Hanff et al v. SuperValu Inc.
MEMORANDUM OPINION AND ORDER in case 0:14-md-2586-ADM-TNL; granting (78) Defendant SuperValu, Inc.'s Renewed Motion to Dismiss Plaintiffs' Consolidated Amended Class Action Complaint; granting (85) Defendants AB Acquisition, LLC and New Al bertson's, Inc.'s Renewed Motion to Dismiss Plaintiffs' Consolidated Amended Class Action Complaint; denying (91) Class Plaintiffs' Motion for Leave to Amend Their Amended Complaint Pursuant to Fed. R. Civ. P. 15(a)(2); the Consol idated Amended Class Action Complaint is dismissed with prejudice (Written Opinion). Signed by Judge Ann D. Montgomery on 3/7/2018. Associated Cases: 0:14-md-02586-ADM-TNL, 0:14-cv-03252-ADM-TNL, 0:14-cv-04660-ADM-TNL, 0:14-cv-05017-ADM-TNL, 0:14-cv-05089-ADM-TNL(TLU)
UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF MINNESOTA
IN RE: SuperValu, Inc., Customer Data
Security Breach Litigation
Court File No. 14-MD-2586 ADM/TNL
This Document Relates to:
Ben Barnow, Esq., Barnow and Associates, P.C., Chicago, IL; Kate M. Baxter-Kauf, Esq.,
Lockridge Grindal Nauen P.L.L.P., Minneapolis, MN, on behalf of Plaintiffs.
Harvey J. Wolkoff, Esq., and David T. Cohen, Esq., Ropes & Gray LLP, New York, NY and
Boston, MA; Katherine S. Barrett Wiik, Esq., and Stephen P. Safranski, Esq., Robins Kaplan
LLP, Minneapolis, MN, on behalf of Defendant SuperValu, Inc.
John L. Landolfi, Esq., Vorys, Sater, Seymour and Pease LLP, Columbus, OH; and Marc A. Al,
Esq., Stoel Rives LLP, Minneapolis, MN, on behalf of Defendants AB Acquisition, LLC and
New Albertson’s Inc.
On December 14, 2017, the undersigned United States District Judge heard oral argument
on Defendant SuperValu, Inc.’s (“SuperValu”) Renewed Motion to Dismiss Plaintiffs’
Consolidated Amended Class Action Complaint [Docket No. 78], Defendants AB Acquisition,
LLC and New Albertson’s, Inc.’s (together, “Albertson’s”) Renewed Motion to Dismiss
Plaintiffs’ Consolidated Amended Class Action Complaint [Docket No. 85], and Class Plaintiffs’
Motion for Leave to Amend Their Amended Complaint Pursuant to Fed. R. Civ. P. 15(a)(2)
[Docket No. 91]. For the reasons set forth below, SuperValu and Albertson’s Motions are
granted and Plaintiffs’ Motion is denied.
A. Data Breach
In this multi-district litigation case, sixteen named plaintiffs (“Plaintiffs”) alleged they
were harmed after computer hackers breached the payment-processing network owned by
SuperValu. See Consolidated Am. Class Action Compl. (“Amended Complaint”) [Docket No.
28] ¶¶ 16–45. Both SuperValu and Albertson’s (collectively, “Defendants”) used the network to
process payment card transactions at more than 1,000 of Defendants’ retail grocery stores. Id.
¶¶ 3–5. The hackers gained access to and installed malicious software on the paymentprocessing network in June 2014 and again in late July or early September 2014. Id. ¶¶ 4–6.
The malicious software released and disclosed the Personal Identifying Information (“PII”) of
Plaintiffs and Class Members who used their payment cards at the affected stores. Id. ¶ 36. The
PII included cardholder names, account numbers, expiration dates, card verification value
(“CVV”) codes, and personal identification numbers (“PINs”). Id. ¶¶ 1, 40, 42. Plaintiffs
alleged the malware allowed hackers to harvest customers’ PII from cash registers and other
payment processing terminals at the time customers swiped their cards. Id. ¶¶ 36, 40. Hackers
were also able to access customers’ PII that had been improperly stored on Defendants’ network
after customers made purchases at Defendants’ stores. Id. ¶ 41.
Of the sixteen named Plaintiffs whose data was allegedly stolen in the breach, only one
The factual background of this case is further detailed in this Court’s January 7, 2016
Memorandum Opinion and Order [Docket No. 52] and the Eighth Circuit’s August 30, 2017
Opinion [Docket No. 73], which are incorporated by reference. See In re: SuperValu, Inc.,
Customer Data Security Breach Litig., No. 14-2586, 2016 WL 81792 (D. Minn. Jan. 7, 2016)
(“Dismissal Order”); In re: SuperValu, Inc., Customer Data Security Breach Litig., 870 F.3d 763
(8th Cir. 2017) (“Eighth Cir. Op.”).
Plaintiff, David Holmes (“Holmes”), alleged that his PII was misused. See id. ¶¶ 16–31.
Holmes alleged that he:
shopped at the Shop ‘n Save location [owned and operated by
SuperValu] in Belleville, Illinois, and swiped his card through
Defendants’ POS [point of sale] terminals. On information and belief
Holmes’ PII was compromised as a result of Defendants’ security
failures. When the Data Breach was announced, Plaintiff Holmes
spent time determining if his card had been compromised, including
but not limited to, reviewing information released about the Data
Breach and impacted locations. Shortly thereafter, Holmes noticed
a fraudulent charge on his credit card, which took two weeks to
replace. As a result of such compromise, Holmes suffered losses and
damages in an amount yet to be completely determined, as such
losses and damages are ongoing and include, but are not limited to,
time spent monitoring his account information to guard against
Id. ¶ 31. Holmes’ factual allegations do not state the date he shopped at the store, the date the
charge was made to his credit card, the amount of the charge, or whether he was required to pay
the charge. See id.
The other fifteen named Plaintiffs did not allege that their PII was misused. Rather, they
alleged that the theft of their PII subjects them to an imminent risk that they will suffer identity
theft in the future. Id. ¶ 60.
B. Procedural History
Following the breach, four putative class actions were filed in federal courts in Illinois,
Minnesota, and Idaho. See, McPeak v. SuperValu, Inc., 14-cv-00899 (S.D. Ill., filed Aug. 18,
2014); Hanff v. SuperValu Inc., 14-cv-3252 (D. Minn., filed Aug. 25, 2014); Mertz v.
SuperValu, Inc., 14-cv-04660 (D. Minn., filed Nov. 4, 2014); and Rocke v. SuperValu, Inc., 14cv-00511 (D. Idaho, filed Nov. 26, 2014). In December 2014, the Judicial Panel on Multidistrict
Litigation centralized the four complaints to this Court for coordinated pre-trial proceedings.
See Transfer Order [Docket No. 1]. On June 26, 2015, pursuant to this Court’s first Pretrial
Order [Docket No. 14], Plaintiffs filed the Amended Complaint with sixteen named plaintiffs
bringing claims on behalf of a putative class of persons affected by the data breach.
1. Defendants’ Initial Motion to Dismiss
On August 10, 2015, Defendants moved to dismiss the Complaint under Federal Rules of
Civil Procedure 12(b)(1) and 12(b)(6). See Defs.’ Mot. Dism. [Docket No. 33]. On January 7,
2016, this Court granted the motion pursuant to Rule 12(b)(1), finding that none of the Plaintiffs
had alleged facts sufficient to establish Article III standing. See generally Dismissal Order. The
Court held that Plaintiffs had not plausibly alleged a cognizable injury because (1) they failed to
allege misuse of their PII or other harm that was traceable to the data breach, and (2) they had
not alleged facts that plausibly suggested a substantial risk of future harm. Id. at *4–7.
In reaching this conclusion, the Court reasoned that because the Amended Complaint
alleged only a single incident in which any Plaintiff’s PII had been misused in the year and a half
since the data breach affecting more than 1,000 stores had occurred, any future harm was
speculative. Id. at *5. Future harm depended upon whether the hackers who accessed
Defendants’ network actually succeeded in capturing the information, whether the hackers would
attempt to use the information, and whether their attempts would be successful. Id.
