FARLEY v. EYE CARE LEADERS HOLDINGS, LLC

IN THE UNITED STATES DISTRICT COURT

FOR THE MIDDLE DISTRICT OF NORTH CAROLINA

KIMBERLY FARLEY, CHAD )

FORRESTER, and KIMBERLY )

SANDVIG, on behalf of themselves )

and all others similarly situated, )

)

Plaintiffs, )

)

v. ) 1:22-CV-468

)

EYE CARE LEADERS HOLDINGS, )

LLC, )

)

Defendant. )

MEMORANDUM OPINION AND ORDER

Catherine C. Eagles, District Judge.

After receiving notice from their eye care clinics that their personal information

had been implicated in a data breach, the plaintiffs Kimberly Farley, Chad Forrester, and

Kimberly Sandvig began to worry about the future threat of identity theft. Mr. Forrester

was soon the victim of a credit card fraud scheme, and Ms. Sandvig’s credit score

fluctuated dramatically despite no changes in her financial behavior. Believing these and

other occurrences to be associated with the breach, the plaintiffs brought this class action

lawsuit against the defendant, Eye Care Leaders Holdings, LLC (ECL), the entity that

provides medical records platforms and patient management software to the plaintiffs’

eye care clinics and whose data was breached.1

1 The plaintiffs each originally brought separate lawsuits against ECL. The cases were

consolidated for pre-trial purposes, see Docs. 23, 34, and together the plaintiffs filed an amended

consolidated class action complaint, Doc. 31, which ECL now seeks to dismiss. Doc. 35.

ECL moves to dismiss this action for lack of subject-matter jurisdiction and failure

to state a claim. Because the plaintiffs allege facts sufficient to plausibly establish

standing and ECL’s remaining arguments are better presented and evaluated on a more

developed factual record, the motion will be denied.

I. Overview of Factual Allegations and Causes of Action

ECL provides record-keeping and healthcare software to eye care clinics across

the country. Doc. 31 at ¶¶ 25–28. Through its services, ECL maintains and controls

sensitive patient information. Id. at ¶¶ 29–31. Patients provide personal health

information and identifying information to their clinics and physicians who store and

manage that data through ECL. Id. This includes dates of birth, health insurance

information, Social Security numbers, and health care information. Id. at ¶¶ 1, 30.

Ms. Farley, Mr. Forrester, and Ms. Sandvig provided their personal information to

their eyecare clinics, each of which uses ECL’s services. Id. at ¶¶ 17–19, 55–57, 62–64,

73–74. ECL controlled and managed access to the plaintiffs’ information on behalf of

the eyecare clinics. Id.

In 2021, ECL suffered from at least four data breaches, collectively referred to as

“the data breach.” Id. at ¶¶ 1, 3–7. In March 2021, “cybercriminals infiltrated ECL’s

computer systems and crippled a record-keeping system ECL provided to eye care clinics

across the country.” Id. at ¶ 3. During this breach, ECL “permanently lost control” over

sensitive patient information. Id. at ¶¶ 38–39. A similar attack happened in April 2021,

id. at ¶¶ 4, 41, and in August 2021 a former ECL employee “accessed ECL’s systems and

patient’s Private Information.” Id. at ¶ 6; see also id. at ¶ 42. In December 2021, another

breach “exposed substantial amounts of patients’ Private Information.” Id. at ¶ 43. The

total number of data breach victims is approximately three million. Id. at ¶¶ 2, 45.

The plaintiffs’ eyecare clinics notified them of the breach. Id. at ¶¶ 58–59, 65, 75.

As a result of the data breach, each plaintiff has spent considerable time and effort

monitoring accounts to protect or minimize harm from fraudulent activity. Id. at ¶¶ 61,

68, 82. Mr. Forrester was also “the victim of a credit card fraud scheme that resulted in

an unauthorized and fraudulent charge” of about $150 on his credit card. Id. at ¶ 69. Ms.

Sandvig’s email has been hacked since the data breach, and someone changed her email

address. Id. at ¶ 78. Her credit score “plummeted even though she had not changed any

of her financial behavior for months,” id. at ¶ 79, she “has been receiving a significantly

higher number of spam emails and texts,” and has “received a letter indicating that her”

personal information “was recently found on the dark web,” id. at ¶ 80, and she now

“spends approximately $28 a month on data protection services.” Id. at ¶ 81.

The plaintiffs bring claims for negligence, invasion of privacy, unjust enrichment,

and breach of fiduciary duty. They assert federal jurisdiction under 28 U.S.C. § 1332(d),

the Class Action Fairness Act.

