Perdue v. Hy-Vee, Inc.

UNITED STATES DISTRICT COURT

CENTRAL DISTRICT OF ILLINOIS

PEORIA DIVISION

NOREEN PERDUE, ELIZABETH DAVIS- )

BERG, DUSTIN MURRAY, MELANIE )

SAVOIE, CHERYL ELLINGSON, ANGELA )

TRANG, HARLEY WILIAMS, MARY )

WILLIAMS, GORDON GREWING, MELISSA )

WARD and PATRICIA DAVIS, individually and )

on behalf of all other similarly situated, )

)

Plaintiffs, )

)

v. ) Case No. 19-1330

)

HY-VEE, INC., )

)

Defendant. )

ORDER AND OPINION

This matter is now before the Court on Defendant Hy-Vee, Inc.’s (“Defendant”) Motion to

Dismiss Plaintiffs’ Consolidated Second Amended Class Action Complaint (ECF No. 30). For the

reasons stated below, Defendant’s Motion is GRANTED IN PART AND DENIED IN PART.

JURISDICTION

The Court exercises subject matter jurisdiction under 28 U.S.C. § 1332(d)(2)(A), because

the matter in controversy exceeds $5 million, exclusive of interest and costs, and is a class action

in which some members of the class are citizens of states different than Defendant. The Court also

exercises supplemental jurisdiction over the state law claims under 28 U.S.C. § 1367(a).

BACKGROUND

Defendant is a large supermarket chain that also operates gas pumps, restaurants, and

coffee shops.1 Between November 2018 and August 2019, Defendant was exposed to a data

breach. On July 29, 2019, Defendant detected the breach and alerted its customers on August 14,

2019. On October 3, 2019, Defendant notified its customers that the breach was carried out by the

use of “malware designed to access payment card data from cards used on point-of-sale (‘POS’)

devices at certain Hy-Vee fuel pumps, drive-thru coffee shops, and restaurants.” (ECF Nos. 21 at

18; 31-2 at 2). Payment card information of customers who made purchases at the affected POS

devices were compromised in the data breach. Defendant posted an online tool for customers to

determine which locations were affected and during what timeframe.

Plaintiffs claim they each used one or more payment cards at a compromised POS, and as

a result, dealt with suffered side effects of the breach. Plaintiff Perdue accessed a gas pump in

Galesburg, Illinois, that was impacted by the data breach. She went three weeks without her bank

card, which was the only way she could allegedly access her money and pay her bills. Plaintiff

Savoie accessed gas pumps in Iowa that were affected by the data breach. She experienced two

fraudulent charges for $100.00 and $74.28. She also spent approximately five hours dealing with

fraudulent charges on her credit card. Plaintiff Ellingson accessed a restaurant operated by

Defendant in Iowa that was affected by the data breach. She was unable to access her bank funds

between August 27, 2019, and September 4, 2019, due to her bank cancelling and replacing her

debit card. Plaintiff Trang accessed several food retailers and gas pumps operated by Defendant in

Minnesota that were affected by the data breach. She experienced $1000.00 in fraudulent charges

and spent approximately three hours dealing with those charges, an overdraft fee, and a cancelled

1 The facts in the Background section are derived from Plaintiffs’ Consolidated Second Amended Class Action

Complaint. (ECF No. 21).

card. Plaintiffs Harley and Mary Williams accessed gas pumps in Kansas that were affected by the

data breach. They spent approximately three-to-four hours dealing with $700.00 in fraudulent

charges on their debit account. They also were unable to access their monies for three weeks.

Plaintiff Grewing accessed gas pumps in Missouri that were affected by the data breach. Two

fraudulent charges for $7.81 and $25.94 appeared on his debit cards. He also spent time driving to

the bank, disputing charges, and cancelling his debit card. Additionally, he purchased a

TransUnion Credit Monitoring Plan as a result of the breach. Plaintiff Murray visited restaurants

operated by Defendant in Missouri that were affected by the data breach. He spent approximately

three hours dealing with the breach after his debit card had been cancelled and replaced. Plaintiff

Davis visited a restaurant operated by Defendant in Wisconsin that was affected by the data breach.

She had a card cancelled and replaced. Plaintiffs Ward, in Kansas, and Davis-Berg, in Illinois,

spent time monitoring their accounts subsequent to the breach.

On October 15, 2019, Plaintiffs filed a Class Action Complaint against Defendant. (ECF

No. 1). On November 25, 2019, Plaintiffs filed their First Amended Class Action Complaint

against Defendant. (ECF No. 8). On December 30, 2019, Plaintiffs filed a Second Amended Class

Action Complaint asserting fifteen claims: negligence (Count I); negligence per se (Count II);

breach of implied contract (Count III); breach of contracts to which Plaintiffs and class members

were intended third-party beneficiaries (Count IV); ten statutory claims under the laws of Illinois,

Iowa, Kansas, Minnesota, Missouri, and Wisconsin (Counts V-XIV); and unjust enrichment

(Count XV). (ECF No. 21). On January 31, 2020, Defendant filed a Motion to Dismiss Plaintiffs’

Second Amended Class Action Complaint under Federal Rule of Civil Procedure 12(b)(6). On

February 28, 2020, Plaintiffs filed their response. (ECF No. 36). On March 17, 2020, Defendant

filed its reply. (ECF No. 40). This Opinion follows.

STANDARD OF REVIEW

Dismissal under Federal Rule of Civil Procedure 12(b)(6) is proper if a complaint fails to

state a claim upon which relief can be granted. Fed. R. Civ. P. 12(b)(6). To survive a motion to

dismiss, a complaint must contain sufficient factual matter, which when accepted as true, states a

claim for relief that is plausible on its face. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Plausibility

means alleging factual content that allows a court to reasonably infer that the defendant is liable

for the alleged misconduct. Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 547 (2007). A plaintiff’s

claim must “give enough details about the subject matter of the case to present a story that holds

together” to be plausible. Swanson v. Citibank, N.A., 614 F.3d 400, 404 (7th Cir. 2010). A court

must draw all inferences in favor of the non-moving party. Bontkowski v. First Nat’l Bank of

Cicero, 998 F.2d 459, 461 (7th Cir. 1993).

When evaluating a motion to dismiss, courts must accept as true all factual allegations in

the complaint. Ashcroft, 556 U.S. at 678. However, the court need not accept as true the

complaint’s legal conclusions; “[t]hreadbare recitals of the elements of a cause of action, supported

by mere conclusory statements, do not suffice.” Id. (citing Bell Atlantic Corp., 550 U.S. at 555).

Conclusory allegations are “not entitled to be assumed true.” Id.

Federal Rule of Civil Procedure 8(a)(2) requires only “a short and plain statement of the

claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). The complaint must

give fair notice of what the claim is and the grounds upon which it rests. E.E.O.C. v. Concentra

Health Servs., Inc., 496 F.3d 773, 776–77 (7th Cir. 2007). Fair notice is not enough by itself; in

addition, the allegations must show that it is plausible, rather than merely speculative, that the

plaintiff is entitled to relief. Tamayo v. Blagojevich, 526 F.3d 1074, 1083 (7th Cir. 2008).

ANALYSIS

I. Plaintiffs’ Negligence and Negligence Per Se Claims

In Count I, Plaintiffs, under each state class, allege negligence against Defendant claiming

that Defendant owed a duty to Plaintiffs to maintain confidentiality and exercise reasonable care

in safeguarding their personal information, and it breached that duty. Plaintiffs claim Defendant’s

conduct created a foreseeable risk of harm, and as a direct and proximate result, they have been

injured. In Count II, Plaintiffs, under each state class, allege negligence per se against Defendant

claiming that it had a duty to provide adequate computer systems and data security practices to

safeguard their personal information. As a result of breaching that duty, Plaintiffs allege they have

suffered damages.