The Court also rejected Plaintiffs’ additional theories of standing that were based upon:
opportunity and mitigation costs, diminished value of Plaintiffs’ payment card PII, delayed or
inadequate notification of the data breach, invasion of Plaintiffs’ privacy and breach of their PII
confidentiality, and Plaintiffs’ lost expectation of a bargained-for benefit. Id. at *7–8.
Finding that Plaintiffs lacked standing under Article III, the Court concluded that it was
without subject matter jurisdiction to address Defendants’ Rule 12(b)(6) argument that the
Amended Complaint failed to state a claim for which relief can be granted. The Amended
Complaint was dismissed without prejudice and final judgment was entered. Id. at *8; Judgment
[Docket No. 53].
2. Plaintiffs’ Rule 59(e) Motion
On February 4, 2016, Plaintiffs filed a post-judgment motion under Rule 59(e), seeking
to vacate the judgment and dismissal of the Amended Complaint. See Pls.’ Mot. Alter Amend J.
[Docket No. 54]. Alternatively, Plaintiffs requested leave to amend the Amended Complaint but
did not submit a proposed Second Amended Complaint. Id.
In support of their motion, Plaintiffs offered, for the first time, declarations of three credit
union officers who averred that some payment cards issued by their respective institutions
incurred fraudulent charges following the data breach. Id. Ex. 3 (“Anderson Decl.”); Pls.’ Index
[Docket No. 61] Ex. 1 (“Malinowski Decl.”), Ex. 2 (“Williams Decl.”). Significantly, the
declarations did not state that any of the compromised cards belonged to a named Plaintiff or that
any cardholder incurred unreimbursed fraudulent charges or other bank charges. Id. Indeed, one
declaration stated that the fraudulent charges on cards issued by that credit union were all
“absorbed” by the institution. Anderson Decl. ¶ 6.
The Court denied the Rule 59(e) motion, finding: (1) Plaintiffs had not shown that they
exercised diligence in obtaining the newly discovered evidence prior to judgment; and (2) none
of the tardily filed declarations established that any named Plaintiff or potential class member
suffered actual harm or faced a substantial risk of imminent future harm from the potential
misuse of their PII. Mem. Op. Order, Apr. 20, 2016 [Docket No. 66] (“Rule 59(e) Order”) at
The Court also denied Plaintiffs’ request for leave to amend the Amended Complaint
because Plaintiffs had not satisfied the more stringent standards governing post-judgment leave
to amend, and because Plaintiffs failed to comply with the requirement under Local Rule 15.1(b)
that a motion to amend a pleading must include “a copy of the proposed amended pleading” and
“a version of the proposed amended pleading that shows . . . how the proposed amended
pleading differs from the operative pleading.” Id. at 8 (quoting L.R. 15.1(b)) .
Plaintiffs then appealed the Court’s Dismissal Order to the Eighth Circuit, but did not
appeal the denial of the Rule 59(e) motion. See Eighth Cir. Op. at 767 n.2 (declining to consider
arguments raised in Plaintiffs’ Rule 59(e) motion or declarations attached to the motion because
Plaintiffs did not appeal the denial of the Rule 59(e) motion).
On appeal, Plaintiffs argued that the following three rulings in the Dismissal Order were
erroneous: (1) that Plaintiffs had not adequately alleged the theft of their personal information,
and that theft alone was not insufficient to confer Article III standing; (2) that Plaintiff Holmes
did not have standing because the misuse of his PII was not fairly traceable to the Data Breach;
and (3) that the breach of Plaintiffs’ alleged implied contractual right to have their PII securely
handled and reasonably protected was not sufficient to confer standing. See Appellant’s
Opening Br. (filed July 13, 2016 in Eighth Circuit Appeal No. 16-2378) at 2–3, 9. Defendants
cross-appealed, arguing that the Amended Complaint was alternatively subject to dismissal
under Rule 12(b)(6) for failure to state a claim upon which relief could be granted. Eighth Cir.
Op. at 774 n.7.
On August 30, 2017, the Eighth Circuit “reverse[d] the district court’s dismissal of
plaintiff Holmes for lack of Article III standing, affirm[ed] the dismissal as to the remaining
plaintiffs, and remand[ed] for further proceedings consistent with this order.” Id. at 774.
In upholding the dismissal of the fifteen Plaintiffs who did not allege that their PII had
been misused, the Eighth Circuit found that the Amended Complaint alleged only a “mere
possibility,” rather than a substantial risk, that Plaintiffs would suffer future identity theft or
account fraud. Id. at 771.
The Eighth Circuit explained that the only factual support for the otherwise bare assertion
that data breaches facilitate identity theft was a 2007 report by the United States Government
Accountability Office (“GAO Report”), and this report did not support Plaintiffs’ contention that
they face a substantial risk of future harm as a result of the data breach. Id. at 770–71. The
GAO Report stated that credit card information alone is generally not enough for identity thieves
to open unauthorized new accounts. The Eighth Circuit noted that the PII alleged to have been
stolen here was limited to credit card information and did not include personally identifying
information such as social security numbers, birth dates, or drivers’ license numbers.
Additionally, the GAO Report concluded that “most breaches have not resulted in detected
incidents of identity theft.” Id. at 771 (quoting GAO Report at 21). The Eighth Circuit thus
concluded that the GAO Report supported only a “mere possibility” of future injury. Id.
Because the Amended Complaint did not plausibly demonstrate that the risk of future identity
theft is substantial, Plaintiffs’ allegations of future injury were not sufficient to confer standing.
The Eighth Circuit also rejected Plaintiffs’ attempt to establish injury based on other
theories, including the costs Plaintiffs incurred to mitigate against the risk of identity theft, and
Defendants’ alleged breach of an implied contract to take reasonable measures to protect
Plaintiffs’ PII. Regarding mitigation costs, the Eighth Circuit held that “[b]ecause plaintiffs have
not alleged a substantial risk of future identity theft, the time they spent protecting themselves
against this speculative threat cannot create an injury.” Id. As to the alleged breach of an
implied contract, the Eighth Circuit held that “the complaint does not sufficiently allege that
plaintiffs were party to such a contract. Therefore, the breach of implied contract claim does not
supply plaintiffs with Article III standing.” Id. at 771 n.6.
The Eighth Circuit declined to address other “independent forms of injury discussed by
the district court, including the argument that the invasion of privacy suffered by the plaintiffs
constitutes an injury in fact, because the plaintiffs did not press them on appeal.” Id. at 771 n.5.
The Eighth Circuit held that Holmes, the Plaintiff who alleged that his stolen PII was
misused in a single fraudulent charge, met the “relatively modest” burden of alleging a present
injury that was fairly traceable to the data breaches. Id. at 772. Thus, Holmes was the only
Plaintiff who satisfied the “threshold inquiry” of Article III standing. Id. at 773. However, the
Eighth Circuit forecast that Defendants’ attacks on the sufficiency of Holmes’ allegations,
including that he “failed to allege the date he shopped at the affected Illinois store, the amount of
the charge, or that the charge was unreimbursed . . . could be fatal to the complaint under the
‘higher hurdles’ of Rules 8(a) and 12(b)(6).” Because the issue of whether Holmes’ allegations
were sufficient to state a claim under Rule 12(b)(6) raises a different question than Article III
standing, the Eighth Circuit concluded that the challenges to the sufficiency of Holmes’
allegations were “more properly directed at whether the complaint states a claim, not whether
Holmes has alleged standing.” Id.
The Eighth Circuit thus concluded that since one named Plaintiff, Holmes, has standing
to bring suit, the case should not have been dismissed for lack of subject matter jurisdiction. Id.
at 774. The Court of Appeals expressly declined to consider Defendants’ Rule 12(b)(6)
arguments on appeal and remanded them to this Court. Id. at 774 n.7.
C. Present Motions
Following the Eighth Circuit’s remand for consideration of Defendants’ Rule 12(b)(6)
motion, SuperValu filed a renewed motion to dismiss under Rule 12(b)(6) for failure to state a
claim. SuperValu argues that the claims by Holmes suffer from fatal defects, including the
failure to allege that he shopped at SuperValu’s stores during the relevant time period or that he
suffered economic injury as a result of the data breach.
