]

sit[s]. . .” Wu v. Stomber,

(D.C. Cir. 2014). “D.C. choice-of-law rules require

that” the court applies “the tort law of the jurisdiction that has the ‘most significant relationship’

to the dispute.”

(citing Washkoviak v. Student Loan Mktg. Ass'n,

(D.C.

2006)). In determining which law applies, the court considers (1) “where the injury occurred,” (2) Page 10 of 22 “where the conduct causing the injury occurred,” (3) “the domicile . . . of the parties,” and (4) “the

place where the relationship is centered.”

(quoting Washkoviak,

) (internal

quotation marks omitted). Federal courts in this district must “first determine whether a ‘true

conflict’ exists between the laws of the competing jurisdictions.” Jones v. Lattimer,

(D.D.C 2014) (quoting Margolis v. U-Haul Int’l, Inc., 818 F. Supp 2d 91, 100 (D.D.C.

2011)). A “true conflict exists” when “more than one jurisdiction has a potential interest in having

its law applied” and “the law of the competing jurisdictions is different.” In re APA Assessment

Fee Litig.,

, 51–52 (D.C. Cir. 2014) (citation omitted). In such a situation, D.C. law

applies “unless the foreign state has a greater interest in the controversy.” Jones,

.

Because Plaintiffs are Wisconsin citizens and Defendant is a D.C. citizen, Am. Compl.

¶¶ 18–21, Wisconsin and D.C. may have an interest in the matter. “Wisconsin has a powerful

interest in protecting its residents from fraud and misrepresentation, while the District of Columbia

has an equally strong interest in ensuring that its corporate citizens refrain from fraudulent

activities.” Pls.’ Resp. to Def.’s MTD at 14, ECF No. 10 (“Opp’n”) (quoting Washkoviak, 900

A.2d at 180–81). The parties agree, however, that the court cannot conduct an adequate choice-

of-law analysis at the motion to dismiss stage, and neither party fully briefed the choice-of-law

issues. MTD at 13; Opp’n at 13–14. Defendant argues that Plaintiffs’ claims fail under either

jurisdiction’s standards, but urges the court to consider and “afford[] significant weight” to

Wisconsin law. Def.’s Reply at 5–9 & n.2.

In general, choice-of-law issues are “‘better suited to resolution on motions for summary

judgment,’ after an opportunity for discovery.” Jones,

n.3 (quoting La

Reunion Aerienne v. Socialist People's Libyan Arab Jamahiriya,

(D.D.C.

Page 11 of 22 2007)). The court will benefit from fulsome briefing before resolving whether Wisconsin or D.C.

law applies. See id.; In re McCormick & Co.,

(D.D.C. 2016). Because it

“cannot determine from the pleadings which jurisdiction has a greater interest in the

controversy”—as the parties concede—“in ruling on a motion to dismiss [the court] must apply

the law of the forum state, which in this case is the District of Columbia.” Washkoviak,

; see also Wu,

; In re APA Assessment Fee Litig., 766 F.3d at 54–55.

Therefore, at this juncture, the court will assess Plaintiffs’ claims under D.C. law.

C. Negligence

Defendant moves to dismiss all counts in Plaintiffs’ Amended Complaint for failure to state

a claim under Federal Rule of Civil Procedure 12(b)(6). Starting with the negligence claim, to

survive a motion to dismiss, Plaintiffs must allege “(1) the existence of a duty owed by the

defendant to the plaintiff, (2) a negligent breach of that duty by the defendant, and (3) an injury to

the plaintiff (4) proximately caused by the defendant’s breach.” Hawkins v. Wash. Metro. Area

Transit Auth.,

(D.D.C. 2018) (quoting Powell v. District of Columbia,

(D.C. 1992)).