Defendant argues that Plaintiffs fail to state a claim for negligence because there is no

duty to safeguard personal information under Illinois law. Alternatively, Defendant states that if

the Court determines that a duty exists under any of the relevant states’ laws, Plaintiffs’ negligence

and negligence per se claims should be barred by the economic-loss doctrine recognized in Illinois,

Iowa, Missouri, and Kansas. Defendant also argues that Plaintiffs fail to plead any damages that

are compensable under Minnesota or Wisconsin law. Regarding Plaintiffs’ negligence per se

claims, Defendant also states that Plaintiffs do not identify any statute or regulation that sets out a

standard of conduct specific enough to establish that it is in violation of that statute or regulation.

According to Defendant, the one statute that Plaintiffs do reference, Section 5 of the Federal Trade

Commission Act (“FTC Act”), does not impose any data security standard. Plaintiffs contend that

Defendant is incorrect about Illinois law and that it has ignored the laws of Minnesota, Kansas,

Wisconsin, and Missouri, as they relate to a duty to safeguard personal information. Lastly,

Plaintiffs argue that Section 5 of the FTC Act was designed to protect consumers from unfair and

deceptive trade practices such as failing to protect private consumer information.

A. Choice-of-Law

Before the Court turns to the specific claims, it must consider a preliminary issue: choice-

of-law. The Parties do not agree which state law applies to Plaintiffs’ claims. Plaintiffs state that

the negligence and negligence per se claims should be governed by the law of the state where the

alleged injury occurred, because differences exist among the laws of each state. Defendant argues

that there is no conflict of law between the relevant states; therefore, Illinois law should apply.

A federal court sitting in diversity applies the forum state’s choice-of-law rules to

determine which state's substantive law applies. See Klaxon Co. v. Stentor Elec. Mfg. Co., 313

U.S. 487, 496–97 (1941) (“The conflict of laws rules to be applied by the federal court in Delaware

must conform to those prevailing in Delaware's state courts.”); Auto–Owners Ins. Co. v. Websolv

Computing, Inc., 580 F.3d 543, 547 (7th Cir. 2009). “Courts do not worry about conflict of laws

unless the parties disagree on which state’s law applies.” Auto–Owners Ins. Co., 580 F.3d at 547.

Since the Parties disagree whether Illinois or each respective state’s law applies, the Court

looks to Illinois choice-of-law rules to determine which law applies. Under Illinois choice-of-law

rules, a conflict of law exists only where the application of one state’s law over that of another

state will make a difference in the outcome of a case, and where there is no conflict in the relevant

state law, a court will apply Illinois law. See Malatesta v. Mitsubishi Aircraft Int'l, Inc., 655 N.E.2d

1093, 1096 (Ill. App. Ct. 1995); Barron v. Ford Motor Co. of Canada, 965 F.2d 195, 197 (7th Cir.

1992) (“[B]efore entangling itself in messy issues of conflict of laws a court ought to satisfy itself

that there actually is a difference between the relevant laws of the different states.”); Int’l Adm'rs,

Inc. v. Life Ins. Co. of N. Am., 753 F.2d 1373, 1376 n.4 (7th Cir. 1985) (“Conflicts [of law] rules

are appealed to only when a difference in law will make a difference to the outcome.”). Illinois

uses the “most significant relationship” approach of the Restatement (Second) of Conflicts of Law.

Esser v. McIntyre, 661 N.E.2d 1138, 1141 (Ill. 1996). In applying this test, courts weigh four

factors: “(1) where the injury occurred; (2) where the injury-causing conduct occurred; (3) the

domicile of the parties; and (4) where the relationship of the parties is centered.” Id. Generally, the

law of the place of injury controls unless some other jurisdiction has a more significant relationship

with the occurrence and with the parties. Id. Moreover, choice-of-law issues in nationwide class

actions are rarely so uncomplicated that one can delineate clear winning and losing arguments at

an early stage in the litigation. Mirfasihi v. Fleet Mortg. Corp., 450 F.3d 745, 750 (7th Cir. 2006).

At this stage, the factors weigh in favor of applying the laws of the non-forum states to the

non-forum Plaintiffs. The injuries Plaintiffs allege each occurred in the state in which Plaintiffs

used a payment card to make a purchase from Defendant. Defendant could not have predicted that

Illinois law would apply to its business with customers in other states. Likewise, it would interfere

with interstate order to supplant the laws of the non-forum states with Illinois law. See generally

Heath v. Zellmer, 151 N.W.2d 664, 672 (Wis. 1967) (“[F]or a state that is only minimally

concerned with a transaction or tort to thrust its law upon the parties would be disruptive of the

comity between states.”). Additionally, as Plaintiffs point out, the respective states recognize

different standards of the common law claims, even if they are small variations. As seen below,

these variations can be outcome determinative. Therefore, the Court will apply the laws of the non-

forum states to the non-forum Plaintiffs.

B. Illinois, Missouri, and Kansas

In Cooney v. Chicago Public Schools, 943 N.E.2d 23 (Ill. App. Ct. 2010), the Board of

Education of the City of Chicago retained a graphics company to print, package, and mail a letter

to 1750 former employees to inform them that they were eligible to change their insurance benefit

plans. Id. at 27. However, an inadvertent mailing contained the names of all 1750 former

employees, along with their addresses, social security numbers, marital status, medical and dental

insurers and health insurance plan information. Id. The former employees sued, alleging, among

other things, negligence under Illinois law. Id. The appellate court affirmed the circuit court’s

dismissal of the negligence claims, finding that the plaintiffs had not established that the Board of

Education owed them a duty to safeguard their personal information. Id. at 28.

The appellate court opined that the Illinois Personal Information Protection Act (“PIPA”),

815 Ill. Comp. Stat. 530/1 et seq., did not create a legal duty to safeguard the plaintiffs’

information. Id. The court held that the plain language of PIPA only requires data collectors that

maintain personal information to “notify the owner or licensee of the information of any breach of

the security of the data immediately following discovery.” Id. (citing 815 Ill. Comp. Stat.

530/10(b)). The court rejected the plaintiffs’ argument that PIPA must also encompass a duty to

protect the information from inadvertent disclosure in the first place. Id. The court explained,

“[b]ecause the provisions in the Act are clear, we must assume it reflects legislative intent to limit

defendants' duty to providing notice.” Id.

In Cmty. Bank of Trenton v. Schnuck Markets, Inc., 887 F.3d 803, 816 (7th Cir. 2018), the

Seventh Circuit affirmed the dismissal of negligence claims under Illinois law in a data breach

case, relying on Cooney. That case involved a data breach at a large Midwestern grocery chain that

resulted in the theft of data for 2.4 million credit and debit cards. Id. at 807. The plaintiffs alleged

common law and statutory claims against defendant, including negligence under Illinois law. Id.

The plaintiffs argued that the defendant had a common law duty to safeguard customers’ personal

information. Id. at 816. Noting that the Illinois Supreme Court had not addressed this issue, the

Seventh Circuit followed Cooney and held that no common law data security duty applied. Id.

Plaintiffs argue that in 2017, subsequent to the ruling in Cooney, the Illinois legislature

amended PIPA to expressly add a duty to safeguard personal information; however, Plaintiffs

admit that no court has analyzed that amendment’s effect on the duty analysis in an Illinois

negligence claim. In 2018, the Seventh Circuit addressed a similar question and predicted that

Illinois would not impose such a duty on retailers like Defendant. Id. Plaintiffs have failed to

highlight any Illinois authority contrary to Cooney. PIPA clearly imposes a duty to notify an

Illinois resident of any data breach, but it does not explicitly include a duty to safeguard personal

information. See 815 Ill. Comp. Stat. 530/10. This Court agrees with the Seventh Circuit’s reading

of Cooney and accordingly adopts its conclusion.