II. Analysis

A. Standing

ECL contends that the plaintiffs’ complaint should be dismissed because they fail

to allege facts that plausibly show they have standing to sue. Doc. 36 at 7–17. This is a

facial challenge to standing, so all well-pleaded facts in the complaint are accepted as

true and construed in the light most favorable to the plaintiffs. See Wikimedia Found. v.

Nat’l Sec. Agency, 857 F.3d 193, 208 (4th Cir. 2017).

“The doctrine of standing is an integral component of the case or controversy

requirement” of federal jurisdiction. Miller v. Brown, 462 F.3d 312, 316 (4th Cir. 2006).

“The party invoking federal jurisdiction bears the burden of establishing” standing.

Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992). The party “must demonstrate

standing for each claim” and “for each form of relief” it seeks. TransUnion LLC v.

Ramirez, 141 S. Ct. 2190, 2208 (2021).

Standing under Article III has three elements: (1) “the plaintiff must have suffered

an injury in fact,” (2) the injury must be “fairly traceable” to the defendant, and (3) “it

must be likely, as opposed to merely speculative, that the injury will be redressed by a

favorable decision.” Lujan, 504 U.S. at 560–61 (cleaned up).

Injury in fact is the “invasion of a legally protected interest which is (a) concrete

and particularized and (b) actual or imminent, not conjectural or hypothetical.” Lujan,

504 U.S. at 560 (cleaned up). “For an injury to be particularized, it must affect the

plaintiff in a personal and individual way.” Spokeo, Inc. v. Robins, 578 U.S. 330, 339

(2016) (cleaned up). “A concrete injury must be de facto; that is, it must actually exist.”

Id. at 340 (cleaned up). “[I]ntangible harms can also be concrete.” TransUnion, 141 S.

Ct. at 2204 (discussing how reputational harms, disclosure of private information, and

abridgement of free speech qualify as concrete harms). Two recent Fourth Circuit cases

provide helpful guidance in evaluating injury and traceability in a data breach case.

In Beck v. McDonald, the court considered two consolidated appeals brought by

plaintiffs who sued a medical center after two data breaches compromised their personal

information. 848 F.3d 262, 266–67 (4th Cir. 2017). In one underlying case, a laptop

computer containing unencrypted patient information was either lost or stolen. Id. at 267.

In the other, “four boxes of pathology reports headed for long-term storage” and

containing personal information “had been misplaced or stolen.” Id. at 268. In both

cases, the plaintiffs alleged injury in fact based on an increased risk of identity theft, and

the district court dismissed the claims for lack of standing. Id. at 267–69.

The Fourth Circuit affirmed, agreeing that the harms alleged were too speculative

to establish standing because they required the court to engage with and credit an

“attenuated chain of possibilities.” Id. at 275 (quoting Clapper v. Amnesty Int’l USA, 568

U.S. 398, 410 (2013)). To find harm, the court would have to assume “that the thief

targeted the stolen items for the personal information they contained” and that the thief

would “then select, from thousands of others, the personal information of the named

plaintiffs and attempt successfully to use that information to steal their identities.” Beck,

848 F.3d at 275. This chain of possibilities was not sufficient to confer standing,

especially since there was no indication that the information had been stolen for the

purpose of identity theft or that any plaintiff was the victim of identity theft. Id.

The next year, the Fourth Circuit considered Hutton v. Nat’l Bd. of Exam’rs in

Optometry, Inc, involving three optometrist-plaintiffs whose personal information was

allegedly stolen when thieves stole data from the defendant, the National Board of

Examiners in Optometry, Inc. 892 F.3d 613, 616 (4th Cir. 2018). Despite allegations

that after the data breach unauthorized persons opened credit cards in the plaintiffs’

names, that their identities had thus been stolen, and that they had spent time and money

on mitigation, the district court dismissed the claims for lack of standing. Id. at 617–18.

The Fourth Circuit distinguished the case from Beck and reversed, explaining that

“[i]n Beck, the plaintiffs alleged only a threat of future injury in the data breach context

where a laptop and boxes” containing personal information “had been stolen, but the

information contained therein had not been misused.” Id. at 621–22. In contrast, the

plaintiffs in Hutton “allege[d] that they ha[d] already suffered actual harm in the form of

identity theft and credit card fraud.” Id. at 622. They had thus “been concretely injured

by the data breach” because someone used or attempted to use their information to open

credit cards without their knowledge. Id. Unlike in Beck, this harm was not speculative

and was sufficient to allege injury in fact. Id.