1. Duty and Breach

“The foundation of modern negligence law is the existence of a duty owed by the defendant

to the plaintiff.” N.O.L v. District of Columbia,

, 499 n.2 (D.C. 1995) (citing Palsgraf

v. Long Island R.R.,

(N.Y. 1928)). Plaintiffs identify several potential duties that

Defendant owed them: (1) a common-law duty to use “reasonable care to secure and prevent

disclosure” of Plaintiff’s PII information; (2) a statutory duty under Section 5 of the Federal Trade

Commission Act,

, to “employ reasonable security measures”; (3) a duty of care

arising from the “special relationship” between Plaintiffs, as employees or recipients of

employment-related benefits; and (4) a duty to follow “industry standards to protect [] PII.” Am Page 12 of 22 Compl. ¶¶ 181–90. Plaintiffs allege sufficient facts for the court to infer that Defendant owed (and

breached) a common-law duty of care to secure and prevent disclosure of Plaintiffs’ PII. Plaintiffs’

alternative theories—statutory obligations, special relationship, and industry standards—support

their breach allegations, but do not impose an independent duty giving rise to a negligence claim.

In general, “one has a duty to guard against only foreseeable risks.” Novak v. Cap. Mgmt.

& Dev. Corp.,

, 911–12 (D.C. Cir. 2006) (citation omitted). Under D.C. law, the

relationship between the parties determines “the foreseeability of the plaintiff’s injury and,

ultimately, the scope of the defendant’s duty.” Hedgepeth v. Whitman Walker Clinic,

(D.C. 2011). For “a party who is at arms’ length,” there is “only a minimal duty” of care.

Once the parties enter into a relationship, however, a defendant must exercise the degree of care

corresponding to the relationship.

If the asserted injury results from intervening criminal acts

of a third party, a heightened showing of foreseeability is required. See Bd. of Trs. of Univ. of D.C.

v. DiSalvo,

(D.C. 2009). And in “some circumstances under District of

Columbia law [] even a failure to act will give rise to a legal duty.” Attias v. Carefirst,

(D.D.C. 2019) (“Attias II”), on reconsideration in part,

(D.D.C.

2021).

Plaintiffs sufficiently allege that Defendant owed and breached a common-law duty of care

owed to Plaintiffs. Defendant acquired Plaintiffs’ PII as a condition of employment and receiving

employment-related benefits. Am Compl. ¶ 48. In doing so, Defendant assumed a duty to take

reasonable care with Plaintiffs’ PII. See Collier v. District of Columbia,

(D.D.C. 2014) (referencing heightened duty for “employer and employee” relationship); Keown,

, at *8. Defendant allegedly breached this duty by failing to implement

reasonable safeguards to “protect their [] PII from reasonably foreseeable threat of a cyberattack

Page 13 of 22 and data breach.” Am Compl. ¶ 182. Plaintiffs allege that Defendant knew or should have known

that “unprotected or exposed PII” is “valuable and highly sought after by nefarious third parties

seeking to illegally monetize” stolen PII. Id. ¶ 57. Based on the “known high frequency of [] data

breaches targeting employers in possession of PII,” a cyberattack was foreseeable. Id. ¶¶ 196.

Plaintiffs claim Defendant failed to guard against this reasonably foreseeable risk by not taking

adequate security measures, including following the “industry standards for an employer’s

obligations to its employees and their beneficiaries with respect to data privacy,” FTC guidelines

for data security practices, and Microsoft Protection Intelligence to prevent and detect data

breaches. Id. ¶¶ 42–45, 80, 93.

Accepting these allegations as true, the court finds that Plaintiffs have sufficiently

established that a cyberattack was foreseeable based on Defendant’s inadequate security practices,

the value of Plaintiffs’ PII, and the prominence of identity thefts and data breaches. See In re U.S.

Off. of Pers. Mgmt. Data Sec. Breach Litig., 928 F.3d at 55–56 (citing Attias I,

,

628–29). To the extent Defendant’s security measures would violate the FTC Act or fall short of

industry standards, such allegations support Plaintiffs’ claim of breach. Keown,

at *9. Thus, Plaintiffs have plausibly alleged Defendant owed and breached a duty.