Defendant also argues that Plaintiffs fail to identify statutory language that imposes a duty

to safeguard personal information upon it. Plaintiffs allege that Defendant violated Section 5 of

the FTC Act, and Defendant argues that Section 5 cannot form the basis of a negligence per se

claim. Plaintiffs argue that Defendant had a duty to protect their personal financial information

under the FTC Act and similar state statutes. The FTC Act prohibits “unfair methods of

competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting

commerce.” 15 U.S.C. § 45(a)(1) (2006). “Unfair or deceptive acts” are defined as those that: (i)

cause or are likely to cause reasonably foreseeable injury within the United States; or (ii) involve

material conduct occurring within the United States. Id. § 45(4)(A)(i-ii). Defendant contends that

the Seventh Circuit has already affirmed the dismissal of similar claims under Illinois and Missouri

law by citing Cmty. Bank of Trenton, 887 F.3d at 818-19; however, the court in that case found

that Section 5 of the FTC Act does not extend its coverage to financial institutions in merchant

data breach cases. That is not the case here as Plaintiffs are not financial institutions. As this district

has previously stated, “the FTC has brought [several] cases against companies that have engaged

in unfair or deceptive practices that put consumers’ personal data at unreasonable risk.” See Irwin

v. Jimmy John's Franchise, LLC, 175 F. Supp. 3d 1064, 1073 (C.D. Ill. 2016) (internal quotation

and citations omitted); see generally F.T.C. v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir.

2015) (case involving customer injuries in a data security case where FTC provisions were

applicable). Other courts have held that “the failure to maintain reasonable and appropriate data

security for consumers’ sensitive personal information can constitute an unfair method of

competition in commerce in violation of the [FTC].” In re Equifax, Inc., Customer Data Sec.

Breach Litig., 362 F. Supp. 3d 1295, 1327 (N.D. Ga. 2019) (internal citations omitted). Therefore,

the FTC Act can serve as the basis of a negligence per se claim.

Notwithstanding the above, the Court agrees with Defendant that even if there is an

existence of some duty, the Illinois economic loss doctrine bars Plaintiffs’ negligence per se claim.

The economic loss doctrine bars a plaintiff from recovering for purely economic losses under a

tort theory of negligence. Moorman Mfg. Co. v. Nat'l Tank Co., 435 N.E.2d 443, 453 (Ill. 1982).

The rationale underlying this doctrine is that tort law affords the proper remedy for loss arising

from personal injury or damages to one’s property, whereas contract law and the Uniform

Commercial Code provide the appropriate remedy for economic loss stemming from diminished

commercial expectations without related injury to person or property. In re Ill. Bell Switching

Station Litig., 641 N.E.2d 440, 444 (Ill. 1994). Illinois law recognizes three exceptions to the

economic loss doctrine: (1) where a plaintiff sustains personal injury or property damage resulting

from a sudden or dangerous occurrence; (2) where plaintiff's damages were proximately caused

by defendant's intentional, false representation; and (3) where plaintiff's damages were

proximately caused by the negligent misrepresentation of a defendant in the business of supplying

information for the guidance of others in business transactions. Moorman, 435 N.E.2d at 450–52.

Here, Plaintiffs’ damages are economic losses. Specifically, Illinois Plaintiff Perdue

alleges she went weeks without access to her account while awaiting a replacement card, and

Illinois Plaintiff Davis-Berg spent time monitoring his account to deal with the side-effects of the

data breach. The Seventh Circuit has noted that lost time and an inability to use or access funds

due to a data breach are economic losses. Dieffenbach v Barnes & Noble, Inc., 887 F.3d 826, 828-

29 (7th Cir. 2018). Moreover, none of the exceptions to the economic loss doctrine apply here.

There was no sudden or dangerous occurrence. Data breaches are a foreseeable risk of participating

in card networks, not an unexpected physical hazard. Cmty. Bank of Trenton, 887 F.3d at 817

(citations omitted). Plaintiffs suggest that Defendant engaged in wrongful conduct by “fail[ing] to

inform Plaintiffs and members of the class that it did not maintain computer software and other

security procedures and precautions . . . [or by] fail[ing] to inform Plaintiffs and the class of the

Data Breach in a timely and accurate manner.” (ECF No. 21 at 33). These allegations, however,

fail to identify a specific actionable fraudulent statement under Illinois law. See Moorman, 435

N.E.2d at 452. Moreover, Defendant did not have a professional advisory relationship with

Plaintiffs, so that exception also does not apply. Id; see In re Michaels Stores Pin Pad Litig., 830

F.Supp.2d 518, 530 (N.D. Ill. 2011). Therefore, Count I’s negligence claim and Count II’s

negligence per se claim are dismissed as they relate to the Illinois Plaintiffs.

Similarly, the elements presented in Cooney are also present in Missouri law. Missouri

courts use the same four-factor common law duty test for negligence. See Hoffman v. Union Elec.

Co., 176 S.W.3d 706, 708 (Mo. 2005). Missouri also has a data privacy statute whose only

consumer-facing mandate is notice. Compare Mo. Ann. Stat. § 407.1500 with 815 Ill. Comp. Stat.

530/10. In addition, the Missouri Attorney General has “exclusive authority” for enforcing

Missouri’s data breach notice statute by a civil action. Id. at § 407.1500(4); see Amburgy v. Express

Scripts, Inc., 671 F.Supp.2d 1046, 1055 (E.D. Mo. 2009) (concluding that no such negligence

cause of action exists under Missouri law). Additionally, Missouri does not permit “recovery in

tort for pure economic damages” without personal injuries or property damage. Autry Morlan

Chevrolet Cadillac, Inc. v. RJF Agencies, Inc., 332 S.W.3d 184, 192 (Mo. Ct. App. 2010).

Missouri’s economic loss doctrine applies to “losses that are contractual in nature,” Captiva Lake

Inv., LLC v. Ameristructure, Inc., 436 S.W.3d 619, 628 (Mo. Ct. App. 2014). There is an exception

to the economic loss rule for special relationships that give rise to a fiduciary duty, but “the

existence of a business relationship does not give rise to a fiduciary relationship, nor a presumption

of such a relationship,” short of, for example, a “financial partnership” or principal-agent

relationship. See Autry Morlan Chevrolet, 332 S.W.3d at 194-95 (citations omitted). Plaintiffs’

alleged damages do not include personal injury or property damage and there is no financial

partnership here. Therefore, like Illinois, Missouri is not likely to recognize the negligence claims

Plaintiffs assert here.

Missouri Plaintiffs’ negligence per se claim also fails because of the same statutory

inferences. Neither Illinois nor Missouri have legislatively imposed liability for personal data

breaches, opting instead to limit their statutory intervention to notice requirements. Cooney, 943

N.E.2d at 28–29; Amburgy, 671 F.Supp.2d at 1055. For both states, a plaintiff must show that a

statute or ordinance has been violated. Cmty. Bank of Trenton, 887 F.3d at 819. Under Missouri

law, negligence per se is a type of negligent conduct that results from the violation of a statute

imposing a duty. Lowdermilk v. Vescovo Building & Realty Co., Inc., 91 S.W.3d 617, 628 (Mo. Ct.

App. 2002). In Lowdermilk, the appellate court noted that any “conduct which constitutes

untrustworthy or improper fraudulent or dishonest dealings or demonstrates bad faith or gross

incompetence has been held not to be a basis for negligence per se.” Id. Further, the court noted

that “the doctrine of negligence per se has traditionally arisen in cases involving personal injury

and physical injury to property[,]” and the doctrine had not yet been extended to any case that

involved damage to economic interests. Id. As stated above, the Court does not find that personal

or property injury occurred here. Therefore, Count I’s negligence claim and Count II’s negligence

per se claim are dismissed as they relate to the Missouri Plaintiffs.

Kansas courts also recognize the economic loss doctrine. Rand Const. Co. v. Dearborn

Mid-W. Conveyor Co., 944 F. Supp. 2d 1042, 1062 (D. Kan. 2013). Under the economic loss

doctrine, a plaintiff seeking recovery for economic losses cannot proceed under theories sounding

in tort. Prof'l Lens Plan, Inc. v. Polaris Leasing Corp., 675 P.2d 887, 899 (Kan. 1984). “In other

words, where plaintiff has suffered no personal injuries or damage to other property, a cause of

action based upon tort does not exist.” City of Winfield, Kan. v. Key Equip. & Supply Co., 2012

WL 1207256, at *1 (D. Kan. 2012) (internal citation omitted). This is similar to the economic loss

doctrine established in Illinois and Missouri. For the same reasons stated above, the economic loss

doctrine bars the Kansas Plaintiffs’ claims for negligence and negligence per se. Therefore, Count

I’s negligence claim and Count II’s negligence per se claim are dismissed as they relate to the

Kansas Plaintiffs.

