# Doe v. The Mission Essential Group, LLC

> District Court, S.D. Ohio · August 20, 2024

URL: https://www.frixlaw.com/law-library/cases/10665130

## Case

- **Court:** District Court, S.D. Ohio
- **Decided:** August 20, 2024
- **Opinion:** 100trialcourt
- **Cited by:** 0 later opinions in the Frix Law Library

## Citator (automated)

- No negative treatment found by the automated citator. That is not the same as a confirmation that the case is good law; read the citing cases.
- Full citator and citing cases: https://www.frixlaw.com/law-library/cases/10665130

## Opinion text

UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF OHIO
EASTERN DIVISION

JOHN DOE, on behalf of
himself and all others
similarly situated,
:
Plaintiff,
Case No. 2:23-cv-3365

Judge Sarah D. Morrison
v.
Magistrate Judge Elizabeth

Preston Deavers

THE MISSION ESSENTIAL :
GROUP, LLC,

Defendant.

OPINION AND ORDER
This matter is before the Court on the Motion to Dismiss (Mot., ECF No. 23)
filed by The Mission Essential Group, LLC (“MEG”). Plaintiff John Doe1 responded
(Resp., ECF No. 24), and MEG filed a Reply (Reply, ECF No. 25). This matter is
now ripe for consideration. For the reasons set forth below, Plaintiff lacks standing
to assert his claims, and MEG’s Motion is GRANTED.
I. FACTUAL BACKGROUND
The following summary draws from the allegations in the First Amended
Class Action Complaint (“FAC”), as well as any documents integral to and
incorporated therein.2 (ECF No. 17 (public) / ECF No. 16 (sealed).)

1 The Court previously granted Plaintiff leave to proceed under a pseudonym.
(ECF No. 14.)

2 “[W]hen a document is referred to in the pleadings and is integral to the
claims, it may be considered without converting a motion to dismiss into one for
MEG is a private contractor that offers translation and interpretation
services to the United States government, friendly foreign governments, and select
private sector segments. (FAC, ¶¶ 1, 18.) MEG specializes in supporting

“intelligence operations for warfighters” by providing “difficult-to-find language
experts” in the Middle East, Africa, and Asia. (Id., ¶ 19.)
Plaintiff was formerly employed by MEG as a translation expert. (FAC,
¶¶ 25, 44.) As a condition of his employment, Plaintiff provided MEG with certain
personally identifiable information (“PII”), including, but not limited to, his full
name and Social Security number. (Id., ¶¶ 11, 26, 46.) MEG collects and maintains
current and former employees’ PII in its computer systems in accordance with

federal and state law, industry standards, and its internal privacy policies. (Id.,
¶¶ 23, 27–28.)
In September 2022, federal law enforcement authorities alerted MEG “of a
potential incident wherein certain [MEG] email accounts may have been accessed
and/or acquired by an unauthorized actor.” (FAC, ¶ 29; id., Ex. A. (“Notice”), ECF
No. 17-1, PAGEID # 183.) The types of PII that were “potentially present” in MEG

email accounts included the full names and Social Security numbers of current and
former employees and contractors and their spouses, dependents, or beneficiaries.
(FAC, ¶ 29; Notice, PAGEID # 183.) Following an internal investigation, however,

summary judgment.” Doe v. Ohio State Univ., 219 F. Supp. 3d 645, 653 (S.D. Ohio
2016) (Graham, J.) (citations omitted); see also Williams v. CitiMortgage, Inc., 498
Fed. App’x. 532, 536 (6th Cir. 2012) (per curiam) (“The law is clear that the Court
may consider [a document] attached to the Complaint … in determining whether
dismissal is proper.”).
MEG “was unable to validate the reports from law enforcement” that any
unauthorized access or data breach had occurred and was “unaware of any actual or
attempted misuse” of PII. (FAC, ¶ 33; Notice, PAGEID # 183.)