Albertson’s also filed a renewed motion to dismiss, arguing that Holmes’ claims against
Albertson’s should be dismissed under 12(b)(1) for failure to allege Article III standing.
Albertson’s contends that Holmes has not alleged that he shopped at an Albertson’s store, and
thus has not alleged an injury that is causally related to Albertson’s or that can be redressed by a
ruling against Albertson’s. Albertson’s also incorporates and adopts the arguments in
SuperValu’s renewed motion to dismiss under Rule 12(b)(6).
Approximately one week after Defendants filed their renewed motions to dismiss,
Plaintiffs moved for leave to amend the Amended Complaint. Plaintiffs argue that the Proposed
Second Amended Class Action Complaint (“Proposed Second Amended Complaint”) [Docket
No. 91, Ex. 1] includes additional factual allegations that support Article III standing for the
dismissed Plaintiffs by showing that those Plaintiffs face a substantial risk of future injury.
Plaintiffs contend that they are entitled to amend the Amended Complaint as a matter of course
and that they should be permitted to amend before Defendants’ renewed motions to dismiss are
A. Plaintiffs’ Motion for Leave to Amend the Amended Complaint
Plaintiffs argue that leave to amend the Amended Complaint is warranted under the
liberal standard of Federal Rule of Civil Procedure 15(a). Plaintiffs contend that the Proposed
Second Amended Complaint “adds allegations related to the increased risk of harm for plaintiffs
previously dismissed for lack of standing, in addition to including additional allegations related
to liability for Defendants.” Mem. Supp. Class Pls.’ Mot. Am. Compl. [Docket No. 93] at 4.
1. Legal Standard
The proper standard for granting leave to amend a complaint depends upon whether leave
is sought before or after judgment has been entered. Pre-judgment leave to amend is governed
by Federal Rule of Civil Procedure 15(a), which provides in relevant part:
(a) Amendments Before Trial.
(1) Amending as a Matter of Course. A party may amend its
pleading once as a matter of course within:
(A) 21 days after serving it, or
(B) if the pleading is one to which a responsive
pleading is required, 21 days after service of a
responsive pleading or 21 days after service of a
motion under Rule 12(b), (e), or (f), whichever is
(2) Other Amendments. In all other cases, a party may amend
its pleading only with the opposing party’s written consent or
the court's leave. The court should freely give leave when
justice so requires.
Fed. R. Civ. P. 15(a).
“Although a pretrial motion for leave to amend one’s complaint is to be liberally granted,
different considerations apply to motions filed after dismissal.” Humphreys v. Roche Biomedical
Labs., Inc., 990 F.2d 1078, 1082 (8th Cir. 1993). “[I]nterests of finality dictate that leave to amend
should be less freely available after a final order has been entered.” United States ex rel. Roop v.
Hypoguard USA, Inc., 559 F.3d 818, 823 (8th Cir. 2009). It is “well-settled that district courts in
this circuit have considerable discretion to deny a [timely] post judgment motion for leave to amend
because such motions are disfavored, but may not ignore the Rule 15(a)(2) considerations that favor
affording parties an opportunity to test their claims on the merits.” United States v. Mask of KaNefer-Nefer, 752 F.3d 737, 742–43 (8th Cir. 2014) (internal quotations omitted) (alteration in
original). Leave to amend after a judgment of dismissal “will be granted if it is consistent with the
stringent standards governing the grant of Rule 59(e) and Rule 60(b) relief.” Id. at 743 (citing Dorn
v. State Bank of Stella, 767 F.2d 442, 443–44 (8th Cir. 1985)).
Whether leave to amend is sought pre judgment or post judgment, it is appropriately denied
“where there are compelling reasons such as undue delay, bad faith, or dilatory motive, repeated
failure to cure deficiencies by amendments previously allowed, undue prejudice to the non-moving
party, or futility of the amendment.” Moses.com Sec., Inc. v. Comprehensive Software Sys., Inc.,
406 F.3d 1052, 1065 (8th Cir. 2005) (internal quotations omitted).
a. Rule 15(a)(1) Does Not Apply
Plaintiffs contend that they are entitled to amend the Amended Complaint as a matter of
course under Rule 15(a)(1), and that they filed their motion for leave to amend under Rule
15(a)(2) out of an abundance of caution. Plaintiffs argue that Rule 15(a)(1) applies because
Plaintiffs sought leave to amend within 21 days of Defendants’ renewed motions to dismiss
under Rule 12(b). However, Defendants served an initial motion to dismiss under Rule 12(b) in
August 2015, and Plaintiffs did not amend as a matter of course within 21 days after service of
the initial Rule 12(b) motion. Therefore, Rule 15(a)(1) does not apply. See Rule 15(a)(1)(B)
(permitting a party to amend its pleading “21 days after service of a motion under Rule 12(b)”).
b. Compelling Reasons Exist to Deny Leave to Amend
Plaintiffs alternatively argue that leave to amend is proper under Rule 15(a)(2).
Defendants concede that Rule 15(a)(2) applies to the surviving Plaintiff Holmes, but argue that
the dismissed Plaintiffs must satisfy the more stringent standard of Rule 60(b) because judgment
has been entered against them. Defendants also argue that regardless of whether Rule 15(a)(2)
or Rule 60(b) applies, leave to amend should be denied based on undue delay and the futility of
the proposed amendment.
The Court need not resolve the question of whether Rule 15(a)(2) or Rule 60(b) applies,
because under either standard leave to amend is appropriately denied. The compelling reasons
of undue delay and futility of the amendment both weigh strongly against granting leave to
“[A] party is not entitled to amend a complaint without making a showing that such an
amendment would be able to save an otherwise meritless claim. A district court thus may deny a
motion to amend a complaint when such an amendment would be futile.” Plymouth Cty., Iowa
v. Merscorp, Inc., 774 F.3d 1155, 1160 (8th Cir. 2014) (internal citation omitted); see also
Moses.com, 406 F.3d at 1065 (listing futility of amendment as basis for denial of leave to
amend); Humphreys, 990 F.2d at 1082 (“It is settled law that district courts may properly deny
leave to amend if the proposed changes would not save the complaint.”).
A. New Allegations Fail to Cure Standing Deficiencies
Plaintiffs argue that the new allegations in the Proposed Second Amended Complaint
provide the factual support that the Eighth Circuit required to support their allegation of a
substantial risk of future injury. Defendants disagree and argue that the new allegations are
insufficient to support Article III standing for the dismissed Plaintiffs.
None of the new allegations in the Proposed Second Amended Complaint are addressed
specifically to a named Plaintiff. See generally Proposed Second Am. Compl. Rather, the new
factual allegations contend that three credit union officers have reported that some payment
cards issued by their institutions were compromised in the data breach, and that some accounts
incurred fraudulent charges. Id. ¶¶ 76–78. The payment cards referenced, however, are not
alleged to have belonged to any of the named Plaintiffs. See id. The proposed allegations also
include information from three research reports regarding the frequency of credit card fraud and
the sensitivity of credit card names and numbers. See id. ¶¶ 73, 81–82. Additionally, Plaintiffs
seek to allege that “[t]he FBI estimated that, during 2014, more than 1,000 retailers were under
assault with the same (or tweaked versions) of the malware that compromised Target and Home
Depot.” Id. ¶ 58.
The new allegations in the Proposed Second Amended Complaint do not cure the Article
III deficiencies identified by the Eighth Circuit. The credit union allegations were considered by
this Court in January 2016 when ruling on Plaintiffs’ Rule 59(e) motion. In support of that
motion, Plaintiffs submitted declarations by the same three credit union officers attesting to the
same information that is now included in the Proposed Second Amended Complaint. Compare
Proposed Second Am. Compl. ¶¶ 75–78 with Anderson Decl.; Malinowski Decl.; Williams Decl.
In denying Plaintiffs’ Rule 59(e) motion, which included a request for leave to amend the
Amended Complaint, this Court concluded that the declarations would not alter the finding that
Plaintiffs lacked Article III standing because the declarations “do not establish that any named
Plaintiff . . . suffered actual harm or faces a substantial risk of imminent future harm from the
potential misuse of their PII.” Rule 59(e) Order at 7. Plaintiffs did not appeal that ruling, and
the Court will not revisit its prior ruling. See Macheca Transp. Co. v. Philadelphia Indem. Ins.