2. Causation and Injury

Plaintiffs must identify “more than speculative harm from defendant’s allegedly negligent

conduct.” Randolph v. ING Life Ins. & Annuity Co.,

(D.C. 2009) (quoting In

re Estate of Curseen v. Buchanan Ingersoll, P.C.,

, 194 (D.C. 2006)). “Threat[s] of

future harm,” which have not materialized, “do[] not suffice to create a cause of action for

negligence.” Hillbroom v. PricewaterhouseCoopers LLP,

(D.C. 2011) (quoting

Knight v. Furlow,

(D.C. 1989)). In the data breach context, a plaintiff may

Page 14 of 22 satisfy injury in fact for Article III standing but fail to meet the injury threshold to state a

negligence claim. See Attias II,

. Here, Plaintiffs allege several harms: (1)

mitigation costs and heightened risk of PII misuse, (2) lost or diminished value of PII, (3) invasion

of privacy, (4) emotional distress, and (5) statutory or nominal damages. Am Compl. ¶¶ 6, 141,

206–07.

i. Mitigation Costs and Heightened Risk of Misuse

“The District of Columbia Court of Appeals has expressly declined to treat an increased

risk of future identity theft” and “time and money spent protecting against future identity theft” as

damages for negligence claims based on data breaches. See Attias II,

, 14

(quoting Randolph, 973 A.2d at 708–09); Keown,

, at *9. Allegations of actual

misuse or economic injury, not speculations as to future misuse or economic harms, are sufficient,

however. Attias II,

(“Only the [plaintiffs]—who. . . have alleged actual

misuse in the form of tax-refund fraud—would be able to recover consequential damages like the

money spent monitoring their credit.”); Keown,

, at *9.

Applying that rule here, the court finds that Fredrickson alleges “actual fraudulent misuse

of his PII.” Am. Compl. ¶ 151. He claims that after the data breach, “third party criminal actors

used [his] PII to initiate a fraudulent purchase of $1,145.13 [] on his credit card.”

As a result,

Fredrickson had to obtain a new credit card and spent “considerable time and money” to mitigate

the ensuing harms. Id. ¶¶ 152, 158. The fraudulent charge on his card and costs associated with

remedying the misuse of his PII qualify as damages. Attias II,

. The

court may also plausibly infer a causal connection between Defendant’s negligence and

Fredrickson’s injury. Fredrickson alleges that he is “very careful about sharing his sensitive PII”

and “has never knowingly transmitted unencrypted sensitive PII over the internet or any other

Page 15 of 22 unsecured source.” Am. Compl. ¶ 153. After his PII—including his social security number—was

stolen during the data breach, he received fraudulent credit card charges.

¶¶ 152–58. At the

motion to dismiss stage, these facts permit a plausible inference that Defendant’s inadequate

security measures caused the data breach, which then caused Fredrickson’s injury. Attias II,

n.4 (Even without “specific facts connecting the two events,” court “plausibly

inferred” causation “when considering a motion under Rule 12(b)(6).”).

Malvitz’s allegations present a closer question. She does not allege any specific fraudulent

charges, but claims she suffered “an increase in spam calls, texts, and/or emails” and spent

“valuable time” on mitigation activities. Am Compl. ¶¶ 140–43. The question is whether “spam

calls, texts, and/or emails,” id. ¶ 142, constitute a “present injury,” rather than “anticipation of

future injury that has not materialized,” Randolph,

. At least one court in this

district has answered yes. In Keown, the court concluded that “an increase in spam, calls, texts,

and/or emails” and time “dealing with these effects . . . is much closer to [a] present injury to

[Plaintiff’s] PII than to efforts to mitigate potential future harm.”

, at *10.

Therefore, the plaintiff alleged an actual injury sufficient to support a negligence claim under D.C.

law.