“[O]ut of an abundance of caution,” in July 2023, MEG notified Plaintiff and
other current and former employees and contractors about the potential data breach
(the “Data Incident”). (FAC, ¶ 35; Notice, PAGEID # 183.) The Notice did not convey
when the Data Incident occurred, how MEG’s network could have been hacked, or
whether cybercriminals, terrorists, or hostile government actors were involved.
(FAC, ¶¶ 5, 30.) In the Notice, MEG encouraged recipients whose PII may have
been contained in an email account to “remain vigilant against incidents of identity

theft and fraud” and offered one year of limited credit monitoring and identity
restoration services. (Id., ¶¶ 38, 40; Notice, PAGEID # 184–86.) MEG also confirmed
that it was reviewing and updating its existing data protection and security policies
and investigating additional security measures to ensure future protection of PII.
(Notice, PAGEID # 184.)
Plaintiff believes that “one or more of [MEG’s] employees gave malicious

threat actors the credentials needed to access [MEG’s] email accounts” through
“basic social engineering techniques like phishing.” (FAC, ¶¶ 31–32.) After receiving
MEG’s Notice, Plaintiff purchased anti-malware and anti-identity theft protection
software on his and his family’s electronic devices. (Id., ¶ 52.) He also began
receiving emails containing crypto-currency links, as well as “strange and
concerning military-related emails” from unrecognized senders appearing to be of
Russian origin that promoted fraudulent offers for a military translation job. (Id.,
¶ 56.) Plaintiff believes these emails suggest that his PII “has been placed in the
hands of cybercriminals, hostile government actors, and terrorists.” (Id.)

II. PROCEDURAL HISTORY

Plaintiff commenced this putative class action against MEG in October 2023
and amended his Complaint shortly thereafter to add new claims and factual
allegations. (ECF Nos. 1, 17.) In the FAC, Plaintiff alleges that due to MEG’s failure
to act with reasonable care and comply with standard security practices, an
unknown actor was able to gain access to MEG’s system via employee email
addresses, thereby compromising and allowing third-party cybercriminals to
acquire his sensitive PII and that of putative class members stored on MEG’s
network. (FAC, ¶¶ 1–4, 10, 23, 29.)
Plaintiff brings seven claims against MEG arising from the Data Incident:
• Negligence (Count I);
• Negligence Per Se (Count II);
• Breach of Implied Contract (Count III);
• Breach of Fiduciary Duty (Count IV);
• Invasion of Privacy / Intrusion upon Seclusion (Count V);
• Unjust Enrichment (Count VI); and
• Declaratory Judgment (Count VII).

(FAC, ¶¶ 96–163.)
As a result of MEG’s failure to protect employees’ PII and failure to
sufficiently notify them of the Data Incident, Plaintiff alleges that he and the
putative class have suffered or are at an increased risk of suffering various forms of
harm, including: (1) lost time and effort monitoring accounts to prevent identity
theft; (2) costs associated with purchasing anti-theft protection software; (3)
violation of privacy rights; (4) diminution in value of their PII; (5) increased risk of
identity theft and physical danger; (6) an increase in “spam” or fraudulent emails;

(7) the deprivation of the “earliest opportunity” to guard their PII due to a delay in
notification of the Data Incident; and (8) emotional distress. (Id., ¶¶ 48, 51–57, 63–
70.) Plaintiff seeks damages and injunctive relief requiring MEG to employ
adequate security practices consistent with law and industry standards to protect
its users’ PII. (Id., ¶ 159, Prayer for Relief.)
MEG now moves to dismiss all claims against it. (Mot., PAGEID # 243.) MEG
argues that Plaintiff lacks standing because his “sole basis for relief rests upon the

risk of hypothetical harms” rather than a concrete injury-in-fact and because any
alleged harm was caused by “independent actions of unknown third parties” and
cannot be fairly traced to MEG. (Id.) Because this argument is dispositive, the
Court need not address MEG’s alternative arguments for dismissal.
III. STANDARD OF REVIEW