C. Minnesota and Wisconsin

Defendant claims that Plaintiffs’ negligence and negligence per se claims under Minnesota

and Wisconsin law fail because Plaintiffs do not allege any compensable damages. Whether

Plaintiffs have stated a claim for negligence depends on whether they sufficiently pled facts, which

if proven true, would establish all four required elements of an actionable negligence claim. Hoida,

Inc. v. M & I Midstate Bank, 717 N.W.2d 17, 26 (Wis. 2006). Under both Minnesota and

Wisconsin law, a plaintiff must establish: (1) the existence of a duty of care on the part of the

defendant; (2) that the defendant breached that duty of care; (3) a causal connection between the

defendant's breach of the duty of care and the plaintiff's injury; (4) and that he or she suffered an

actual loss or damage that resulted from the breach. Id; Glorvigen v. Cirrus Design Corp., 796

N.W.2d 541, 549 (Minn. Ct. App. 2011), aff'd, 816 N.W.2d 572 (Minn. 2012). In Wisconsin, the

elements of duty and breach are usually presented to the trier of fact in a question asking whether

the defendant was negligent, and then the elements of causation and damages are addressed.

Nichols v. Progressive Northern Ins. Co., 746 N.W.2d 220, 225 (Wis. 2008) (internal citation

omitted). At the motion to dismiss stage, Wisconsin courts have “reserved the right to deny the

existence of a negligence claim based on public policy reasons.” Hoida, 717 N.W.2d at 24.

Foreseeability of harm is an element of the duty of care. Nichols, 746 N.W.2d at 226

(internal citation omitted). As noted above, data breaches are a foreseeable risk of participating in

card networks. See Cmty. Bank of Trenton, 887 F.3d at 817. Plaintiffs alleges that Defendant

breached its duty of care when it failed to maintain the security of its payment system, and that

they were injured as a result. Therefore, Plaintiffs satisfy the first, second, and third elements of a

negligence claim.

Rule 8 does not create a pleading standard for damages beyond what is necessary to

establish standing. Dieffenbach, 887 F.3d at 828. “To say that the plaintiffs have standing is to say

that they have alleged injury in fact, and if they have suffered an injury then damages are

available.” Id. Plaintiff Davis alleges her payment card was cancelled as a result of the data breach.

Plaintiff Trang alleges she suffered approximately $1000.00 in fraudulent charges and the

cancellation of her bank card due to the breach. Defendant argues that because Davis fails to allege

that she experienced fraudulent charges, suffered any out-of-pocket loss, or experienced identity

theft, that her negligence and negligence per se claims should be dismissed. Defendant further

argues that because Trang fails to allege that the fraudulent charges were not reimbursed, or that

her bank required her to pay any fees, that her claims should also be dismissed. The Court finds

that the specific allegations Defendant contends are necessary to establish a claim are not required

at the pleading stage. See Fox v. Iowa Health Sys., 399 F.Supp.3d 780, 795 (W.D. Wis. 2019)

(stating that at the pleading stage plaintiffs only have to allege they suffered injury in fact as a

result of a data breach); see also In re Target Corp. Data Sec. Breach Litig., 66 F.Supp.3d 1154,

1171 (D. Minn. 2014) (holding that negligence claims would not be dismissed because defendant

was seeking a more detailed explanation of what damages were caused by delayed data breach

notification). Therefore, the Court declines to dismiss Count I’s negligence claim and Count II’s

negligence per se claim as they relate to Plaintiff Trang and Davis, as well as the state classes from

Minnesota and Wisconsin.

D. Iowa

Plaintiffs conceded their Iowa negligence and negligence per se claims; therefore, the

Court dismisses the claims as they relate to Plaintiffs Savoie and Ellingson, as well as state classes

from Iowa. (ECF No. 36 at 29).

II. Plaintiffs’ Contract and Quasi-Contract Claims

Defendant claims that Plaintiffs’ contract and quasi contract claims are deficient because:

(1) Plaintiffs fail to sufficiently plead facts that infer an implied contract existed; (2) Plaintiffs fail

to sufficiently plead the existence of any contract to which they were intended third-party

beneficiaries; (3) Plaintiffs insufficiently allege that Defendant was unjustly enriched; and (4)

Plaintiffs unjust enrichment claim cannot stand on its own. The Court addresses each argument in

turn.

A. Implied Contract

The Parties agree that that there is no conflict of laws related to Plaintiffs’ implied contract

claim, accordingly, the Court will apply Illinois law. (ECF No 31 at 24; ECF No. 26 at 28). In

Count I, Plaintiffs allege that implied contracts were created when they provided Defendant with

their card information, and in exchange, Defendant agreed to provide them with certain services,

to take measures to protect their security and confidentiality, and protect their personal

information. Plaintiffs claim that the protection of their personal information was a material term

of these implied contracts.

An implied contract is created by the parties’ conduct and contains all of the elements of

an express contract—offer, acceptance, and consideration—as well as a meeting of the minds.

Brody v. Finch Univ. of Health Scis. 698 N.E.2d 257, 265 (Ill. App. Ct. 1998). Under a similar set

of facts, this district held that plaintiffs plausibly alleged a claim for breach of implied contract

under Illinois law. See Irwin, 175 F. Supp. 3d at 1070-71 (holding that plaintiffs in a data breach

case alleged the existence of an implied contract obligating defendant to take reasonable measures

to protect customers’ information); see also In re Michaels, 830 F.Supp.2d at 531-32 (holding that

an implicit contractual relationship existed between plaintiffs and defendant which obligated

defendant to protect plaintiffs' financial information in data breach case). “[W]hen the customer

uses a credit card for a commercial transaction, he [or she] intends to provide the data to the

merchant, and not to an unauthorized third party.” Irwin, 175 F. Supp. 3d at 1070 (internal citation

omitted). Additionally,

a jury could reasonably find an implied contract between the defendant and its

customers that defendant would take reasonable measures to protect the customers’

financial information . . . [W]hen a customer uses a credit card in a commercial

transaction, [he or] she intends to provide the data to the merchant only . . . and

does not expect—and certainly does not intend—the merchant to allow

unauthorized third parties to access that data.

In re Michaels, 830 F.Supp.2d at at 531 (internal quotation and citation omitted).

The Court finds that the reasoning outlined in Michaels also applies here. Plaintiffs have

plausibly alleged the existence of an implied contract obligating Defendant to take reasonable

measures to protect their private information and to timely notify them of the data breach. Plaintiffs

have also plausibly alleged they would not have entered into transactions with Defendant if they

had known it would not protect their information. Therefore, the Court declines to dismiss Count

III’s breach of implied contract claim.

B. Breach of Contract/Third Party Beneficiary

The Court will apply Illinois law to Plaintiffs’ breach of contract claim as Plaintiffs have

not claimed the existence of an outcome determinative conflict. Int’l Adm'rs, Inc., 753 F.2d at

1376. In Count IV, Plaintiffs allege breach of contracts to which Plaintiffs were intended third-

party beneficiaries. These contracts include “various entities . . . (i) contracts between Hy-Vee and

its merchant customers . . . (ii) contracts between Hy-Vee and Visa and/or Mastercard . . . [and]

(iii) contracts between Hy-Vee and its acquiring banks.” (ECF No 21 at 40). Defendant argues that

Plaintiffs have not alleged the necessary facts to put it on notice of what contracts it allegedly

breached; rather, the Plaintiffs only vaguely allude to unspecified contracts. Defendant contends

that the vague allegations are insufficient to give notice of any breach of contract claim.