(citing Guo Wengui v. Clark Hill, PLC,

, 37 (D.D.C. 2020)); see also

Attias II,

(Allegations “listing what ‘identify thieves’ ‘can’ or ‘may’ do”

with PII are insufficient, but actual misuse permits recovery for mitigation efforts). Although it is

a close question, the court reaches the same conclusion at this stage. Because Malvitz alleges

actual misuse through “increased spam calls, texts, and/or emails,” Am. Compl. ¶ 142, she alleges

an actual injury sufficient to state a negligence claim.

Page 16 of 22 ii. Lost or diminished value of PII

Plaintiffs’ allegations that they suffered damages for lost or diminished value of their PII

cannot sustain a negligence claim. When addressing injury in fact for Article III standing, courts

have “routinely rejected the proposition that an individual’s personal identifying information has

an independent monetary value.” See, e.g., Welborn v. IRS,

(D.D.C. 2016)

(collecting cases). Plaintiffs allege that “an active and robust legitimate marketplace for PII

exists,” but fail to plead facts showing how the unauthorized access to their PII diminishes its

value. Am. Compl. ¶¶ 116–19, 120. To the contrary, Plaintiffs allege the information

compromised in the data breach remains particularly valuable. Id. ¶ 121. Moreover, they do not

assert that they intended to sell their PII or participate in the marketplace. Without allegations that

“their personal information became less valuable as a result of the [data] breach or that they

attempted to sell their information and were rebuffed because of a lower price-point attributable

to the breach,” Plaintiffs fail to allege damages based on a change in value. Welborn,

; see also Keown,

, at *10 (Even though Plaintiff’s PII “decreased in

‘rarity,’” they did not claim that they intended to “sell [the] information on the black market in the

first place, so it is uncertain how they were injured by this alleged loss.”).

iii. Invasion of Privacy

Invasion of privacy is a distinct intentional tort, which Plaintiffs do not assert, but a loss of

privacy “may constitute ‘damage to the interests of the plaintiff’ sufficient to support a claim of

negligence if the defendant has a duty to prevent such damage.” Keown,

, at

*10 (citing District of Columbia v. Cooper,

(D.C. 1984)). PII must be disclosed

to a third party to establish an invasion of privacy, however. In re Sci. Applications Int'l Corp.

(SAIC) Backup Tape Data Theft Litig.,

(D.D.C. 2014). “[C]onduct giving

Page 17 of 22 rise to the unauthorized viewing of [PII] such as plaintiff’s Social Security number . . . can

constitute an intrusion . . .” Randolph,

; see also Vassiliades v. Garfinckel’s,

Brooks Bros.,

(D.C. 1985) (“[I]nvasion of privacy ‘represents a vindication of

the right to private personality and emotional security.” (citation omitted)). Here, Plaintiffs

plausibly allege that third parties obtained unauthorized access to their PII, which Defendant had

a duty to safeguard. See supra Section III.C.1. The third parties “accessed and obtained”

Plaintiffs’ PII, including their names, dates of birth, Social Security numbers, dates of service,

insurance participant IDs, and member numbers. Am. Compl. ¶¶ 4, 139, 149. Disclosure of such

information constitutes an “actual harm to [Plaintiffs’] interest in privacy. . . both judicially

cognizable and recognized at common law.” Keown,

, at *11.

iv. Emotional Distress

Plaintiffs’ emotional distress allegations also support their negligence claim. Plaintiffs

may “recover for pain and suffering as ‘parasitic’ damages as a result of or incident to the ‘invasion

of another legally protected interest.’” Attias II,

(quoting Hedgepeth,

). If a plaintiff seeks only damages for mental pain and suffering, they must satisfy

either the zone of physical danger rule or “the special relationship and undertaking rule.”

(citations omitted). Here, Plaintiffs allege an increase in “fear, anxiety, and stress” because of the

data breach. Am Compl. ¶¶ 142, 157. Their distress “stems from the invasion of another legally

protected interest,” privacy, so they may seek “parasitic” damages. Keown,

, at

*11 (citation omitted). Because Plaintiffs’ injuries are “neither purely economic nor purely

emotional,” they need not satisfy the alternative paths to recover emotional distress damages.