“Subject matter jurisdiction is a threshold matter that a court must decide
prior to considering a claim’s merits.” Boyd v. United States, 932 F. Supp. 2d 830,
834 (S.D. Ohio 2013) (Marbley, J.). Without subject matter jurisdiction, a federal
court lacks authority to hear a case. Lightfoot v. Cendant Mortg. Corp., 580 U.S. 82,
92 (2017); see also Kokkonen v. Guardian Life Insurance Co. of America, 511 U.S.
375, 377 (1994) (federal courts are “courts of limited jurisdiction” that “possess only
that power authorized by Constitution and statute”). Federal Rule of Civil
Procedure 12(b)(1) provides for dismissal when the Court lacks subject matter
jurisdiction. “When subject matter jurisdiction is challenged under Rule 12(b)(1),
the plaintiff has the burden of proving jurisdiction in order to survive the motion.”

Madison–Hughes v. Shalala, 80 F.3d 1121, 1130 (6th Cir. 1996).
Motions to dismiss for lack of subject matter jurisdiction fall into two general
categories: facial attacks and factual attacks. United States v. Ritchie, 15 F.3d 592,
598 (6th Cir. 1994). Here, MEG puts forth a facial attack, which “questions merely
the sufficiency of the pleading[,]” and the Court therefore takes the allegations of
the FAC as true and construes them in the light most favorable to Plaintiff. (Mot.,
PAGEID # 247 n.4); Wayside Church v. Van Buren Cty., 847 F.3d 812, 816 (6th Cir.

2017) (internal quotations omitted); Ohio Nat. Life Ins. Co. v. United States, 922
F.2d 320, 325 (6th Cir. 1990). To survive a facial attack, the complaint must contain
a “short and plain statement of the grounds” for jurisdiction. Rote v. Zel Custom
Mfg. LLC, 816 F.3d 383, 387 (6th Cir. 2016) (internal quotations and citations
omitted). However, “conclusory allegations or legal conclusions masquerading as
factual conclusions will not suffice to prevent a motion to dismiss.” Mezibov v. Allen,

411 F.3d 712, 716 (6th Cir. 2005).
IV. ANALYSIS

Pursuant to Article III of the United States Constitution, standing is
necessary to the exercise of jurisdiction and “determin[es] the power of the court to
entertain the suit.” Warth v. Seldin, 422 U.S. 490, 498 (1975); see also TransUnion
LLC v. Ramirez, 594 U.S. 413, 417 (2021) (citation omitted) (“[U]nder Article III,
the plaintiff must have a ‘personal stake’ in the case—in other words, standing.”). If
the plaintiff lacks standing, then the federal court lacks jurisdiction. Tennessee Gen.
Assembly v. U.S. Dep’t of State, 931 F.3d 499, 507 (6th Cir. 2019).

To demonstrate Article III standing, the plaintiff must establish three
elements:
First, the plaintiff must have suffered an injury in fact—an invasion of
a legally protected interest which is (a) concrete and particularized,
and (b) actual or imminent, not conjectural or hypothetical. Second,
there must be a causal connection between the injury and the conduct
complained of—the injury has to be fairly traceable to the challenged
action of the defendant, and not the result of the independent action of
some third party not before the court. Third, it must be likely, as
opposed to merely speculative, that the injury will be redressed by a
favorable decision.

Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992) (cleaned up); see also
TransUnion, 594 U.S. at 423 (citing Lujan). The plaintiff “bears the burden of
establishing these elements” and must at the pleading stage “clearly ... allege facts
demonstrating” each element. Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016)
(citations omitted); Warth, 422 U.S. at 338.
A. Injury-in-Fact

Injury is “the ‘[f]irst and foremost’ of standing’s three elements.” Spokeo, 578
U.S. at 338–39 (quoting Steel Co. v. Citizens for Better Env’t, 523 U.S. 83, 103
(1998)). “To establish injury in fact, a plaintiff must show that he or she suffered ‘an
invasion of a legally protected interest’ that is ‘concrete and particularized’ and
‘actual or imminent, not conjectural or hypothetical.’” Id. at 339 (quoting Lujan, 504
U.S. at 560). A plaintiff can demonstrate the existence of an injury-in-fact (1) by
showing that he suffered an actual injury as applied to him; (2) even if no actual
injury in the traditional sense, by showing that the defendant violated a statute and
thereby concretely harmed the plaintiff through the violation; or (3) by

demonstrating an imminent risk of injury. Foster v. Health Recovery Servs., Inc.,
493 F. Supp. 3d 622, 631 (S.D. Ohio 2020) (Marbley, J.). Dismissal is proper only if
all theories of injury-in-fact asserted under any of these three avenues are
implausible. Tate v. EyeMed Vision Care, LLC, No. 1:21-cv-36, 2023 WL 6383467, at
*8 (S.D. Ohio Sept. 29, 2023) (Cole, J.).
The federal circuits are split on what constitutes a sufficient Article III injury
in data breach cases, which often involve allegations like those in this case of future

or speculative fraud, identity theft, or other misappropriation of personal
information. See Kingen v. Warner Norcross + Judd LLP, No. 1:22-CV-01126, 2023
WL 8544231, at *2 (W.D. Mich. Oct. 4, 2023). In the Sixth Circuit, Galaria v.
Nationwide Mut. Ins. Co., 663 Fed. App’x 384 (6th Cir. 2016), is instructive.3 There,
the plaintiffs sued their insurance company, alleging that hackers breached the
company’s network and stole their personal information; they sought damages for,

among other things, the increased risk of fraud and the time and expenses they
incurred in mitigating that risk. Id. at 385, 387. The Sixth Circuit concluded that
the plaintiffs’ allegations “of a substantial risk of harm, coupled with reasonably

3 This Court has questioned Galaria’s viability after TransUnion, 594 U.S.
413, see Brickman v. Maximus, Inc., No. 2:21-cv-3822, 2022 WL 16836186, at *3
(S.D. Ohio May 2, 2022) (Watson, J.), but the Sixth Circuit has yet to reconsider
Galaria in light of TransUnion. Because this Court must follow relevant precedent
from the Sixth Circuit, the Court applies Galaria.
incurred mitigation costs, are sufficient to establish a cognizable Article III injury at
the pleading stage.” Id. at 388. Because the Galaria plaintiffs claimed that “their
data [was] stolen and [was] in the hands of ill-intentioned criminals,” the court

reasoned that the plaintiffs’ alleged injury (the risk of future fraud) was
“sufficiently concrete” because “a reasonable inference [could] be drawn that the
hackers will use the victims’ data for the fraudulent purposes alleged in [the
plaintiffs’] complaints.” Id.
With these principles in mind, the Court turns to the sufficiency of Plaintiff’s
alleged injuries in this case.4

1. Imminent Risk of Injury
Where plaintiffs seek to establish standing based on a risk of future harm
that has yet to materialize, the “threatened injury must be certainly impending to
constitute injury in fact,” and “[a]llegations of possible future injury are not
sufficient.” Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013) (internal
quotations and citation omitted) (emphasis in original). Standing can be “based on a
‘substantial risk’ that the harm will occur,” even where it is not “literally certain.”