Co., 737 F.3d 1188, 1195–96 (8th Cir. 2013) (“A party who successfully obtains a remand
following an initial appeal has already gotten a second bite at the apple. We should not permit
such parties to hold in reserve an argument regarding a particular issue . . . just so they can
attempt to receive yet [another] bite at the same apple . . . . To conclude otherwise would be
unfair to opposing parties, encourage piecemeal appeals, and undermine our procedural
efficiency.”). Thus, it is futile for Plaintiffs to amend their complaint to allege Article III
standing based on facts that this Court has already ruled are not sufficient to confer standing.
The new allegations drawn from the three research reports are similarly futile because the
reports do not plausibly demonstrate a substantial risk that Plaintiffs will suffer from future
identity theft or credit card fraud. One of the reports, the February 2014 Javelin Identity Theft
Report (the “Javelin Report”) states that “[n]early 40% of those whose card numbers were
compromised in 2013 became fraud victims (46% if this card was a debit card).” Id. ¶ 73
(quoting Javelin Report). Thus, this report establishes that the majority of consumers whose
payment cards are compromised in a breach will not become fraud victims as a result of the
The other two research reports were published in 2010 and 2012 and discuss the
technological ability to “link” information about an individual with other logically associated
information about that individual. Id. ¶¶ 81–82. Plaintiffs argue that these allegations overcome
the Eighth Circuit’s observations that “compromised credit or debit card information, like the
Card Information here, generally cannot be used alone to open unauthorized accounts,” and that
there was “little to no risk” that the Plaintiffs’ stolen PII could be used to commit identity theft
by opening unauthorized accounts. Eighth Cir. Op. at 770. However, the technology discussed
in the 2010 and 2012 reports was in existence in 2013, the time period covered in the Javelin
Report finding that fewer than half of consumers whose credit cards were compromised became
victims of identity theft or credit card fraud. Thus, the allegations about the technological ability
to link information are insufficient to tip the balance from a mere possibility to a substantial risk
that Plaintiffs will suffer identity theft or credit card fraud in the future.
Similarly, the allegation that the FBI estimated that more than 1,000 retailers were
attacked with the same or similar malware that compromised Target and Home Depot’s
computer networks does not cure the deficiencies to Article III standing identified by the Eighth
Circuit. In determining that Plaintiffs failed to allege a substantial risk of future injury, the
Eighth Circuit took as true the allegations that SuperValu’s payment processing network had
been attacked by malware. That numerous other retailers were also attacked has no bearing on
whether the Plaintiffs here face a substantial risk of future injury.
Because Plaintiffs’ proposed new allegations do not cure the Article III standing
deficiencies identified by the Eighth Circuit, the Proposed Second Amended Complaint is futile.
B. Proposed Second Amended Complaint Fails Under 12(b)(6)
The Proposed Second Amended Complaint is futile for the additional reason that it
cannot withstand Defendants’ renewed motions under Rule 12(b)(6). For the reasons discussed
in Section III.B.1. below, the Amended Complaint fails to state a claim upon which relief can be
granted, and the new allegations in the Proposed Second Amended Complaint do not alter this
result. Therefore, the Proposed Second Amended Complaint is futile and Plaintiffs’ motion for
leave to amend the Amended Complaint is denied on this basis.
ii. Undue Delay
Additionally, Plaintiffs’ attempt to now include the credit union information in the
Proposed Second Amended Complaint constitutes undue and prejudicial delay. Plaintiffs chose
not to appeal this Court’s previous ruling that the credit union information does not establish a
substantial risk of future harm.
Although delay alone is not a sufficient reason to deny leave to amend a complaint,
denial of leave to amend is proper where the delay results in prejudice to the opposing party.
Buder v. Merrill Lynch, Pierce, Fenner & Smith, Inc., 644 F.2d 690, 694 (8th Cir. 1981). A
court must balance the prejudice that would result to the opposing party if the motion for leave to
amend were granted against the hardship to the moving party if the motion were denied. Id.
Here, Defendants spent considerable time and money on appeal litigating the issue of
whether the Amended Complaint sufficiently alleged a substantial risk of future harm. The
Eighth Circuit’s extensive analysis of this issue did not include the credit union information
because Plaintiffs did not appeal this Court’s Rule 59(e) ruling. Eighth Cir. Op. at 767 n.2.
Only after the Eighth Circuit has decided against Plaintiffs on the issue of whether they have
sufficiently alleged a substantial risk of future harm do Plaintiffs resurrect the credit union
arguments already rejected by this Court and not appealed to the Eighth Circuit. Allowing this
eleventh hour attempt to resuscitate its complaint with previously rejected factual contentions is
inexcusable delay which unfairly prejudices Defendants.
In resisting this conclusion, Plaintiffs argue that Defendants will not be prejudiced by the
proposed amendment because this Court’s dismissal of Plaintiffs’ case was without prejudice to
Plaintiffs’ filing another action. However, Defendants would be prejudiced by having to defend
a revived action that is based on previously rejected and unappealed arguments.
Plaintiffs also argue that they will be prejudiced if they are not allowed to amend because
Defendants have purportedly failed to comply with Plaintiffs’ discovery requests2 regarding the
circumstances of the data breach, and because Defendants stated in their press releases
announcing the data breach that they had not determined whether cardholder data had in fact
been stolen or misused. Plaintiffs contend that denial of leave to amend will prevent them from
responding to Defendants’ defenses after full discovery and from trying their claims on the
This argument misses the mark because the vehicle for redressing deficient discovery
responses is a motion to compel discovery, not a motion for leave to amend the complaint.
This Court issued a Pretrial Order on April 28, 2015 permitting Plaintiffs to serve
discovery requests “on the following topics: (1) Defendants’ corporate structure, corporate
relationships, and respective responsibilities with respect to payment-card data security; and (2)
when the data breach occurred, the number of cards affected by the breach and whether data was
taken or used.” Pretrial Order No. 2 [Docket No. 15] ¶ A.3.
Perhaps recognizing the flaws in their argument, Plaintiffs filed a motion to compel discovery
responses on January 31, 2018, more than two months after the present Motions were fully
briefed, and more than six weeks after oral argument on the present Motions. See Pls.’ Mot.
Compel [Docket No. 109]; Min. Entry [Docket No. 108] (stating that a hearing was held on
December 14, 2017 on Defendants’ renewed motions to dismiss and Plaintiffs’ motion for leave
to amend Amended Complaint, and that the motions were taken under advisement). Rather than
demonstrating hardship to Plaintiffs, the discovery motion serves as another example of
Plaintiffs’ dilatory conduct. If Plaintiffs’ ability to allege Article III standing rests so critically
upon the discovery responses, as Plaintiffs appear to contend, they should not have waited to
move to compel those responses until after the case had been dismissed, appealed, remanded and
undergone full briefing and argument on a second round of dispositive motions.3 Thus,
Defendants’ prejudice outweighs any purported hardship to Plaintiffs.
Accordingly, the motion for leave to amend the Amended Complaint is denied on
grounds of both futility and undue delay.
B. Renewed Motions to Dismiss
1. SuperValu’s Renewed Motion to Dismiss
SuperValu argues that the Amended Complaint must be dismissed under Rule 12(b)(6)
because the only remaining Plaintiff, Holmes, fails to state a claim for relief under any of the
Amended Complaint’s six causes of action.
Plaintiffs’ Motion to Compel was orally denied without prejudice by Magistrate Judge
Tony N. Leung on February 27, 2018. See Min. Entry [Docket No. 124].
a. Rule 12(b)(6) Standard
Rule 12 of the Federal Rules of Civil Procedure states that a party may move to dismiss a
complaint for failure to state a claim upon which relief can be granted. Fed. R. Civ. P. 12(b)(6).
