FILED Jun 05 2025, 8:53 am CLERK Indiana Supreme Court Court of Appeals and Tax Court

IN THE Court of Appeals of Indiana Kevin McLinden, Appellant-Plaintiff, v. Tangoe U.S., Inc., Appellee-Defendant.

June 5, 2025 Court of Appeals Case No. 24A-PL-1617 Appeal from the Marion Superior Court The Honorable Kurt Eisgruber, Judge Trial Court Cause No. 49D06-2312-PL-48384

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 1 of 9 Opinion by Senior Judge Crone Judges Brown and Felix concur.

Crone, Senior Judge.

[1] Kevin McLinden seeks reinstatement of his lawsuit against his former employer, Tangoe U.S., Inc., for damages resulting from a data breach. He contends the trial court erred by dismissing his complaint for lack of standing.

Concluding that McLinden has demonstrated harm sufficient to confer standing at the pleading stage, we reverse and remand for further proceedings.

Facts and Procedural History [2] Unless otherwise noted, the following facts are taken from McLinden’s complaint and are assumed true for purposes of this appeal. See infra Hoosier Contractors, LLC v. Gardner, 212 N.E.3d 1234, 1239 (Ind. 2023). Tangoe is an IT services and consulting company that is headquartered in Indiana and employs thousands of individuals around the globe. Appellant’s App. Vol. II, pp. 13, 14 (Complaint). As a condition of employment, Tangoe requires individuals to provide private information, including their social security numbers. Id. at 14.

[3] Between November 15 and 17, 2022, Tangoe’s information system was accessed by an unknown third party without authorization. Id. at 34 (Ex. A to

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 2 of 9 Complaint). The third party obtained the personally identifiable information (“PII”) of numerous current and former Tangoe employees, including McLinden. Data involved in the breach included names, dates of birth, social security numbers, medical information, health insurance information, medication information, medical billing/claims information, and financial account information. Id.

[4] Upon discovering the breach, Tangoe took steps to secure its system and launched an investigation to determine the nature and scope of the incident. Id. Tangoe did not immediately alert affected individuals of the data breach; instead, it delayed notification to McLinden and others until one year later. Id. at 34 (Ex. A to Complaint), 38 (Ex. B to Complaint). The notice stated that Tangoe was not aware of any misuse of personal information as a result of the breach, provided the toll free phone number for the dedicated call center for questions and concerns, encouraged recipients to review their account

We recognize this is a developing area of law as nearly 4,000 new cyberattacks occur every day, and every seconds, a company falls victim to a ransomware attack. https://www.getastra.com/blog/security- audit/how-many-cyber-attacks-per-day/#The_State_of_Cyberattacks_today [https://perma.cc/24QJ-UN98] (last visited May 29, 2025). In 2023, there were 6.06 billion malware attacks globally. https://www.varonis.com/blog/data-breach-statistics#breaches-by-the-numbers [https://perma.cc/9B6K- 7X4F] (last visited May 29, 2025). Indeed, as two of our judges have pointed out, the technological advancements that have digitized our lives and, in many ways made tasks quicker and easier to accomplish, are not without their drawbacks. Judge Crone highlighted the increase in speed and ease with which sensitive, personal information can now be accessed and “broadcast to the public.” Robbins v. Trs. of Ind.

Univ., 45 N.E.3d 1, 13 (Ind. Ct. App. 2015) (Crone, J., concurring in part and concurring in result in part).

More recently, Judge Bailey similarly observed that “with the ubiquity of digital data, it is easier than ever for unwanted third parties to obtain—and share—sensitive information.” F.B.C. v. MDwise, Inc., 122 N.E.3d 834, 839 (Ind. Ct. App. 2019) (Bailey, J., dissenting), trans. denied, abrogated by Cmty. Health Network, Inc. v. McKenzie, 185 N.E.3d 368 (Ind. 2022).

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 3 of 9 statements and monitor their credit reports for suspicious activity, and offered to provide, at its expense, two years of credit monitoring and identity theft restoration services. Id. at 34 (Ex. A to Complaint), 38-39 (Ex. B to Complaint).

[5] McLinden brought this putative class action, alleging negligence, negligence per se, breach of implied contract, unjust enrichment, and breach of bailment.

Tangoe moved to dismiss the action for lack of standing under Trial Rule 12(B)(6). The court granted Tangoe’s motion, and McLinden moved the court to reconsider that decision. The court denied McLinden’s motion, and he now appeals.

Discussion and Decision [6] There are several standards of review at work here. First, the order being appealed is the trial court’s denial of McLinden’s motion to reconsider the dismissal of his lawsuit for lack of standing. However, McLinden’s motion to reconsider is actually a motion to correct error. A motion to correct error asks the trial court to revisit its final judgment, while a motion to reconsider must be posed and ruled upon prior to the entry of final judgment. Barclays Inv. Funding LLC v. Jamalee Invs., LLC, 186 N.E.3d 659, 661 (Ind. Ct. App. 2022) (quoting Hubbard v. Hubbard, 690 N.E.2d 1219, 1221 (Ind. Ct. App. 1998)). Accordingly, because the trial court’s dismissal of this action is a final judgment, McLinden’s motion requesting the court to revisit that decision is a motion to correct error, which we review for an abuse of discretion. Derr Enters., LLC v. Union City Ind.

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 4 of 9 Props., LLC, 253 N.E.3d 1129, 1133 (Ind. Ct. App. 2025). Such occurs when the decision is against the logic and effect of the facts and circumstances before the court or is contrary to law. Id.