Id. at 414 n.5 (citing cases); see also Galaria, 663 Fed. App’x at 388–89 (injury-in-

4 The named plaintiff purporting to represent a class must have standing
himself to seek relief on behalf of putative class members. See Key v. DSW, Inc., 454
F. Supp. 2d 684, 687 (S.D. Ohio 2006) (Frost, J.) (quoting Simon v. Eastern Ky.
Welfare Rights Org., 426 U.S. 26, 40 n.20 (1976)) (“[A]ny named plaintiffs who
represent a class ‘must allege and show that they personally have been injured, not
that injury has been suffered by other, unidentified members of the class to which
they belong and which they purport to represent.’”).
fact may be adequately pled based on “allegations of a substantial risk of harm,
coupled with reasonably incurred mitigation costs”).
Plaintiff alleges that he is at risk of future harm arising from (1) the

potential for identity theft, fraud, or other scams; and (2) the potential for “physical
harm” from unidentified entities and governments due to his position as a military
translator. (FAC, ¶¶ 49, 65–68; Resp., PAGEID # 298–99.) However, he has not
shown that these future risks are substantial or certainly impending.
Initially, and perhaps most problematically, Plaintiff has not sufficiently
alleged that a data breach actually occurred. Plaintiff alleges that “[i]n September
2022, MEG … lost control over its computer network and the highly sensitive

private information stored on the computer network in a data breach perpetrated by
cybercriminals,” such that Plaintiff and members of his proposed class “had their
most sensitive personal information accessed, exfiltrated, and stolen.” (FAC, ¶¶ 1,
4.) In support of this allegation, Plaintiff directs the Court to the Notice of Data
Breach that he received from MEG. (Id., ¶ 2 (citing Notice, PAGEID # 183).) But the
Notice does not state that a data breach occurred—rather, the Notice states that

MEG was “notified by federal law enforcement authorities of a potential incident
wherein certain [MEG] email accounts may have been accessed and/or acquired by
an unauthorized actor.” (Notice, PAGEID # 183.) The Notice explains that “[a]fter a
thorough and comprehensive investigation, [MEG] was unable to validate the
reports from law enforcement and confirm unauthorized access to [MEG] email
accounts occurred.” (Id.) The Notice emphasizes that “there is no evidence of any
actual or attempted misuse” of information. (Id.) Although Plaintiff acknowledges
this language (see FAC, ¶¶ 3, 29, 33), he offers no allegations of fact that contravene
MEG’s statements, only arguing in a conclusory fashion that the Notice was an

ingenuine attempt by MEG to “downplay the severity” of the Data Incident. (FAC,
¶ 33.)
“[I]f a factual assertion in the pleadings is inconsistent with a document
attached for support, the Court is to accept the facts as stated in the attached
document.” Nat’l Ass’n of Minority Contractors, Dayton Chapter v. Martinez, 248 F.
Supp. 2d 679, 681 (S.D. Ohio 2002) (Rice, J.) (citing The Mengel Co. v. Nashville
Paper Prods. & Specialty Workers Union, 221 F.2d 644, 647 (6th Cir. 1955)); see also

Williams, 498 Fed. App’x at 536 (“[W]hen a written instrument contradicts
allegations in the complaint to which it is attached, the exhibit trumps the
allegations.”). MEG’s Notice states that it was unable to confirm or verify any
unauthorized access or exfiltration of any data. “[T]he mere allegation of a risk of
harm based on a data breach, without evidence of data theft or that the intruder
accessed Plaintiff’s specific information, is insufficient to state an ‘imminent’ injury

for purposes of Article III standing.” Foster, 493 F. Supp. 3d at 632. Without
sufficient allegations of an actual data breach or unauthorized access, Plaintiff has
not alleged a substantial risk of future harm. See, e.g., Sifuentes v. Pluto TV, No.
1:23-CV-1013, 2023 WL 7319434, at *1 (W.D. Mich. Nov. 7, 2023) (“In Galaria, the
plaintiffs alleged that their data had been stolen and was [ ] in the hands of ill-
intentioned criminals … But Plaintiff makes no such allegation here. Instead, he
simply claims the existence of a breach of Defendant’s firewall and from that
speculates a parade of horribles.”); Williams-Diggins v. Mercy Health, No. 3:16-CV-
1938, 2018 WL 6387409, at *2 (N.D. Ohio Dec. 6, 2018) (emphasis in original)

(finding lack of standing when plaintiff “only alleged that his personal information
might be accessed improperly, not that it actually was”). Similarly, the Court doubts
the imminency of any future harm to Plaintiff when nearly two years have passed
since the alleged Data Incident with no signs that Plaintiff’s PII has been accessed
or misused. See Black’s Law Dictionary (12th ed. 2024) (defining “imminent” to
mean “threatening to occur immediately,” “dangerously impending,” or “about to
take place”).