The plaintiffs’ cases are more like Hutton than Beck. Unlike in Beck where a

laptop was either stolen or lost and four boxes of pathology reports were missing, Beck,

848 F.3d at 267–69, 274–75, thieves here targeted personal information in a series of

massive and deliberate acts, giving rise to an easy inference that the thieves intended to

misuse the personal information they stole. There may be many reasons unrelated to

identity theft why someone might steal a laptop, such as obtaining the laptop itself, and it

is not uncommon for old boxes of documents to be lost or misplaced. But one is hard

pressed to think of a reason why data thieves would engage in a large-scale and

sophisticated operation to steal electronic data containing personal information and only

personal information other than to misuse it, either by identity theft or perhaps as part of

a blackmail or ransomware type scheme. See Remijas v. Neiman Marcus Grp., LLC, 794

F.3d 688, 693 (7th Cir. 2015) (“Why else would hackers break into a store’s database and

steal consumers’ private information? Presumably, the purpose of the hack is, sooner or

later, to make fraudulent charges or assume those consumers’ identities.”).

As in Hutton, the plaintiffs have alleged that thieves targeted and stole personal

information. See, e.g., Doc. 31 at ¶¶ 1, 42, 93, 158. Unlike the plaintiffs in Beck, there

are no other equally likely reasons for the theft. The Fourth Circuit in Beck implied that

such allegations would be sufficient to establish standing, see Beck, 848 F.3d at 274, and

other district courts have found such allegations of targeted data theft to be sufficient to

establish standing. See In re Marriott Int’l, Inc. Customer Data Sec. Breach Litig., 440 F.

Supp. 3d 447, 459 (D. Md. 2020) (finding standing when the defendant “disclosed that it

was the target of” a cyberattack and distinguishing the case from Beck “where there were

no allegations of targeting”); Stamat v. Grandizio Wilkins Little & Matthews, LLP, No.

22-CV-747, 2022 WL 3919685, at *6 (D. Md. Aug. 31, 2022) (“[C]ourts have permitted

a plaintiff to establish standing where the [personal identifying information] was the

specific target of the attack.”).

Like the plaintiffs in Hutton, Mr. Forrester and Ms. Sandvig also allege actual

misuse of their information. At some point after the data beach, someone placed a

fraudulent and unauthorized charge on Mr. Forrester’s credit card. Doc. 31 at ¶ 69.

Someone also hacked Ms. Sandvig’s email, id. at ¶ 78, and her credit scored inexplicably

plummeted and then fluctuated dramatically. Id. at ¶ 79. Additionally, Ms. Sandvig “has

been receiving a significantly higher number of spam emails and texts.” Id. at ¶ 80.

These injuries are sufficient to satisfy Article III standing.2 See Krakauer v. Dish

Network, L.L.C., 925 F.3d 643, 653 (4th Cir. 2019); Garey v. James S. Farrin, P.C., 35

F.4th 917, 921–22 (4th Cir. 2022); McCreary v. Filters Fast LLC, No. 20-CV-595, 2021

WL 3044228, at *4–5 (W.D.N.C. July 19, 2021).

Accepting the allegations in the complaint as true, the injuries are “fairly

traceable” to ECL. See Lujan, 504 U.S. at 560. The “fairly traceable” standard is not the

same as the tort causation standard. Friends of the Earth, Inc. v. Gaston Copper

Recycling Corp., 204 F.3d 149, 161 (4th Cir. 2000). Instead, “[i]t must simply be

plausible that” the data breach “was the cause” of the plaintiffs’ injuries. See Bank of La.

v. Marriott Int’l, Inc., 438 F. Supp. 3d 433, 441 (D. Md. 2020). The plaintiffs have

established standing to the extent required at this stage.

ECL also argues that the plaintiffs lack standing to seek prospective relief. Doc.

36 at 15–17. “A plaintiff can satisfy the injury-in-fact requirement for prospective relief

either by demonstrating a sufficiently imminent injury in fact or by demonstrating an

ongoing injury.” Garey, 35 F.4th at 922 (cleaned up).

Accepting the allegations in the complaint as true, the plaintiffs have established a

substantial risk of future injury. Some data breach victims have already experienced the

2 Although Ms. Farley has not alleged actual misuse of her data, see generally Doc. 31, her

allegations of targeted theft of personal information are sufficient to establish standing in the

context of this case, especially since other plaintiffs have alleged actual misuse. See In re

Marriott Int’l, Inc., 440 F. Supp. 3d at 460 (“The allegations about the targeting of personal

information in the cyberattack and the allegations of identity theft by other plaintiffs whose

personal information was stolen makes the threatened injury sufficiently imminent. In other

words, in these circumstances the remaining . . . Plaintiffs do not have to wait until they, too,

suffer identity theft to bring their claims to this court.”).

misuse of their data, resulting in spam messages, hacked email addresses, fraudulent

credit card charges, and adverse impacts to their credit scores. In these circumstances,

the plaintiffs’ fear of future injury is not just speculative. See In re Marriott Int’l, Inc.,

440 F. Supp. 3d at 460 (“The allegations about the targeting of personal information in

the cyberattack and the allegations of identity theft by other plaintiffs whose personal

information was stolen makes the threatened injury sufficiently imminent.”); Desue v.