The court construes the pleadings in the light most favorable to the nonmoving party, and the
facts alleged in the complaint must be taken as true. Hamm v. Groose, 15 F.3d 110, 112 (8th
Working in combination with Rule 8, Rule 12 requires the plaintiff’s factual allegations
to “raise a right to relief above the speculative level,” and push claims “across the line from
conceivable to plausible.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 570 (2007). In other
words, the complaint must establish more than a “sheer possibility that a defendant has acted
unlawfully.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A pleading must relate “enough facts
to state a claim to relief that is plausible on its face.” Twombly, 550 U.S. at 570. “A claim has
facial plausibility when the plaintiff pleads factual content that allows the court to draw a
reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at
678. Determining whether a complaint states a plausible claim for relief is “a context-specific
task that requires the reviewing court to draw on its judicial experience and common sense.” Id.
“But where the well-pleaded facts do not permit the court to infer more than the mere possibility
of misconduct, the complaint has alleged—but not ‘shown’—‘that the pleader is entitled to
relief.’” Id. (quoting Fed. R. Civ. P. 8(a)(2)).
In contrast to Article III standing, which “presents only a ‘threshold inquiry,” Federal
Rules of Civil Procedure 8(a) and 12(b)(6) present “higher hurdles,” which require a plaintiff to
“plead facts sufficient to ‘raise a right to relief above the speculative level.’” Brown v.
Medtronic, Inc., 628 F.3d 451, 459 (8th Cir. 2010) (quoting Twombly, 550 U.S. at 555); accord
Eighth Cir. Op. at 773.
b. Choice of Law
As an initial matter, the Court must determine which state’s law applies to the state law
issues raised by sole Plaintiff Holmes’ claims. A district court sitting in diversity typically
applies the choice-of-law rules of the forum state in which it sits. Prudential Ins. Co. v. Kamrath
of Am., 475 F.3d 920, 924 (8th Cir. 2007); In re Guidant Corp. Implantable Defibrillators Prods.
Liab. Litig., 489 F. Supp. 2d 932, 934–35 (D. Minn. 2007). In multi-district litigation, however,
the forum state is normally the state where the action was filed before it was transferred to the
court presiding over the multi-district pretrial proceedings. Guidant, 489 F. Supp. 2d at 935.
Holmes filed his original complaint in Illinois. Thus, the Court will apply Illinois choice-of-law
For common law claims, Illinois courts typically apply the law of the state that bears the
most “significant relationship” to the occurrence and the parties in the action. Gregory v. Beazer
E., 892 N.E.2d 563, 581 (Ill. App. Ct. 2008) (tort); Champagnie v. W.E. O’Neil Constr. Co., 395
N.E.2d 990, 996 (Ill. App. Ct. 1979) (contract). SuperValu argues that Illinois has the most
significant relationship to this case because it is where Holmes is domiciled and where he
completed the transaction alleged in his claims. SuperValu thus contends that Illinois law
governs Holmes’ common law claims. Holmes does not argue otherwise and states that he
“assumes Illinois law applies.” Pls.’ Mem. Opp’n SuperValu’s Renewed Mot. Dism. [Docket
No. 99] at 7. Therefore, the Court will apply Illinois law to Holmes’ common law claims.
Similarly, Holmes’ statutory claims are governed by Illinois’ consumer protection
statutes, because as an Illinois resident Holmes lacks sufficient contacts with other states to
assert their consumer protection laws. See Ferrari v. Best Buy Co., No. 14-2956, 2015 WL
2242128, at *9 (D. Minn. May 12, 2015) (“[N]amed plaintiffs lack standing to assert claims
under the laws of the states in which they do not reside or in which they suffered no injury.”)
(quoting Insulate SB, Inc. v. Advanced Finishing Sys., Inc., No. 13-2664, 2014 WL 943224, at
*11 (D. Minn. Mar. 11, 2014)) (quoting in turn In re Ductile Iron Pipe Fittings (DIPF) Indirect
Purchaser Antitrust Litig., No. 12-169, 2013 WL 5503308, at *11 (D.N.J. Oct. 2, 2013)).
c. Analysis of Claims
i. Negligence (Count III)
To state a valid cause of action for negligence under Illinois law, a plaintiff must plead
“the existence of a duty owed by the defendant, a breach of that duty, and injury proximately
resulting from that breach.” Bogenberger v. Pi Kappa Alpha Corp., Inc., —N.E.3d—, 2018 WL
476648, at *4 (Ill. Jan. 19, 2018); Fox v. Cohen, 406 N.E.2d 178, 179 (Ill. App. Ct. 1980).
SuperValu argues that Holmes has not stated a valid claim for negligence because: (1) he
has not plausibly alleged a cognizable injury proximately resulting from the data breach; (2) the
economic loss doctrine bars his negligence claim; and (3) he has not alleged that SuperValu
breached a duty to safeguard consumers’ information.
A. Cognizable Injury
Based on earlier rulings in this case, Holmes’ only remaining allegation of injury is that
he experienced a fraudulent charge on his credit card.4 SuperValu argues this allegation fails to
In the Dismissal Order, this Court rejected other theories of injury that were based upon
mitigation costs, diminished value of payment card PII, delayed or inadequate notification of the
data breach, invasion of privacy and breach of PII confidentiality, and lost expectation of a
adequately allege a cognizable injury because Illinois law requires a plaintiff to plead out-ofpocket damage, and Holmes does not allege that he paid the fraudulent charge or that the loss
was not reimbursed.
Under Illinois law, “(f)ailure to state sufficient facts to constitute a legally cognizable
present injury or damage mandates dismissal” of a negligence claim. Yu v. Int’l Bus. Machs.
Corp., 732 N.E.2d 1173, 1177 (Ill. App. Ct. 2000). Data breach cases in Illinois and elsewhere
have repeatedly held that a cardholder’s mere allegation of an unauthorized charge,
unaccompanied by an out-of-pocket loss, is not sufficient to state an actionable injury. See, e.g.,
In re Barnes & Noble Pin Pad Litig., No. 12-08617, 2016 WL 5720370, at *1, *5–6 (N.D. Ill.
Oct. 3, 2016) (dismissing under Rule 12(b)(6) due to plaintiff’s failure to plead that unauthorized
charges on her credit card resulted in economic or out-of-pocket damages); In re Hannaford
Bros. Co. Customer Data Sec. Breach Litig., 613 F. Supp. 2d 108, 133–34 (D. Me. 2009)
(holding that reimbursed charges cannot sustain an injury in tort or contract), rev’d on other
grounds sub nom. Anderson v. Hannaford Bros. Co., 659 F.3d 151 (1st Cir. 2011); In re Sony
Gaming Networks & Customer Data Sec. Breach Litig., 903 F. Supp. 2d 942, 963 (S.D. Cal.
2012) (stating that reimbursed charges were insufficient to adequately plead a cognizable injury);
cf. Kuhns v. Scottrade, Inc., 868 F.3d 711, 718 (8th Cir. 2017) (holding plaintiff failed to allege
actual damage where, although plaintiff alleged misuse of his data, he did not allege that he
suffered “fraud or identity theft that resulted in financial loss from the use of [his] stolen PII”).
Here, Holmes does not allege that he suffered an out-of-pocket loss from the
bargained-for benefit. See Dismissal Order at *7–*8. Plaintiffs chose not to appeal these
unauthorized charge on his credit card. Rather, he merely states that he “noticed a fraudulent
charge on his credit card statement and immediately cancelled his credit card.” Am. Compl.
¶ 31. Although this allegation is sufficient to allege an injury in fact for purposes of Article III
standing, it does not provide a basis for the Court to draw a reasonable inference that Holmes
suffered monetary loss and thus a cognizable injury as the result of the charge. See Barnes &
Noble, 2016 WL 57230370, at *4–6 (holding that plaintiffs had sufficiently alleged an injury in
fact for Article III standing but nevertheless dismissing claim under Rule 12(b)(6) for failure to
allege actual injury because plaintiffs did not allege that they lost money due to unauthorized
charges); In re Michaels Stores Pin Pad Litig., 830 F. Supp. 2d 518, 527 (N.D. Ill. 2011)
(“Michaels is correct that Plaintiffs suffered no actual injury . . . if Plaintiffs were reimbursed for
all unauthorized withdrawals and bank fees and, thus, suffered no out-of-pocket losses. . . .