Furthermore, Defendant claims that Plaintiffs have failed to establish that they were the intended

third-party beneficiaries of these unidentified contracts. Plaintiffs argue that they are not required

to attach the breached contracts at this stage and that Defendant “knows what agreements Plaintiffs

are referring to.” (ECF No. 36 at 31).

To state a claim for breach of contract, a plaintiff must allege: “(1) the existence of a valid

and enforceable contract; (2) substantial performance by the plaintiff; (3) a breach by the

defendant; and (4) resultant damages.” Reger Dev., LLC v. Nat'l City Bank, 592 F.3d 759, 764

(7th Cir. 2010). Here, it is uncertain that a valid or enforceable contract exists. The Court agrees

with Defendant that broadly referring to unspecific contracts with “various entities” such as

“merchant customers,” “Visa and/or Mastercard,” and “acquiring banks” is not sufficient to put

Defendant on notice which contracts it breached. (ECF No 21 at 40). While Plaintiffs are not

required to attach the exact contracts they claim Defendant breached to their complaint, they must

allege enough facts that identify a certain contract or provision. See Babbitt Municipalities, Inc. v.

Health Care Serv. Corp., 64 N.E.3d 1178, 1186 (Ill. App. Ct. 2016) (holding that if contract terms

are too uncertain or indefinite to enforce, allegations of a breach of those terms will not provide a

basis for a breach of contract claim). As pled, the contracts Plaintiffs allude to could encompass a

wide variety of different terms that are not applicable, or perhaps no such contracts exist. The

allegations are extremely broad. Since the contracts are unidentified, it is also not possible to

determine if Plaintiffs were third-party beneficiaries. Therefore, the Court dismisses Count IV’s

breach of contract claim without prejudice and grants Plaintiffs leave to file an amended complaint

to re-plead this count within twenty-one (21) days, if they can do so in good faith.

C. Unjust Enrichment

The Court will also apply Illinois law to Plaintiffs’ unjust enrichment claim, as Plaintiffs

have not claimed the existence of an outcome determinative conflict. Int’l Adm'rs, Inc., 753 F.2d

at 1376. In Count XV, Plaintiffs plead unjust enrichment in the alternative of their implied contract

claim. Plaintiffs allege that they conferred a monetary benefit upon Defendant in the form of

monies paid for the purchase of goods and that Defendant was supposed to use Plaintiffs’ monies,

in part, to pay for the costs of reasonable data privacy and security measures. Defendant claims

that these allegations lack merit because Plaintiffs admit they obtained goods in exchange for the

financial benefit they conferred on Defendant. Additionally, Defendant contends that no

allegations support the idea that there was an understanding between Defendant and Plaintiffs that

some portion of their purchase was intended for data security.

Under Illinois law, “a plaintiff must allege that the defendant has unjustly retained a benefit

to the plaintiff’s detriment, and that defendant’s retention of the benefit violates the fundamental

principles of justice, equity, and good conscience.” HPI Health Care Servs., Inc. v. Mt. Vernon

Hosp., Inc., 545 N.E.2d 672, 679 (Ill. 1989). In Irwin, this Court addressed similar allegations and

dismissed the plaintiff’s unjust enrichment claim. 175 F. Supp. 3d at 1072 (“[T]he court agrees

with the defendants. [Plaintiff] paid for food products. She did not pay for a side order of data

security and protection; it was merely incident to her food purchase.”).

Plaintiffs have not alleged that any specific portion of their payments went toward data

protection; rather, they state that their payments were for food and gas. Additionally, Plaintiffs

have not alleged a benefit conferred in exchange for protection of their personal information. The

Seventh Circuit has stated that similar arguments are not applicable unless the product plaintiff

received was defective or dangerous. See Lewert v. P.F. Chang's China Bistro, Inc., 819 F.3d 963,

968 (7th Cir. 2016) (stating that plaintiffs’ argument that the cost of their meals was an injury since

they would not have dined at the restaurant had they known of its poor data security was

insufficient because the product was not defective); see also Remijas v. Neiman Marcus Grp., LLC,

794 F.3d 688, 695 (7th Cir. 2015) (plaintiffs alleged unjust enrichment claiming department store

sold its products at premium prices, instead of taking a portion of the proceeds for cybersecurity.

The court held “this is a step that we need not, and do not, take in this case. Plaintiffs do not allege

any defect in any product they purchased; they assert instead that patronizing [defendant] inflicted

injury on them.”). Plaintiffs here do not allege that the food or gas they received was defective.

Therefore, the Court dismisses Count XV’s unjust enrichment claim.

III. Plaintiffs’ Statutory Claims

A. Iowa and Kansas Data Breach Notification Statutes

In Count VI, Plaintiffs allege Defendant violated the Iowa Personal Information Security

Breach Protection Act, Iowa Code Ann. § 715C.2 (“PISBPA”), by delaying sending notice of the

data breach to consumers in a timely fashion. In Count IX, Plaintiffs allege Defendant violated the

Kansas Protection of Consumer Information Act, Kan. Stat. Ann. § 50-7a02 (“PCI”), by failing to

immediately provide notice of the data breach to consumers.

Defendant claims that neither the Iowa PIBPA nor the Kansas PCI allow for a private right

of action and that both statutes are only enforceable by the respective state’s attorney general.

Plaintiffs contend that the statutes are ambiguous as to whether they create a private right of action.

In Iowa, a violation of PIBPA entails:

[a]ny person who owns or licenses computerized data that includes a consumer's

personal information that is used in the course of the person's business, vocation,

occupation, or volunteer activities and that was subject to a breach of security shall

give notice of the breach of security following discovery of such breach of security,

or receipt of notification . . . to any consumer whose personal information was

included in the information that was breached. The consumer notification shall be

made in the most expeditious manner possible and without unreasonable delay,

consistent with the legitimate needs of law enforcement . . . and consistent with

any measures necessary to sufficiently determine contact information for the

affected consumers, determine the scope of the breach, and restore the reasonable

integrity, security, and confidentiality of the data.

Iowa Code Ann. § 715C.2(1). Additionally, it

is an unlawful practice [under the consumer-protection statute] and, in addition to

the remedies provided to the attorney general [in the consumer-protection statute],

the attorney general may seek and obtain an order that a party held to violate this

section pay damages to the attorney general on behalf of a person injured by this

violation.

§ 715C.2(9)(a). However, the statute further provides that the “rights and remedies available under

this section are cumulative to each other and to any other rights and remedies available under the

law.” § 715C.2(9)(b). In recent decisions in data breach cases interpreting this statute, other courts

have found that the statute is ambiguous with regard to whether it creates a private right of action,

and therefore, these courts have not been inclined to dismiss such claims at the motion to dismiss

stage. See In re Target Corp., 66 F.Supp.3d at 1169 (holding § 715C.2(9)(b) to be “ambiguous as

to whether private enforcement is permissible, and Plaintiffs’ Iowa claim will not be dismissed.”);

see also In re Equifax, Inc., 362 F.Supp.3d at 1339 (agreeing with the court’s decision from In re

Target Corp. and declining to dismiss Iowa PISBPA claim). This Court likewise concludes that

Plaintiffs’ claims under Count VI’s Iowa data breach statute should not be dismissed.

In Kansas, a violation of the PCI entails:

[a] person that conducts business in this state, or a government, governmental

subdivision or agency that owns or licenses computerized data that includes

personal information shall, when it becomes aware of any breach of the security of

the system, conduct in good faith a reasonable and prompt investigation to

determine the likelihood that personal information has been or will be misused. If

the investigation determines that the misuse of information has occurred or is

reasonably likely to occur, the person or government, governmental subdivision or

agency shall give notice as soon as possible to the affected Kansas resident. Notice

must be made in the most expedient time possible and without unreasonable delay,

consistent with the legitimate needs of law enforcement and consistent with any

measures necessary to determine the scope of the breach and to restore the

reasonable integrity of the computerized data system.