20/20 Eye Care Network, Inc., No. 21-CV-61275, 2022 WL 796367, at *5 (S.D. Fla.

Mar. 15, 2022). They provide facts that plausibly allege a significant risk that ECL will

again be targeted by data thieves, see, e.g., Doc. 31 at ¶¶ 12, 16, 48, 119, and they allege

that ECL continues to store their personal information. Id. at ¶ 119.

B. Failure to State a Claim

ECL argues that the laws of the plaintiffs’ home states, Tennessee and Missouri,

govern their claims and that under these laws all the claims fail. Doc. 36 at 18–24. In a

diversity case, a federal district court applies the choice of law rules of the state in which

it sits. Perini/Tompkins Joint Venture v. Ace Am. Ins. Co., 738 F.3d 95, 100 (4th Cir.

2013). In tort and “tort-like” actions, North Carolina follows the rule of lex loci, applying

the law of the state where the injury occurred. SciGrip, Inc. v. Osae, 373 N.C. 409, 420,

838 S.E.2d 334, 343 (2020); Boudreau v. Baughman, 322 N.C. 331, 335, 368 S.E.2d 849,

854 (1988) (applying law of the place where the injury occurred in a negligence case);

Harco Nat’l Ins. Co. v. Grant Thornton LLP, 206 N.C. App. 687, 692, 698 S.E.2d 719,

722–23 (2010) (citing Boudreau, 368 S.E.2d at 853–54). This is ordinarily “the state

where the last event necessary to make the actor liable or the last event required to

constitute the tort takes place.” SciGrip, 838 S.E.2d at 343 (cleaned up).

Each cause of action must be evaluated separately to determine what the alleged

injury is and where it allegedly occurred. Boudreau, 368 S.E.2d at 853–54 (analyzing

causes of action separately for conflict of law purposes). This may be, but is not

necessarily, the plaintiff’s place of residence; the lex loci test “requires application of the

law of the state where the plaintiff has actually suffered harm.” Harco, 698 S.E.2d at 726

(applying the lex loci test to a misappropriation of trade secrets claim and rejecting the

defendant’s argument that the law where the plaintiff resided was automatically the law

that applied).

In a data breach case applying the lex loci test under similar if not identical South

Carolina law at the motion to dismiss stage, the United States District Court for the

District of South Carolina has concluded that as to various negligence claims, the injury

occurs when the data is stolen. In re Blackbaud, Inc., Customer Data Breach Litig., 567

F. Supp. 3d 667, 675 (D.S.C. 2021). The court applied the law of the state where the

defendant was headquartered “because the place of the breach cannot be determined

without further discovery and South Carolina is the only Blackbaud location specifically

enumerated in the record.” Id. at 676.

So too here. For purposes of the motion to dismiss, the Court will apply North

Carolina law. See, e.g., Doc. 31 at ¶¶ 20, 27 (providing that ECL is headquartered in

Durham, North Carolina). A more definitive resolution of the choice of law question is

deferred until “after the parties have developed the factual evidence through the process

of discovery,” Clean Earth of Md., Inc. v. Total Safety, Inc., No. 10-CV-119, 2011 WL

1627995, *4(N.D.W. Va. Apr. 28, 2011), and with briefing that addresses more

specifically where the injury ascribed to each cause of action arose. See, e.g., In re

Blackbaud, Inc., 567 F. Supp. 3d at 675 n.5 (collecting cases supporting this approach).

ECL argues that the plaintiffs fail to state any valid claim for relief under North

Carolina law. But plaintiffs are not required to prove their case in the complaint. See

Robertson v. Sea Pines Real Est. Cos., 679 F.3d 278, 291 (4th Cir. 2012) (“Iqbal and

Twombly do not require a plaintiff to prove his case in the complaint.”). The plaintiffs

have met the minimal standard of plausibility for each of their claims. Any weaknesses

of those claims will be better evaluated on a more developed factual record.

iI. Conclusion

The plaintiffs allege targeted data theft of their personal information as well as

actual misuse of that information. These allegations are sufficient to support standing.

And ECL’s arguments on choice of law and otherwise are better evaluated on a more

fully developed record. ECL’s motion to dismiss will be denied. The defendant’s motion

to dismiss the plaintiff Jeanne Byers’ complaint will be resolved in a separate order.

It is ORDERED that the defendant’s motion to dismiss, Doc. 35, is DENIED.

This the 30th day of January, 2023.

bh he □□

UNITED STATES DISTRICT JUDGE

11