However, because Plaintiffs allege they lost money, the Court can reasonably infer that Plaintiffs
were not reimbursed for all fees and charges.”) (emphasis added). Whether Holmes suffered
monetary loss as a result of the fraudulent charge is entirely within his knowledge and requires
no discovery from Defendants, yet Holmes has failed to allege this fact in the Amended
Complaint and does not attempt to include it in the Proposed Second Amended Complaint. In
the absence of this allegation, he fails to plead a cognizable injury.
In arguing that the mere allegation of a fraudulent charge is sufficient to plausibly allege
a cognizable injury, Holmes cites four Illinois data breach cases in which the plaintiffs’
allegations survived a motion to dismiss. See Pls.’ Mem. Opp’n SuperValu’s Renewed Mot.
Dism. at 7–8. However, these cases are distinguishable. In each of those cases, plaintiffs
alleged that they had experienced actual withdrawals of fraudulent charges from their bank
accounts or sustained monetary losses such as bank fees caused by the charges. See Lewert v.
P.F. Chang’s China Bistro, Inc., No. 14-04787 (N.D. Ill. June 25, 2014) Compl. [Docket No. 1]
¶ 33 (alleging “monetary losses arising from unauthorized bank account withdrawals”)
(emphasis added); Remijas v. Neiman Marcus Grp., LLC, No. 14-01735 (N.D. Ill. June 2, 2014)
Am. Compl. [Docket No. 27] ¶ 4 (alleging fraudulent charges on debit card); Allen v. Schnuck
Mkts., Inc., No. 15-0061, 2015 WL 5076966, at *3 (S.D. Ill. Aug. 27, 2015) (alleging actual
“financial losses caused by fraudulent charges to their compromised cards and bank fees
associated with the data breach”) (emphasis added); Michaels, 830 F. Supp. at 527 (alleging
“monetary losses from unauthorized bank account withdrawals and/or bank fees charged to
[plaintiffs’] accounts”) (emphasis added). Unlike those cases, no factual allegations of bank
account withdrawals, bank fees, or other monetary loss from fraudulent charges are included in
the Amended Complaint or the Proposed Second Amended Complaint.
Holmes also argues that the Eighth Circuit held that he has already met the requirements
for establishing his standing by pleading that he experienced a fraudulent charge on his account.
However, as the Eighth Circuit explicitly recognized, Holmes’ failure to allege the date he
shopped at the affected store, the amount of the charge, or that the charge was not reimbursed
“could be fatal to the complaint under the ‘higher hurdles’ of Rules 8 and 12(b)(6).” Eighth Cir.
Op. at 773. This is because “standing under Article III presents only a ‘threshold inquiry’
requiring ‘general allegations’ of injury, causation and redressability.” Id. (internal citations
Holmes also invokes the collateral source rule to argue that even if his loss was covered
by a collateral source such as his financial institution, he is entitled to recover damages from
Defendants. The collateral source rule applies where a plaintiff becomes liable to one party, and
then that liability is discharged by a third party’s payment. See Arthur v. Catour, 833 N.E.2d
847, 853 (Ill. 2005) (finding that insurance company was a collateral source where plaintiff
“became liable” for medical bills and insurance company paid the medical provider). Here,
Holmes has not alleged that he had an obligation to pay the charge. Moreover, as noted above,
data breach cases decided under Illinois law repeatedly recognize that a cardholder’s mere
allegation of an unauthorized charge, unaccompanied by an out-of-pocket loss, is insufficient to
state an actionable injury. See Barnes & Noble, 2016 WL 57230370, at *6; Michaels, 830 F.
Supp. 2d at 527.
Holmes also argues that his allegations of time spent monitoring his account information
to guard against potential fraud is a cognizable injury. However, time spent disputing an
unauthorized charge and having a new card issued does not constitute actual injury or monetary
loss. See Barnes & Noble, 2016 WL 5720370, at *5 (holding that plaintiff’s allegations of
spending time to dispute an unauthorized charge and have a new card issued were insufficient to
plead that plaintiff “suffered any actual injury or monetary loss due to the fraudulent charge.”).
Holmes relies on the Seventh Circuit’s decision in Remijas v. Neiman Marcus Group., LLC to
argue that “identifiable costs associated with the process of sorting things out” constitute a
cognizable injury for data breach victims. 794 F.3d 688, 691–97 (7th Cir. 2015). But Holmes
alleges only time, not “costs” to monitor his account. Additionally, in Remijas, the Seventh
Circuit was addressing whether the plaintiffs had sufficiently alleged a cognizable injury for
purposes of Article III standing, not whether the plaintiffs had satisfied the higher hurdle of Rule
Even if the Amended Complaint sufficed to allege a cognizable injury, which it does not,
the requisite element of causation has not been adequately alleged because the Amended
Complaint does not state when Holmes shopped at the affected store or when the fraudulent
charge was incurred. Indeed, Holmes does not even allege that the charge was incurred after the
data breach. Rather, he merely alleges that he “noticed” the fraudulent charge shortly after the
data breach. Amended Complaint ¶ 31. In the absence of such basic time and sequence
allegations, the Amended Complaint does not plausibly show that the unauthorized charge
proximately resulted from the data breach.5
To resist this conclusion, Holmes argues that the allegations are sufficient to show
causation because the Eighth Circuit has already accepted as true the allegations that Plaintiffs’
PII was stolen in the data breach. Again, the Article III standing threshold is lower than that for
a motion to dismiss under Rule 12(b)(6). Holmes also argues that it is premature to assume that
the preliminary dates set forth in SuperValu’s data breach notification letter are accurate,
because that letter stated it was possible that additional time frames for the data breach would be
identified after further investigation. However, without any allegation whatsoever as to when
Holmes shopped at the store and when the fraudulent charge was incurred, the Court cannot
draw a reasonable inference that the fraudulent charge proximately resulted from the data breach.
Rather, the allegations establish only the sheer possibility that the charge was attributable to the
Notably, in all four Illinois data breach cases on which Holmes relies to argue that the
allegation of a fraudulent charge suffices to state an actionable injury under Rule 12(b)(6), the
plaintiffs alleged the dates or date ranges during which they used their payment cards at the
affected stores. See In re Michaels Stores Pin Pad Litig., No. 11-3350 (E.D. Ill. ) Am. Compl.
[Docket No. 25] ¶¶ 16–19; Lewert Compl. ¶ 10; Remijas Am. Compl. ¶ 4; Allen, 2015 WL
5076966, at *1.
data breach. Thus, the Amended Complaint does not show that Holmes is entitled to relief. See
Iqbal, 556 U.S. at 679. (“[W]here the well-pleaded facts do not permit the court to infer more
than the mere possibility of misconduct, the complaint has alleged—but not ‘shown’—‘that the
pleader is entitled to relief.”) (quoting Fed. R. Civ. P. 8(a)(2)).
Because Holmes has failed to allege a cognizable injury resulting from the data breach,
his negligence claim fails to state a claim upon which relief can be granted.
B. Economic Loss
SuperValu argues that even if Holmes had alleged a cognizable injury resulting from the
data breach, his negligence claim is barred by the economic loss doctrine, which prohibits
recovery for purely economic claims sounding in negligence. The Court agrees.
Under Illinois law, the economic loss doctrine provides that a plaintiff may not recover
for “purely economic losses under a tort theory of negligence.” Michaels, 830 F. Supp. 2d at
528. The rationale underlying the doctrine is that “tort law affords the proper remedy for loss
arising from personal injury or damages to one’s property, whereas contract law and the Uniform
Commercial Code provide the appropriate remedy for economic loss stemming from diminished
commercial expectations without related injury to person or property.” Id. Here, Holmes does
not allege injury to his person or property as a result of the breach. Thus, his alleged losses are
purely economic, and the economic loss doctrine is a further bar to his negligence claim.