Kan. Stat. Ann. § 50-7a02 (a). Additionally,

[f]or violations of this section, except as to insurance companies licensed to do

business in this state, the attorney general is empowered to bring an action in law

or equity to address violations of this section and for other relief that may be

appropriate. The provisions of this section are not exclusive and do not relieve an

individual or a commercial entity subject to this section from compliance with all

other applicable provisions of law.

§ 50-7a02 (g). Similarly, courts in recent data breach cases have also found the Kansas PCI to be

ambiguous as to whether a private right of action exists. See In re Target Corp., 66 F.Supp.3d at

1169 (pointing out that the Kansas statute states “the enforcement provisions are not exclusive).

The Defendant here has not identified any authority construing the language from this particular

data breach statute as precluding a private right of action. “[A]bsent any authority construing this

ambiguity to exclude private rights of action, the [Kansas PCI] claims should not be dismissed.”

In re Equifax, Inc., 362 F. Supp. 3d at 1341. Therefore, the Court declines to dismiss Plaintiffs’

claims under Count IX’s Kansas PCI in this matter.

B. Consumer Fraud and Deceptive Trade Practices

In Count V, Plaintiffs allege a violation of the Illinois Consumer Fraud and Deceptive

Business Practices Act, 815 Ill. Comp. Stat. Ann. 505/1 et seq. (“Illinois CFA”). In Count VI,

Plaintiffs allege a violation of the Illinois Uniform Deceptive Trade Practices Act, 815 Ill. Comp.

Stat. 510/1 et seq. (“Illinois DTPA”). In Count VIII, Plaintiffs allege a violation of the Iowa

Consumer Fraud Act, Iowa Code Ann. §§ 714H.3, 714H.5 (“Iowa CFA”). In Count X, Plaintiffs

allege a violation of the Kansas Consumer Protection Act, Kan. Stat. Ann. § 50-623 et. seq.

(“Kansas CPA”). In Count XI, Plaintiffs allege a violation of the Minnesota Prevention of

Consumer Fraud Act, Minn. Stat. Ann. §§ 325F.68 et. seq; 8.31 (“Minnesota CFA”). In Count XII,

Plaintiffs allege a violation of the Minnesota Uniform Deceptive Trade Practices Act, Minn. Stat.

Ann. §325D.43 et seq. (“Minnesota DTPA”). In Count XIII, Plaintiffs allege a violation of the

Missouri Merchandising Practices Act, Mo. Ann. Stat. § 407.020(a) et seq. (“Missouri MPA”). In

Count XIV, Plaintiffs allege a violation of the Wisconsin Deceptive Trade Practices Act, Wis. Stat.

Ann. § 100.18 et seq. (“Wisconsin DTPA”).

Defendant argues that the respective consumer fraud and deceptive trade practices claims

should be dismissed for failure to plead fraud under Federal Rule of Civil Procedure 9(b)’s

heightened pleading standard. Alternatively, Defendant argues that if the claims are s not dismissed

under Rule 9(b), then the claims should be dismissed for the following reasons: (1) the Illinois

CFA claim fails for lack of damages, causation, and failure to plead a nexus to Illinois; (2) the

Illinois DTPA claim fails for failure to allege a likelihood of future harm; (3) the Iowa CFA claim

fails for lack of damages and causation; (4) the Minnesota CFA claim fails to allege a misstatement

made in connection with the sale of merchandise; (4) the Minnesota DTPA claim fails to allege a

misstatement made in connection with the sale of merchandise or a likelihood of future harm; (6)

the Missouri MPA claim fails to allege a misstatement made in connection with the sale of

merchandise or damages; and (7) the Wisconsin DTPA claim fails for lack of damages and

causation. Plaintiffs contend that their claims are not subjected to the heightened pleading standard

under Rule 9(b), rather, they are subject to the liberal notice pleading requirements under Rule

8(a). Plaintiffs also state that they have properly alleged actual damages and ascertainable losses

as a result of Defendant’s unfair and deceptive conduct; that the Illinois and Iowa CFAs require

only that Plaintiffs’ damages occur as a result of an unfair or deceptive practice; that they have

plausibly alleged multiple acts and forbearances that constitute omission under Minnesota and

Missouri law in connection with sales made at Defendant’s locations; and Plaintiffs have made

numerous allegations of risk of future harm resulting from the breach.

i. Rule 9(b)

Rule 9(b) requires a complaint to “state with particularity the circumstances constituting

fraud.” Fed. R. Civ. P. 9(b). This ordinarily requires describing the “who, what, when, where, and

how” of the fraud. Pirelli Armstrong Tire Corp. Retiree Med. Benefits Tr. v. Walgreen Co., 631

F.3d 436, 441–42 (7th Cir. 2011). Claims are only subject to these heightened pleading standards

if they “sound in fraud,” i.e., they are “premised on a fraudulent course of conduct.” Id. at 446–47

(citation omitted). According to Defendant, Plaintiffs allege claims under many state laws that are

subject to these heightened pleading standards, including their claims for deceptive trade practices;

however, the Court concludes that Plaintiffs’ unfair and deceptive trade practices claims are not

subject to Rule 9(b)'s heightened pleading standards.

As a procedural matter, courts have held that similar complaints alleging fraud and

deceptive practices in federal court should be judged under Rule 8(a) and not the particularity

requirement for fraud under Rule 9(b). Windy City Metal Fabricators & Supply, Inc. v. CIT Tech.

Fin. Servs, Inc., 536 F.3d 663, 670 (7th Cir. 2008); see In re Target Corp., 66 F. Supp. 3d at 1163;

see also Fed. Trade Comm'n v. Hornbeam Special Situations, LLC, 308 F.Supp.3d 1280, 1286-87

(N.D. Ga. 2018) (stating that to sound in fraud, the elements of the claim must be similar to that

of common law fraud, requiring, among other things, proof of scienter, reliance, and injury).

Here, Defendant has failed to show that the state unfair and deceptive trade practice statutes

sound in fraud. It has also failed to demonstrate that the elements of these statutes are similar to

the elements of common law fraud, and they have not shown that Plaintiffs’ theory of recovery

rests upon a unified course of fraudulent conduct. Defendant’s sole argument is that Plaintiffs have

failed to allege the “who, what, when, where, and how” of its conduct. (ECF No. 31 at 35). Even

assuming arguendo that the Rule 9(b) standard applies, Plaintiffs have alleged enough facts to

establish who (the Defendant), what and how (security was inadequate to protect against a data

breach and the information was withheld), when (the data breach occurred between November

2018 and August 2019), and where (respective Plaintiffs’ states). Therefore, the Court concludes

that the heightened pleading standards of Rule 9(b) do not apply to the particular state statutes.

ii. Actual Damages

Plaintiffs do not oppose Defendant’s motion to dismiss their claims under the Wisconsin

DTPA; therefore, Count XIV is dismissed. (ECF No. 36 at 13).

In Illinois, only a person who suffers actual damage may bring an action under the CFA.

815 Ill. Comp. Stat. 505/10a(a). The plaintiff must allege a purely economic injury, measurable by

the plaintiff's loss. Morris v. Harvey Cycle & Camper, Inc., 911 N.E.2d 1049, 1053 (Ill. App. Ct.

2009); see Mulligan v. QVC, Inc., 888 N.E.2d 1190, 1197–98 (Ill. App. Ct. 2008) (“If the plaintiff

is not materially harmed by the defendant's conduct, however flagrant it may have been, there may

be no recovery.”).

The Court has already determined that Plaintiffs have alleged economic injury under

Illinois law and suffered economic losses. Additionally, Defendant itself concedes that the alleged

damages are considered economic. (ECF No. 31 at 22); see Dieffenbach, 887 F.3d at 830 (holding

that economic losses were alleged when plaintiff did not have access to funds for three days, and

plaintiff spent time working with the police and her bank to restore the funds). Therefore, the Court

declines to dismiss Count V’s Illinois CFA claim on Defendant’s basis that the Illinois Plaintiffs

did not allege actual damages.