Page 18 of 22 v. Economic Loss Doctrine

Defendant argues that the economic loss doctrine bars Plaintiffs’ recovery in negligence.

MTD at 14–15. That doctrine precludes recovery for purely economic losses in tort, unless a

special relationship exists. Attias II,

; see also Aguilar v. RP MRP Wash.

Harbour, LLC,

, 985–86 (D.C. 2014) (“The economic loss doctrine in the District of

Columbia bars recovery of purely economic losses in negligence, subject to only one limited

exception where a special relationship exists.”). Plaintiffs do not seek purely economic losses. As

explained, Plaintiffs adequately allege harm to their privacy interests and emotional distress

damages, in addition to economic losses from mitigation efforts.

For the reasons stated above, Plaintiffs state a negligence claim and the court will deny

Defendant’s motion to dismiss Count I.

D. Breach of Implied Contract

Defendant contends that Plaintiffs’ claim fails because they “fail to plead the necessary

elements”—offer, acceptance, and consideration—for a valid contract governing Plaintiffs’ PII.

MTD at 17–19. The court disagrees. Under D.C. law, “an implied-in-fact contract contains ‘all

necessary elements of a binding agreement,’ differing from other contracts ‘only in that it has not

been committed to writing’ and is instead ‘inferred from the conduct of the parties.’” Shaffer v.

George Wash. Univ.,

(D.C. Cir. 2022) (quoting Camara v. Mastro’s Rests. LLC,

(D.C. Cir. 2020)). “To prevail on a claim of breach of contract, a party must

establish (1) a valid contract between the parties; (2) an obligation or duty arising out of the

contract; (3) a breach of that duty; and (4) damages caused by breach.” Molock v. Whole Foods

Market, Inc.,

(D.D.C. 2018) (quoting Francis v. Rehman,

(D.C. 2015)); see also Paul v. Howard Univ.,

(D.C. 2000) (citation

omitted). To survive a motion to dismiss, however, “it is enough for the plaintiff to describe the Page 19 of 22 terms of the alleged contract and the nature of the defendant’s breach.” Molock,

(quoting Francis,

).

Courts have found that where there is no history, course of dealing, or series of statements

to support a contractual relationship, there can still be a “contractual duty to take reasonable

measures to secure customer PII.” Attias v. CareFirst, Inc., No. 15-CV-882 (CRC),

, at *6 (D.D.C. Sept. 13, 2023) (“Attias IV”). In both Attias and Keown, courts found

implied contract claims where privacy notices or practices were provided or accessible to

plaintiffs. See Attias IV,

, at *6–7; Keown,

, at *13. Such

notices included assurances that the defendant took steps to protect PII. Attias IV,

at *6–7. Plaintiffs identify similar assurances by Defendant in this case, specifically,

Defendant's “Privacy Policy” and website representations. Am Compl. ¶¶ 29, 220; Opp’n at 21.

Defendant’s website stated that

Our website is scanned on a regular basis for security holes and known vulnerabilities in order to make your visit to our site as safe as possible. We use regular Malware Scanning. Your personal information is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems, and are required to keep the information confidential. In addition, all PII/information you supply is encrypted via Secure Socket Layer (SSL) technology. We implement a variety of security measures when a user submits, or accesses their information to maintain the safety of your personal information. All transactions are processed through a gateway provider and are not stored or processed on our servers.

Am. Compl. ¶ 29 (formatting modified).