Holmes argues that exceptions to the economic loss doctrine exist where a defendant
breaches an extra-contractual duty owed to the plaintiff or where a special relationship exists
between the parties. He contends that such exceptions apply here because: (1) SuperValu
solicited customers’ PII and thus had a duty to take reasonable measures to safeguard their data
and notify them of an any data breach; and (2) a special relationship exists between Holmes, the
putative class, and SuperValu arising from SuperValu’s solicitation of customers’ PII and
representation that reasonable measures would be taken to safeguard the data. Similar arguments
have been rejected by courts applying Illinois law in other data breach cases. See Id. at 528–31;
In re Target Corp. Data Sec. Breach Litig., 66 F. Supp. 3d 1154, 1174 (D. Minn. 2014). Based
on the persuasive reasoning in those cases, the Court concludes that Holmes’ argued exceptions
to the economic loss doctrine do not apply here.
SuperValu argues that Holmes’ negligence claim fails for the additional reason that
SuperValu did not have a common law duty to protect his personal information. “The existence
of a duty under Illinois law is a question of law.” USAA Fed’l Savings Bank v. PLS Fin’l
Servs., Inc., 260 F. Supp. 3d 965, 969 (N.D. Ill. 2017) (citing Simpkins v. CSX Transp., Inc.,
965 N.E.2d 1092, 1096 (Ill. 2012)). “Although the Illinois Supreme Court has not opined on the
issue, the Illinois Appellate Court has refused to create ‘a new legal duty beyond legislative
requirements’ to safeguard an individual’s personal information or protect it from disclosure.”
Id. (quoting Cooney v. Chicago Pub. Schs., 943 N.E.2d 23, 28–29 (Ill. App. Ct. 2010)). Federal
courts interpreting Illinois law have consistently declined to impose a common law duty to
safeguard personal information in data security cases. See Landale Signs & Neon, Ltd. v.
Runnion Equip. Co., No. 16-7619, 2016 WL 7409916, at *3 (N.D. Ill. Dec. 22, 2016) (listing
cases). This Court similarly declines to recognize a common law duty to protect personal
information where Illinois courts have not done so. Therefore, Holmes’ negligence claim fails
for the additional reason that it does not allege the existence of a duty owed by SuperValu. See
Cooney, 943 N.E.2d at 29 (“Absent a duty, there is no negligence.”). The negligence claim is
dismissed for failure to state a claim upon which relief can be granted.
ii. Negligence Per Se (Count V)
Count V of the Amended Complaint alleges a claim for negligence per se. Holmes has
conceded in prior briefing that his negligence per se claim fails under Illinois law, and he does
not address the claim in his responsive brief to SuperValu’s renewed motion to dismiss. See
Pls.’ Mem. Opp’n Defs.’ Mot. Dism. [Docket No. 40] at 37 n.9; Pls.’ Mem. Opp’n SuperValu’s
Renewed Mot. Dism. Therefore, Holmes’ claim for negligence per se is dismissed for failure to
state a claim upon which relief can be granted.
iii. Breach of Implied Contract (Count IV)
The Eighth Circuit, in addressing Article III standing, stated that “the complaint does not
sufficiently allege that plaintiffs were party to such a contract.” Eighth Cir. Op. at 771 n.6.
Because Holmes’ allegations fail to satisfy the threshold inquiry of standing to bring a breach of
implied contract claim, the allegations obviously fall short of the higher hurdle of Rule 12(b)(6).
The claim fails for the additional reason that Holmes has not sufficiently alleged an actual injury,
which is a required element of his breach of implied contract claim. See Barnes & Noble, 2016
WL 5720370, at *4–6 (dismissing breach of implied contract claim for failure to allege damage
as required under Illinois law). Thus, the claim for breach of implied contract is dismissed for
failure to state a claim upon which relief can be granted.
iv. State Consumer Protection Statutes (Count I)
SuperValu argues that Holmes fails to state a plausible claim under the Illinois Consumer
Fraud and Deceptive Business Practices Act, 815 Ill. Comp. Stat. 505/2 et seq. (“ICFA”) and
under the Illinois Uniform Deceptive Trade Practices Act, 815 Ill. Comp. Stat. 510/2 et. seq.
A. Illinois Consumer Fraud and Deceptive Practices Act
To state a claim under the ICFA, a plaintiff must allege that:
(1) the defendant engaged in a deceptive or unfair practice, (2) the
defendant intended for the plaintiff to rely on the deception, (3) the
deception occurred in the course of conduct involving trade or
commerce, (4) plaintiff sustained actual damages, and (5) such
damages were proximately caused by the defendant’s deception.
Michaels, 830 F. Supp. 2d at 525 (citing Martis v. Pekin Mem’l Hosp. Inc., 917 N.E.2d 598, 603
(Ill. App. Ct. 2009).
SuperValu first argues that Holmes has failed to allege that he suffered actual damage.
Section 10a of the ICFA provides that “[a]ny person who suffers actual damage as a result of a
violation of this Act committed by any other person may bring an action against such person.”
815 Ill. Comp. Stat. 505/10a(a) (emphasis added). Thus, “only a person who suffers actual
damage may bring an action under the ICFA.” Michaels, 830 F. Supp. 2d at 526. The actual
damage element “requires that the plaintiff suffer actual pecuniary loss.” Camasta v. Jos. A.
Bank Clothiers, Inc., 761 F.3d 732, 739 (7th Cir. 2014).
As discussed above, Holmes has failed to allege that he suffered actual pecuniary loss.
This omission is fatal to his claim under the ICFA. See Barnes & Noble, 2016 WL 5720370, at
*6 (holding plaintiff failed to state a claim under ICFA where she had not alleged that she
suffered out-of-pocket loss due to a fraudulent charge); accord Michaels, 830 F. Supp. 2d at 527
(stating that plaintiffs suffer no actual injury under the ICFA if they do not suffer out-of-pocket
Holmes argues that damages under the ICFA are not limited to monetary damages and
may include damages for lost time or aggravation. However, non-economic damages are
recoverable under the ICFA “only when they are part of a total award that includes actual
economic damages.” Morris v. Harvey Cycle & Camper, Inc., 911 N.E.2d 1049, 1054 (Ill. App.
The absence of any actual damage also precludes Holmes’ claim for injunctive relief
under § 505/10a(c) of the ICFA. “It is well established under Illinois law that private rights of
action for injunctive relief under the ICFA require damages.” Schilke v. Wachovia Mortg., FSB,
820 F. Supp. 2d 825, 838 n.5 (N.D. Ill. 2011).
The claim under ICFA is dismissed for failure to state a claim upon which relief can be
B. Illinois Uniform Deceptive Trade Practices Act
To maintain an action for injunctive relief under UDTPA, “a consumer must allege facts
which would indicate that he is likely to be damaged in the future.” Reid v. Unilever U.S., Inc.,
964 F. Supp. 2d 893, 918 (N.D. Ill. 2013) (internal quotation marks omitted). Holmes argues
that a likelihood of future injury exists because SuperValu experienced two data breaches in the
past and still accepts payment cards. The Court disagrees. Even allowing Holmes the benefit of
all reasonable inferences, the occurrence of two data breaches in a three month period and none
in the three and a half years since suggests merely a possibility of a future data breach, not a
likelihood of a future data breach. Because Holmes does not plausibly allege that he is likely to
be damaged in the future, he cannot state a claim under the UDTPA.
The claim under UDTPA is dismissed for failure to state a claim upon which relief can be
v. Illinois Data Breach Notification Statute (Count II)
In Count II of the Amended Complaint, Holmes asserts a claim under the Illinois
Personal Information Protection Act (“PIPA”), 815 Ill. Comp. Stat. 530/10(a). The Amended
Complaint refers to the PIPA as the Illinois data breach notification statute. See Am. Compl. ¶¶
117–18. “The PIPA itself does not provide for a private cause of action to seek damages for
violations.” Best v. Malec, No. 09-7749, 2010 WL 2364412, at *7 (N.D. Ill. June 11, 2010).
Rather, a violation of the PIPA “constitutes an unlawful practice under” the ICFA. 815 Ill.
Comp. Stat. 530/20. Thus, “[t]he only provision for a private right of action under the PIPA is
pursuant to the ICFA.” Best, 2010 WL 2364412, at *7.
