In re Whitworth University Data Breach

1 U.S. FDILISETDR IINC TT HCEO URT 2 EASTERN DISTRICT OF WASHINGTON Jan 23, 2024 SEAN F. MCAVOY, CLERK 5 UNITED STATES DISTRICT COURT 6 EASTERN DISTRICT OF WASHINGTON 8 NO. 2:23-CV-00179-SAB In re Whitworth University Data Breach ORDER DENYING 11 DEFENDANT’S MOTION TO 12 DISMISS 14 Before the Court is Defendant’s Motion to Dismiss. ECF No. 16. The motion was heard without oral argument. Plaintiff Patrick Loyola is represented by Kevin Laukaitis, Brian Bleichner, and Samuel Strauss. Plaintiff Rachel Wilson is represented by Jason Dennett, Kaleigh Boyd and Kim Stephens. Plaintiff Danielle Wyman is represented by Samuel Strauss. Defendant is represented by David Liu and David Spellman.

20 On September 20, 2023, Plaintiffs collectively filed an Amended Consolidated Complaint against Defendant Whitworth University. ECF No. 15.

22 Plaintiffs assert that Defendant failed to properly secure and safeguard their and class members protected health information (PHI) and personally identifiable information (PII) stored on Defendant’s information network.

25 Plaintiffs are bringing five claims on behalf of themselves and the class: 1) negligence; 2) breach of implied contract; 3) breach of the implied covenant of good faith and fair dealing; 4) unjust enrichment; and 5) violation of the Washington Consumer Protection Act. Defendant now moves to dismiss Counts Two (breach of implied contract); Three (breach of good faith and fair dealing); and Four (unjust enrichment) for failure to state a claim upon which relief may be granted. For the reasons stated below, the Court denies the motion.

4 Motion Standard 5 To survive a motion to dismiss under Rule 12(b)(6), a complaint must allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corps.

7 v. Twombly, 550 U.S. 544, 570 (2007). A claim is plausible on its face when “the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). The Ninth Circuit explain: To be entitled to the presumption of the truth, allegations in a 12 complaint or counterclaim may not simply recite the elements of a cause of action but must contain sufficient allegations of underlying facts to give fair notice and to enable the opposing party to defend 14 itself effectively. The factual allegations that are taken as true must plausibly suggest an entitlement to relief, such that it is not unfair to require the opposing party to be subject to the expense of discovery 16 and continued litigation.

17 Starr v. Baca, 652 F.3d 1202, 1216 (9th Cir. 2011).

18 When evaluating a Rule 12(b)(6) motion, the court must draw all reasonable inferences in favor of the non-moving party. Navarro v. Block, 250 F.3d 729, 732 (2001). However, the court is not required to accept conclusory allegations as true or to accept any unreasonable inferences in a complaint. In re Gilead Scis. Sec. 22 Litig., 536 F.3d 1049, 1054 (9th Cir. 2008).

23 Plaintiff’s Complaint 24 In July 2022, cybercriminals gained access to Defendant’s network and obtained Plaintiffs’ PHI/PII. Plaintiffs assert they provided Defendant with this information as required to apply for enrollment at Whitworth University. Almost a year later, Defendant sent a letter to Plaintiffs stating that their PHI/PII was involved in a Data Breach.

1 Plaintiffs allege they spent time dealing with the consequences of the Data Breach, which included time spent verifying the legitimacy and impact of the Data Breach, time spent exploring credit monitoring and identity theft insurance options, time spent self-monitoring accounts with heightened scrutiny and time spent seeking legal counsel regarding their options for remedying and/or mitigating the effects of the Data Breach. They assert they have increased anxiety about their loss of privacy and anxiety over the impact of cybercriminals accessing, using, and selling their PHI/PII.

9 Specifically, in July 2023, Plaintiff Wyman experienced fraud and identity theft. Someone, not Plaintiff, called her bank to ask for an increase to her line of credit. Her credit history also showed a fraudulent pending mortgage loan in Florida, a loan for a 2018 Toyota Camry and attempts to open at least 7 bank accounts and at least 7 credit cards. Several credit cards/loans were opened or requested in Plaintiff’s name. As a result, her credit score dropped, and she spent at least 15 hours dealing with the fraudulent activity.

16 Analysis 17 A. Breach of Implied Contract 18 1. Plaintiffs’ Allegations 19 In their Consolidated Complaint, Plaintiffs allege that through its course of conduct, Defendant, Plaintiffs and Class Members entered into implied contracts for Defendant to implement data security adequate to safeguard and protect the privacy of Plaintiffs’ and Class Members’ PHI/PII. In doing so, Defendant required Plaintiffs and Class Members to provide and entrust their PHI/PII to obtain Defendant’s services. Plaintiffs and Class Members accepted Defendant’s offers and provided their PHI/PII to Defendant. A meeting of the minds occurred when Plaintiffs and Class Members agreed to and did provide their PHI/PII to Defendant in exchange for, amongst other things, the protection of their PHI/PII.