Defendant’s website “speaks to an obligation to take affirmative steps to ‘protect’

[Plaintiffs] PII.” Attias IV,

, at *7. Further, Plaintiffs allege that Defendant

required them to provide their PII in order to obtain benefits. Am. Compl. ¶ 213. They claim that,

in doing so, Defendant implicitly “agreed” to “reasonably safeguard” the information from

“unauthorized access or disclosure.” Id. ¶ 219. Drawing all inferences in Plaintiffs’ favor, that

Page 20 of 22 assumption is reasonable. See Keown,

at *13 (“[I]t is difficult to imagine how,

in our day and age of data and identity theft, the mandatory receipt of Social Security or other

sensitive personal information would not imply the recipients assent to protect the information

sufficiently.” (citing Attias IV,

at *6–7)). Therefore, Plaintiffs adequately state

the key contract terms.

Turning to the second requirement—breach—Plaintiffs need only identify the nature of the

alleged breach. Molock,

. They claim that Defendant breached by failing

to “take adequate cybersecurity measures” to safeguard their PII and storing the data in

unencrypted files. Am. Compl. ¶ 67. Accepting these allegations as true, the court finds that

Plaintiffs’ breach of implied contract claim survives, and it will deny Defendant’s motion to

dismiss Count II.

E. Unjust Enrichment

Finally, Defendant moves to dismiss Plaintiffs’ unjust enrichment claim, arguing that

Plaintiffs do not plausibly allege that they provided anything in exchange for data security or that

Defendant retained any benefit unjustly. MTD at 23–25. Unjust enrichment “rests on a contract

implied in law,” which permits recovery “in the absence of any contract, actual or implied in fact.”

United States ex rel. Modern Elec., Inc. v. Ideal Elec. Sec. Co.,

(D.C. Cir. 1996),

(citing Bloomgarden v. Coyer,

(D.C. Cir. 1973)). It requires that “(1) the

plaintiff conferred a benefit on the defendant; (2) the defendant retains the benefit; and (3) under

the circumstances, the defendant’s retention of the benefit is unjust.” Butler v. Enter. Integration

Corp.,

, 101 (D.D.C. 2020) (quoting News World Commc’ns, Inc. v. Thompson,

(D.C. 2005)). Plaintiffs cannot recover under both unjust enrichment and

breach of contract theories, but appropriately plead this claim in the alternative. See Fed. R. Civ.

P. 8(a)(3); Shaffer,

. Page 21 of 22 Plaintiffs fail to state a claim for unjust enrichment. They allege that they “conferred

monetary benefit on Defendant by providing [] their PII and [] labor” and that Defendant saved

money on security costs and unjustly enriched itself by profiting from Plaintiffs’ work. Am.

Compl. ¶¶ 232–235. This falls short of unjust enrichment. First, Plaintiffs fail to allege that

Defendant derived any benefit or value from Plaintiffs’ PII. There is no assertion that Defendant

ran analytics on Plaintiffs’ PII or used it for an independent business purpose. MTD at 14 n.4.

Rather, Defendant required Plaintiffs’ PII as a condition of employment and to provide

employment-related benefits. Am. Compl. ¶ 48. Second, Defendant did not unjustly benefit from

Plaintiffs’ labor. Malvitz was not Defendant’s employee but received benefits as an employee’s

spouse. Id. ¶ 135. Therefore, she did not provide Defendant with any labor. Although Fredrickson

worked for Defendant, id. ¶ 147, he received a salary, and therefore Defendant did not unjustly

retain the benefit of his labor. The Complaint “does not identify any profit reaped by [Defendant]

that is attributable to use of Plaintiff’s data, nor does it allege that Plaintiffs gave [Defendant] any

money that should have been used for data security.” See Keown,

, at *14.

Therefore, the court will dismiss Plaintiffs’ unjust enrichment claim.

IV. CONCLUSION

For the foregoing reasons, the court will DENY Defendant’s motion to dismiss Plaintiffs’

negligence and breach of contract claims, but GRANT Defendant’s motion as to Plaintiffs’ unjust

enrichment claim. An Order shall accompany this Opinion.

Date: June 12, 2025

Tanya S. Chutkan TANYA S. CHUTKAN United States District Judge

Page 22 of 22