Private actions brought under the Iowa CFA, “require[] plaintiffs to prove an ascertainable

loss of money or property caused by the misrepresentation.” Fox, 399 F.Supp.3d at 798 (internal

quotation omitted). Here, Iowa Plaintiff Savoie experienced two fraudulent charges, one for

$100.00 and another for $74.28. Iowa Plaintiff Ellingson’s debit card was cancelled leaving her

without access to funds between August 27, 2019, and September 4, 2019. Defendant contends

that because Savoie does not allege that the charges went unreimbursed, the Iowa CFA should not

apply. The Court reiterates that Plaintiffs are not required to state whether they were reimbursed

at the pleading stage. See Fox, 399 F.Supp.3d at 795 (finding that plaintiffs only have to allege

they suffered injury in fact as a result of a data breach at the pleading phase). At this juncture, the

Court finds that the two fraudulent charges suffice as ascertainable losses of money and that not

having access to funds or a debit card suffices as loss of property. Therefore, the Court declines to

dismiss Count VIII’s Iowa CFA claim on Defendant’s basis that the Iowa Plaintiffs did not allege

actual damages.

To state a claim under the Missouri MPA, a plaintiff must allege: (1) the purchase of

merchandise; (2) for personal, family, or household purposes; and (3) an ascertainable loss of

money or property as a result of an act or practice declared unlawful under the MPA. See Hess v.

Chase Manhattan Bank, USA, N.A., 220 S.W.3d 758, 773 (Mo. 2007). The MPA defines

merchandise as “objects, wares, goods, commodities, intangibles, real estate or services.”

Mo. Ann. Stat. § 407.010(4); Edmonds v. Hough, 344 S.W.3d 219, 223 (Mo. Ct. App. 2011);

Here, Plaintiffs purchased merchandise in the form of food or gas. They also experienced

an ascertainable loss of money or property. Specifically, Missouri Plaintiff Grewing purchased

merchandise by accessing gas pumps that were affected by the data breach, and as a result,

experienced an ascertainable loss of money when two fraudulent charges for $7.81 and $25.94

occurred. He also spent time driving to the bank, disputing charges, and cancelling his debit card.

Missouri Plaintiff Murray purchased food at restaurants operated by Defendant that were affected

by the data breach, and as a result, lost his property for a time period when his debit card was

cancelled and replaced. Therefore, the Court declines to dismiss Count XIII’s Missouri MPA claim

on Defendant’s basis that the Missouri Plaintiffs did not allege actual damages.

iii. Causation

The Illinois CFA declares unlawful the “unfair or deceptive acts or practices, including …

misrepresentation or the concealment, suppression or omission of any material fact, with intent

that others rely upon [it] . . . in the conduct of trade or commerce . . . whether any person has in

fact been misled, deceived or damaged thereby.” 815 Ill. Comp. Stat. 505/2. Defendant argues that

Plaintiffs must allege that he or she actually saw a communication or advertisement and was

deceived by Defendant’s statements. In Cozzi Iron & Metal, Inc. v. U.S. Office Equipment, Inc.,

250 F.3d 570, 576 (7th Cir. 2001), the Seventh Circuit held that the misrepresentation must relate

to information that is material to a buyer or essential to the transaction, while acknowledging

Illinois state courts (at the time) did not require the plaintiff to show reliance for the claim to be

valid. Id. However, in a case post-dating Cozzi, the Illinois state court held that for CFA claims,

“a plaintiff must prove that he or she was actually deceived by the misrepresentation in order to

establish the element of proximate causation.” Avery v. State Farm Mut. Auto. Ins. Co., 835 N.E.2d

801, 861 (Ill. 2005).

Here, Plaintiffs allege a deceptive omission of material fact. Courts have held that an

omission or concealment of material fact in the conduct of trade can constitute a violation of the

Illinois CFA. See Lateef v. Pharmavite LLC, No. 12 C 5611, 2013 WL 1499029, at *3

(N.D. Ill. Apr. 10, 2013) (citing Wigod v. Wells Fargo Bank, N.A., 673 F.3d 547, 575 n.13

(7th Cir. 2012) (collecting cases)) (“Omissions are also actionable under the [Illinois CFA] if they

are intended to induce the plaintiff's reliance.”); see also Haymer v. Countrywide Bank, FSB, 2011

WL 2790172, at *4 (N.D. Ill. July 15, 2011) (finding the plaintiffs allegations were sufficient to

show reliance under the Illinois CFA when the defendants omitted or concealed a material fact in

the loan application process); Capiccioni v. Brennan Naperville, Inc., 791 N.E.2d 553, 558

(Ill. App. Ct. 2003) (“A defendant need not have intended to deceive the plaintiff; innocent

misrepresentations or omissions intended to induce the plaintiff's reliance are actionable under [the

Illinois CFA]”). Accordingly, the Court finds that Plaintiffs have plausibly alleged causation and

a claim under the Illinois CFA, because the allegation that Defendant’s failure to disclose that its

system for payment cards was not reasonably secure is a material omission, and if Plaintiffs had

known that information, they would not have made the purchases. The Court declines to dismiss

Count V’s Illinois CFA claim as they relate to the Illinois Plaintiffs.

Under the Iowa CFA, a plaintiff must have “suffer[ed] an ascertainable loss of money or

property as the result of a prohibited practice.” Iowa Code Ann. § 714H.5(1). “[T]he phrase ‘as a

result of’ can be ‘naturally read simply to impose the requirement of a causal connection.’ ”

Sanders v. Kohler Co., 641 F.3d 290, 294 (8th Cir. 2011) (quoting Brown v. Gardner, 513 U.S.

115, 119 (1994)). “Until recently, [the Iowa Supreme Court] described causation as consisting of

two components: cause in fact and proximate, or legal, cause.” Garr v. City of Ottumwa, 846

N.W.2d 865, 869 (Iowa 2014) (citations omitted). But the Iowa Supreme Court “no longer refer[s]

to proximate or legal cause; instead, [it] use[s] a different formulation, scope of liability.” Id.

(citation omitted). Moreover, Iowa courts apply a but-for test in determining whether a “defendant

in fact caused the plaintiff's harm.” Id. The Iowa Supreme Court described that test as follows:

[T]he defendant's conduct is a cause in fact of the plaintiff's harm if, but-for the

defendant's conduct, that harm would not have occurred. The but-for test also

implies a negative. If the plaintiff would have suffered the same harm had the

defendant not acted negligently, the defendant's conduct is not a cause in fact of the

harm.

Id. (quotations and citations omitted). Moreover, “[c]ausation is ordinarily a jury question.” Id. at

870.

The Court finds that Plaintiffs have alleged enough facts that plausibly establish

Defendant’s failure to implement reasonable security measures caused Plaintiffs’ harm, and but

for Defendant’s conduct, that harm would not have occurred. Plaintiffs allege they would not have

been victims of a data breach had Defendant not acted negligently. At this stage, the Court cannot

go into a further inquiry regarding causation as that is ordinarily a question for the jury. Therefore,

the Court declines to dismiss Count VII’s Iowa CFA claim as it relates to the Iowa Plaintiffs.

iv. Misstatements

Defendant argues that to state a claim under the Minnesota DTPA, Minnesota CFA, and

Missouri MPA, Plaintiffs must allege that Defendant made misstatements in connection with the

sale or advertisement of merchandise. Defendant also argues that Plaintiffs’ allegations are

defective because it does not sell data security services. Plaintiffs state that Defendant

misapprehends the case and that their claims instead arise from Defendant’s omission of its data

security failures in its POS systems.

The Minnesota DTPA describes conduct that constitutes deceptive trade practices,

including “pass[ing] off goods or services as those of another,” “caus[ing] likelihood of confusion

or of misunderstanding as to ... certification of goods or services” and “any other conduct which

similarly creates a likelihood of confusion or misunderstanding.” Minn. Stat. Ann.§ 325D.44,

subdiv. 1(1),(2),(13). The Minnesota CFA prohibits “[t]he act, use, or employment by any person

of any fraud, false pretense, false promise, misrepresentation, misleading statement or deceptive

practice, with the intent that others rely thereon in connection with the sale of any merchandise....”