28 // 1 2. Analysis 2 Under Washington law, there are three essential elements to establish a breach of contract: 1) the parties entered into an enforceable contract; 2) Defendant breached the contract as claimed by Plaintiffs; and 3) Plaintiffs were damaged because of Defendant’s breach. Nw. Indep. Forest Mfrs v. Dep’t of Labor & Indus., 78 Wash.App. 707, 712 (1995).

7 Plaintiffs have alleged sufficient facts to plead a cause of action for breach of implied contract. Plaintiffs alleged the parties had an implicit agreement that Defendant would safeguard Plaintiffs PHI/PII data, Defendant breached the agreement, and Plaintiffs were damaged.

11 B. Breach of Implied Covenant of Good Faith and Fair Dealing 12 1. Plaintiffs’ Allegations 13 Plaintiffs allege that Defendant breached the implied covenant of good faith and fair dealing by failing to maintain adequate computer systems and data security practices to safeguard PHI/PII, failing to timely and accurately disclose the Data Breach to Plaintiffs and Class Members, and continued acceptance of PHI/PII and storage of other personal information after Defendant knew, or should have known, of the security vulnerabilities of the systems that were exploited in the Data Breach.

20 Plaintiffs allege Defendant acted in bad faith and/or with malicious motive in denying Plaintiffs and Class Members the full benefit of their bargains as originally intended by the parties, thereby causing them injury in an amount to be determined at trial.

24 2. Analysis 25 Washington law requires parties to perform in good faith the obligations imposed by their agreement. Rekhter v. State, Dep’t of Soc. And Health Servs,, 180 27 Wash.2d 102, 112 (2004). The duty arises only in connection with the terms agreed to by the parties, including those terms where one party has discretionary authority to determine a future contract term. Id. at 113.

2 Plaintiffs have sufficiently plead a cause of action for breach of the implied duty of good faith.

4 C. Unjust Enrichment 5 1. Plaintiffs’ Allegations 6 In their Consolidated Complaint, Plaintiffs allege the following: 7 Defendant benefited by unduly taking advantage of Plaintiffs and Class members. Specifically, Defendant, before and at the time Plaintiffs and Class Members entrusted their PHI/PII to Defendant to enroll in or apply to one of Defendant’s programs, caused Plaintiffs and Class Members to reasonably believe that Defendant would keep such PHI/PII secure.

12 Defendant was aware, or should have been aware, that reasonable students would have wanted their PHI/PII kept secure and would not have contracted with Defendant, directly or indirectly, had they known that Defendant’s information systems were sub-standard for that purpose. Defendant was also aware that if the substandard condition of and vulnerabilities in its information systems were disclosed, it would negatively affect Plaintiffs’ and Class Members’ decisions to seek services therefrom.

19 Defendant failed to disclose facts about its substandard information systems, defects, and vulnerabilities before Plaintiffs and Class Members decided to purchase, engage in commerce, and seek services or information. Instead, Defendant suppressed and concealed such information. By concealing and suppressing that information, Defendant denied Plaintiffs and Class Members the ability to make a rational and informed purchasing and health care decision and took undue advantage of Plaintiffs and Class Members.

26 Defendant was unjustly enriched at the expense of Plaintiffs and Class Members, as Defendant received profits, benefits, and compensation, in part, at the expense of Plaintiffs and Class Members; however, Plaintiffs and Class Members 1|| did not receive the benefit of their bargain because they paid for products that did not satisfy the purposes for which they bought/sought them. Since Defendant’s 3|| profits, benefits, and other compensation were obtained improperly, Defendant is not legally or equitably entitled to retain any of the benefits, compensation, or 5|| profits realized from these transactions.

2. Analysis Under Washington law, “[u]njust enrichment is a method of recover for the value of the benefit retained absent any contractual relationship because notions of fairness and justice require it,” Young v. Young, 164 Wash.2d 477, 484 (2008).

10 A party claiming unjust enrichment must prove three elements: (1) the defendant received a benefit; (2) the received benefit was at the plaintiff's expense; and (3) the circumstances made it unjust for the defendant to retain the benefit without payment. Jd.

14 Plaintiffs have sufficiently plead a cause of action for unjust enrichment.

15 Accordingly, IT IS HEREBY ORDERED: 16 1. Defendant’s Motion to Dismiss, ECF No. 16, is DENIED.

17 IT IS SO ORDERED. The District Court Executive is hereby directed to 18|| file this Order and provide copies to counsel.

19 DATED this 23rd day of January 2024.

Sucker Ecc Yoar byt Sec 25 Stanley A. Bastian 26 Chief United States District Judge ORDER DENYING DEFENDANT?’S MOTION TO DISMISS ~ 6