“While a violation of PIPA constitutes an unlawful practice under ICFA, there still must
be actual damages to state a claim under ICFA.” Barnes & Noble, 2016 WL 5720370, at *6
(internal citation and quotations omitted). As this Court held in the January 2016 Dismissal
Order, Holmes has not alleged he suffered actual damage due to the allegedly delayed and
inadequate notification of the data breach. Dismissal Order at *7. Again, this ruling was not
challenged on appeal.
Holmes’ claim for equitable relief under PIPA also fails. As stated above, Holmes is not
entitled to injunctive relief under § 505/10a(c) of the ICFA because “private rights of action for
injunctive relief under the ICFA require damages.” Schilke, 820 F. Supp. 2d at 838 n.5.
Therefore, the claim for violation of the Illinois data breach notification statute is
dismissed for failure to state a claim upon which relief can be granted.
vi. Unjust Enrichment (Count VI)
SuperValu argues that the Amended Complaint fails to state a claim for unjust
enrichment. “To state a cause of action based on a theory of unjust enrichment, a plaintiff must
allege that the defendant has unjustly retained a benefit to the plaintiff’s detriment, and that
defendant’s retention of the benefit violates the fundamental principles of justice, equity, and
good conscience.” HPI Health Care Servs., Inc. v. Mt. Vernon Hosp., Inc., 545 N.E.2d 672, 679
Holmes’ unjust enrichment claim is based on allegations that he conferred financial
benefits to SuperValu by paying money for the purchase of goods, and had he known of the data
breach he would not have shopped there. Holmes alleges that the financial benefits are a direct
and proximate result of SuperValu’s allegedly negligent practices and failure to inform him of
the data breach, and that it would be inequitable for SuperValu to retain any of the financial
benefits it would not have received but for its allegedly illegal conduct. Am. Compl.
This claim lacks merit because Holmes admits that he obtained goods in exchange for the
financial benefit he conferred upon SuperValu. Id. ¶ 151. Holmes does not allege that the goods
he purchased were defective or that their value was somehow diminished by the data breach.
Therefore, SuperValu did not obtain any unjust benefit. See Irwin v. Jimmy John’s Franchise,
LLC, 175 F. Supp. 3d 1064, 1072 (C.D. Ill. 2016) (“Irwin paid for food products. She did not
pay for a side order of data security and protection; it was merely incident to her food purchase .
. . .”). Additionally, the Seventh Circuit has repeatedly noted that arguments based on this
theory have been adopted by courts only where the product itself was defective or dangerous.
See Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963, 968 (7th Cir. 2016); Remijas, 749
F.3d at 694–95. The Seventh Circuit has consistently declined to take the additional step of
extending this theory to data breach cases. See id. This Court similarly declines to extend the
Holmes also argues that SuperValu was unjustly enriched because it charged customers
for the costs it incurs to maintain its electronic network security, but then diverted those funds
elsewhere and left its network security vulnerable to intrusions. In the Dismissal Order, this
Court considered and rejected this theory. See Dismissal Order at *8 (“. . . Plaintiffs do not
allege that the Data Breach diminished the value of the groceries or other goods they purchased
from Defendants. Nor do Plaintiffs allege facts showing that the price they paid for goods
included an amount that both parties understood would be allocated toward protecting customer
data.”). Plaintiffs did not appeal this ruling. The claim for unjust enrichment is dismissed for
failure to state a claim upon which relief can be granted.
Because the Amended Complaint does not include sufficient factual allegations to state a
plausible claim for relief on any of the counts asserted, SuperValu’s motion to dismiss this action
with prejudice6 is granted.
Dismissal with prejudice is appropriate because the Court concludes that any additional
opportunity for amendment would be futile. Although the data breach occurred more than three
years ago, Plaintiffs’ proposed Second Amended Complaint included substantially the same
allegations and theories of injury that had been rejected in this Court’s prior ruling dismissing
the case without prejudice. The absence of newly alleged injuries suggests that Plaintiffs do not
have any other injuries that can sustain their claims for relief. See In re Barnes & Noble Pin Pad
Litig., 2017 WL 2633398, at *4 (N.D. Ill. June 13, 2017) (dismissing a second amended
complaint with prejudice because “[e]ven with the benefit of the Court’s prior ruling, Plaintiffs
primarily rested on the same theories of injury that had been rejected in the prior ruling,” causing
the Court to conclude that Plaintiffs do not have any other injuries that could ground their claims
2. Albertson’s Motion to Dismiss
Albertson’s moves to dismiss under Rules 12(b)(1) and (6). Albertson’s contends that
the Amended Complaint must be dismissed under Rule 12(b)(1) because Plaintiff Holmes lacks
Article III standing to assert claims against Albertson’s, and standing is a prerequisite to subject
matter jurisdiction. See Lujan v. Defenders of Wildlife, 504 U.S. 555, 559–60 (1992).
A plaintiff invoking federal jurisdiction must establish constitutional standing, which
consists of three elements: (1) an injury in fact; (2) a causal connection between the injury and
the challenged conduct of the defendant; and (3) a likelihood that a favorable ruling will redress
the alleged injury. Young Am. Corp. v. Affiliated Computer Servs. (ACS), Inc., 424 F.3d 840,
843 (8th Cir. 2005) (citing Lujan, 504 U.S. at 560–61).
Albertson’s argues that the second and third elements are lacking here because Holmes,
the only remaining Plaintiff in this action, does not allege an injury that is causally connected to
Albertson’s or that could be redressed by a decision against Albertson’s. Holmes’ allegations
are that he provided his PII in the course of shopping at Shop ’n Save, which is owned by
SuperValu; that SuperValu announced that hackers had twice gained access to the portion of its
computer network that processes payment card transactions; and that shortly after the intrusions
were announced he noticed a fraudulent charge on his credit card statement. Am. Compl.
¶¶ 1–2, 4, 6, 31. The Amended Complaint acknowledges that the stores owned and operated by
Albertson’s are separate and distinct from those owned and operated by SuperValu. See id. ¶ 3
(alleging Albertson’s operates grocery stores under the brand names “Albertson’s, ACME
Markets, Jewel-Osco, Shaw’s, and Star Markets”), ¶ 2 (alleging SuperValu owns and operates
grocery stores under brand names “Cub Foods, Farm Fresh, Hornbacher’s, Shop ’n Save, and
Shoppers Food & Pharmacy”).
Holmes does not allege he had any interaction with an Albertson’s store. Thus, he does
not allege any injury that can be causally connected to Albertson’s. Additionally, because
Holmes does not name Albertson’s in his underlying complaint in the Southern District of
Illinois7 and does not assert a single allegation against Albertson’s, there is no likelihood that a
ruling against Albertson’s will redress Holmes’ alleged injury. Therefore, Albertson’s is
dismissed from this action pursuant to Rule 12(b)(1).
Even if Holmes had standing to bring a claim against Albertson’s, he has failed to state a
plausible claim against Albertson’s because his allegations and claims do not relate to
Albertson’s. Holmes’ claims also fail for the reasons set forth in Section II.B.1., above. Thus,
dismissal is also warranted under Rule 12(b)(6).
Based upon the foregoing, and all the files, records, and proceedings herein, IT IS
HEREBY ORDERED that:
Defendant SuperValu, Inc.’s Renewed Motion to Dismiss Plaintiffs’ Consolidated
Amended Class Action Complaint [Docket No. 78] is GRANTED;
Defendants AB Acquisition, LLC and New Albertson’s, Inc.’s Renewed Motion
to Dismiss Plaintiffs’ Consolidated Amended Class Action Complaint [Docket
No. 85] is GRANTED;
Class Plaintiffs’ Motion for Leave to Amend Their Amended Complaint Pursuant
to Fed. R. Civ. P. 15(a)(2) [Docket No. 91] is DENIED; and
See McPeak v. SuperValu, Inc., 3:14-CV-00899 (S.D. Ill.) at Docket No. 8 ( First
Amended Class Action Complaint).
The Consolidated Amended Class Action Complaint is dismissed with prejudice.
LET JUDGMENT BE ENTERED ACCORDINGLY.
BY THE COURT:
s/Ann D. Montgomery
ANN D. MONTGOMERY
U.S. DISTRICT JUDGE
Dated: March 7, 2018.
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?