Minn. Stat. Ann. § 325F.69, subdiv. 1. Furthermore, the Missouri MPA was enacted “to preserve

fundamental honesty, fair play, and right dealings in public transactions.” In re Sony Gaming

Networks & Customer Data Sec. Breach Litig., 996 F. Supp. 2d 942, 999 (S.D. Cal. 2014) (internal

quotation and citation omitted). The Act prohibits “deception, fraud, false pretense, false promise,

misrepresentation, unfair practice or concealment, suppression, or omission of any material fact in

connection with the sale or advertisement of any merchandise in trade or commerce.” Mo. Ann.

Stat. § 407.020(1)

At this stage, the Court finds that Plaintiffs have sufficiently pled claims under the

Minnesota and Missouri statutes. Specifically, Plaintiffs allege that Defendant was on notice of its

data security shortcomings and failed to disclose the data breach in a timely manner. These

misstatements were all made in connection with sales at Defendant’s various locations. Courts

have refused to dismiss these types of claims when similar allegations were made. See In re Target

Corp., 66 F.Supp.3d at 1162-63 (denying motion to dismiss claims brought under Minnesota

consumer protection statutes in data breach case); see In re Sony, 966 F.Supp.2d at 999 (denying

motion to dismiss Missouri MPA claim because defendant “omitted material information

regarding the security of its network at the point of sale.”); see also Gordon v. Chipotle Mexican

Grill, Inc., 344 F. Supp. 3d 1231, 1254 (D. Colo. 2018) (affirming magistrate recommendation

denying motion to dismiss Missouri MPA claim in data breach case); but see E-Shops Corp. v.

U.S. Bank Nat. Ass'n, 678 F.3d 659, 666 (8th Cir. 2012) (granting motion to dismiss Minnesota

DPA and CFA claims because factual allegations did not explain “the who, what, when, where

and how [defendant’s] conduct amounted to false, deceptive, or misleading conduct.”). Defendant

urges the Court to follow the opinion in Kuhns v. Scottrade, Inc., 868 F.3d 711, 719 (8th Cir.

2017), where the court granted defendant’s motion to dismiss plaintiffs’ Missouri MPA claim;

however, in that case, a securities brokerage firm told its customers that data security measures

were in place to induce customers to voluntarily transfer their personal identifying information to

defendant in order to obtain its brokerage services. Id. Here, Defendant did not induce consumers

to provide personal identifying information by telling them they had data security measures in

place in order for them to purchase merchandise, such as food or gas. Plaintiffs state that according

to Defendant’s argument, the only viable data breach class action lawsuits would be those asserting

claims against companies that sell data security services, and such an argument would be

nonsensical. The Court agrees. As stated above, there are numerous data breach cases that proceed

against businesses that do not sell data security. Therefore, the Court declines to dismiss Counts

XI and XII Minnesota CFA and DTPA claims as they relate to the Minnesota Plaintiffs. The Court

also declines to dismiss Count XIII’s Missouri MPA claim as it relates to the Missouri Plaintiffs.

v. Future Deception or Harm

Defendant argues that Plaintiffs have failed to allege a likelihood of future harm as required

under the Illinois DTPA and Minnesota DTPA, because those statutes only permit injunctive relief.

Plaintiffs contend that they made allegations of risk of future harm resulting from the breach

because their stolen information could be used in the future to perpetrate identity theft, to drain

bank accounts, or make clone cards.

The Illinois DTPA “was enacted to prohibit unfair competition and was not intended to be

a consumer protection statute.” Chabraja v. Avis Rent A Car Sys., Inc., 549 N.E.2d 872, 876

(Ill. App. Ct. 1989). Nonetheless, a consumer may seek injunctive relief under the DTPA if she

can show that she is likely to be damaged in the future by the defendant's misleading trade

practices. Popp v. Cash Station, Inc., 613 N.E.2d 1150, 1157 (Ill. App. Ct. 1992). In most consumer

actions, the plaintiff is unable to allege facts showing a likelihood of future harm because the harm

has already occurred, and because the plaintiff is unlikely to be deceived by a defendant’s

misstatements again in the future. Reid v. Unilever U.S., Inc., 964 F. Supp. 2d 893, 918 (N.D. Ill.

2013). While Plaintiffs argue that Defendant’s misrepresentations leave them open to a future risk

of additional fraudulent activity, this is not the type of harm that the Court is able to issue an

injunction against. In other words, the Court cannot stop hackers from using their information in

the future. Additionally, Plaintiffs acknowledge that Defendant has “removed the malware and

implemented enhanced security measures.” (ECF No. 21 at 19). Courts have ruled that these types

of allegations do not suffice as threat of future harm. See Fox, 399 F. Supp. 3d at 799–800

(plaintiff’s’ “arguments go to the risk of harm that [plaintiff] faces from the data breaches

themselves, not the risk of harm that [plaintiff] faces if [defendant] continues to misrepresent its

protective measures . . . because [plaintiff] does not explain how this risk of harm will be abated

if the court enters an injunction … the court will dismiss [plaintiff’s] claim under the [Illinois

DTPA].”) Therefore, the Court dismisses Count VI’s Illinois DTPA claim as they relate to the

Illinois Plaintiffs.

Similarly, the Minnesota DTPA also requires that Plaintiffs allege a likelihood of future

harm. See Johnson v. Bobcat Co., 175 F. Supp. 3d 1130, 1140-1141 (D. Minn. 2016) (recognizing

that a plaintiff must allege a threat of future injury in order to receive injunctive relief under the

Minnesota DTPA). For the same reasons cited above, the Court will also dismiss Count XII’s

Minnesota DTPA claim as it relates to the Minnesota Plaintiffs.

vi. Nexus to Illinois

Lastly, Defendant argues that Plaintiff Davis-Berg’s Illinois CFA and DTPA claims should

be dismissed because while Plaintiff alleges to be a resident of Illinois, she used her credit card to

make a gas purchase in Kansas.

To bring a claim under the Illinois CFA or DTPA, a plaintiff must allege “circumstances

that relate to the disputed transaction occur primarily and substantially in Illinois.” Int'l Equip.

Trading, Ltd. v. Illumina, Inc., 312 F. Supp. 3d 725, 733 (N.D. Ill. 2018) (quoting Avery., 835

N.E.2d at 853). Here, Davis-Berg’s disputed transaction occurred in Kansas, not Illinois.

Therefore, Plaintiffs have not sufficiently pled an Illinois CFA or DTPA claim for Davis-Berg.

The Court will allow Plaintiffs to replead only the Illinois CFA claim on behalf of Davis-Berg, but

not the Illinois DTPA since the Court has already dismissed the claim.

CONCLUSION

For the reasons stated above, Defendant’s Motion to Dismiss [31] is GRANTED IN

PART and DENIED IN PART.

- Count I’s negligence claim and Count II’s negligence per se claim are dismissed as they

relate to the Illinois Plaintiffs, the Missouri Plaintiffs, the Kansas Plaintiffs, and the Iowa

Plaintiffs;

- Count IV’s breach of contract claim is dismissed without prejudice and the Court grants

Plaintiffs leave to file an amended complaint to re-plead this count within twenty-one (21)

days, if they can do so in good faith;

- Count XV’s unjust enrichment claim is dismissed;

- Count XIV’s claim under the Wisconsin DTPA is dismissed as it relates to the Wisconsin

Plaintiffs;

- Count VI’s claim under the Illinois DTPA is dismissed as it relates to the Illinois Plaintiffs;

- Count XII’s claim under the Minnesota DTPA claim is dismissed as they relate to the

Minnesota Plaintiffs; and

- The Court will allow Plaintiffs to replead the Illinois CFA claim on behalf of Davis-Berg.

The Court declines to dismiss all remaining causes of action. The Court will also reach out the

Parties to schedule a status conference in order to address class certification under Fed. R. Civ. P.

23(c)(1).

ENTERED this 20th day of April, 2020.

/s/ Michael M. Mihm

Michael M. Mihm

United States District Judge