[7] Motions to dismiss for lack of standing may be brought under Rule 12(B)(6) for failure to state a claim upon which relief can be granted. Hoosier Contractors, 212 N.E.3d at 1239 (quoting Thomas v. Blackford Cnty. Area Bd. of Zoning Appeals, 907 N.E.2d 988, 990 (Ind. 2009)). When evaluating such a motion on appeal, we take the alleged facts as true, consider them in the light most favorable to the non-movant, and draw every reasonable inference in favor of the non-movant.

Hoosier Contractors, 212 N.E.3d at 1239.

[8] “The threshold issue of standing determines whether a litigant is entitled to have a court decide the substantive issues of a dispute.” Solarize Ind., Inc. v. S.

Ind. Gas & Elec. Co., 182 N.E.3d 212, 216 (Ind. 2022). Indiana law is clear that standing requires a party to demonstrate that it has suffered or is in immediate danger of suffering a direct injury as a result of the conduct at issue. Hoosier Contractors, 212 N.E.3d at 1238 (quoting Solarize, 182 N.E.3d at 217). Where, as here, an action is at the pleading stage, “a claimant’s general factual allegations of injury arising from the defendant’s conduct may suffice to satisfy standing.” Hoosier Contractors, 212 N.E.3d at 1239. “Whether a party has standing is a legal question we review de novo.” Id. at 1238.

[9] McLinden argues that the court erred in concluding that the time and money he allegedly spent avoiding identity theft is not an injury sufficient to confer

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 5 of 9 standing. In his complaint, McLinden alleged that he has “suffered and will continue to suffer damages, including monetary losses, lost time, anxiety, and emotional distress.” Appellant’s App. Vol. II, p. 17 (Class Action Complaint, ¶ 49). He additionally claimed that he has “suffered or [is] at an increased risk of suffering”:

a. The loss of the opportunity to control how [his] PII is used;

b. The diminution in value of [his] PII;

c. The compromise and continuing publication of [his] PII;

d. Out-of-pocket costs associated with the prevention, detection, recovery, and remediation from identity theft or fraud;

e. Lost opportunity costs and lost wages associated with the time and effort expended addressing and attempting to mitigate the actual and future consequences of the Data Breach, including, but not limited to, efforts spent researching how to prevent, detect, contest, and recover from identity theft and fraud;

f. Delay in receipt of tax refund monies;

To support his argument, McLinden offers up, both in his brief and in his filing of additional authority, cases that apply federal principles of standing. While these cases may be instructive to our decision, they are not binding upon us. See Schulz v. State, 731 N.E.2d 1041, 1044 (Ind. Ct. App. 2000) (recognizing that federal limits on justiciability have no direct applicability to cases brought under state law because state constitution does not contain case or controversy requirement but acknowledging that federal limits are nonetheless instructive because standing requirement under both constitutions fulfills purpose of ensuring litigant is entitled to have court decide merits of dispute) (quotations and citations omitted), trans. denied.

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 6 of 9 g. Unauthorized use of stolen PII; and

h. The continued risk to [his] PII, which remains in the possession of defendant and is subject to further breaches so long as defendant fails to undertake the appropriate measures to protect the PII in their possession.

Id. at 17-18.

[10] It is clear in Indiana that an economic loss satisfies the actual injury requirement for standing purposes. See, e.g., Mercer Belanger Pro. Corp. v. Gaeta, 241 N.E.3d 1159, 1172 (Ind. Ct. App. 2024) (concluding plaintiff had met standing requirements where he alleged injury in the form of monetary damages, specifically the payment of attorney’s fees to defend himself against debt collector’s illegal mortgage foreclosure efforts), trans. denied. Accepting the alleged facts as true and drawing all reasonable inferences in favor of McLinden as we are bound to do, we conclude his allegations of monetary loss are sufficient to satisfy the requirement of an injury in order to establish standing.

[11] We note that McLinden alternatively argued that the mere disclosure of his private information is itself an injury sufficient to establish standing.

Specifically, he claims that the disclosure of his PII, though an intangible harm, constitutes a concrete injury; ergo, he has standing. He bases his argument on a misreading of TransUnion LLC v. Ramirez, 594 U.S. 413 (2021). There, the United States Supreme Court held that certain intangible harms that bear “a close relationship to harms traditionally recognized as providing a basis for

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 7 of 9 lawsuits in American courts[,]” such as disclosure of private information, can constitute concrete injuries for standing purposes. Id. at 425.

[12] However, the allegation of a recognized cause of action does not automatically equate to the existence of standing; they are two wholly distinct concepts.

Accordingly, even if McLinden alleges a cause of action under our state’s newly-recognized tort of disclosure, he must still satisfy the standing requirements of direct injury or the immediate danger thereof.

Conclusion [13] Based on the foregoing, we conclude that McLinden met our state requirements for standing at the pleading stage in that his allegations of monetary damages constitute an injury.

[14] Reversed and remanded.

Brown, J., and Felix, J., concur.

Indiana has only recently recognized an invasion of privacy tort claim based on the public disclosure of private facts. In 2022, our Supreme Court explicitly recognized such a claim and explicitly adopted the disclosure tort as it is articulated in the Restatement (Second) of Torts § 652D. See Cmty. Health Network, Inc., N.E.3d at 382. The court stated the four elements of the disclosure tort as: (1) the information disclosed must be private in nature; (2) the disclosure must be made to the public; (3) the disclosure must be one that would be highly offensive to a reasonable person; and (4) the information disclosed is not of legitimate public concern.

Id.

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 8 of 9 ATTORNEYS FOR APPELLANT Lynn A. Toops Amina A. Thomas Arend J. Abel Cohen and Malad Indianapolis, Indiana ATTORNEY FOR APPELLEE Kimberly Castellino Metzger McCarter & English, LLP Carmel, Indiana

Court of Appeals of Indiana | Opinion 24A-PL-1617 | June 5, 2025 Page 9 of 9