Consequently, this case is distinguishable from Galaria. There, “hackers
broke into [the defendant’s] computer network and stole” plaintiffs’ PII. Galaria,
663 Fed. App’x at 386. Thus, they “allege[d] that their data ha[d] already been
stolen and [was] now in the hands of ill-intentioned criminals,” and they “already
knew that they [had] lost control of their data,” meaning there was “no need for
speculation” as to the substantial risk of harm. Id. at 388. Such is not the case here.

2. Actual Injury
Plaintiff also argues that he has sufficiently alleged concrete tangible and
intangible harms as a result of the Data Incident, including (1) “reasonable
mitigation costs” associated with purchasing anti-malware and anti-theft protection
software for “all of his and his family’s electronic devices”; (2) lost time and effort
spent “verifying the legitimacy of the Notice … and self-monitoring his accounts and
credit reports”; (3) emotional distress; (4) his receipt of targeted scam or fraudulent
emails; (5) the deprivation of the “earliest opportunity” to guard his PII due to
MEG’s delayed notification of the Data Incident; (6) violation of his privacy rights;

and (7) property damage to his PII. (FAC, ¶¶ 48, 51–57, 63–70; Resp., PAGEID
# 294–302.) The Court addresses each of these alleged injuries in turn.
Mitigation Costs. Looking first to the costs expended in purchasing protective
software, in light of the fact that Plaintiff has not adequately alleged a substantial
or impending risk of concrete harm, he did not “reasonably” incur these mitigation
costs but rather acted based on his own speculative anticipation of harm. See
Clapper, 568 U.S. at 416 (“Respondents’ contention that they have standing because

they incurred certain costs as a reasonable reaction to a risk of harm is
unavailing—because the harm respondents seek to avoid is not certainly
impending.”).
Plaintiff argues that he “took these steps at MEG’s direction,” pointing to the
Notice warning recipients to “remain vigilant against incidents or identity theft and
fraud.” (Notice, PAGEID # 184; Resp., PAGEID # 296.) But “remain[ing] vigilant”

does not necessarily entail purchasing software for multiple devices, particularly
when MEG had not identified a data breach but nevertheless offered a year of
complimentary credit monitoring and identity restoration services. (FAC, ¶ 52;
Notice, PAGEID # 184.) Plaintiff’s mitigation expenses were made on his own
volition “based on a nonparanoid fear” and do not qualify as actual injuries.
Lost Time and Effort. Plaintiff’s next theory of injury fails because his
allegations are, at best, conclusory as to his “efforts spent researching how to
prevent, detect, contest, and recover from identity theft and fraud” and the “time

spent verifying the legitimacy of the Notice of Data Breach, and self-monitoring his
accounts and credit reports to ensure no fraudulent activity has occurred.” (FAC,
¶¶ 50, 63.)
Further, even if Plaintiff had alleged these facts, his lost time and effort are
not actual injuries for the same reasons as his purchase of protection software.
Although it may have been reasonable to spend some time and effort to mitigate the
risks associated with an actual data breach, these actions are not a concrete injury

where there are no plausible allegations that Plaintiff’s PII was accessed. If
Plaintiff experienced lost time and effort, he did so trying to combat a speculative,
potentially nonexistent threat.
Emotional Distress. Plaintiff asserts that he “has and is experiencing feelings
of anxiety, sleep disruption, stress, fear, and frustration … far beyond allegations of
mere worry or inconvenience.” (FAC, ¶ 51.) Some courts find that emotional distress

can be an injury-in-fact sufficient to confer standing—but only when there are
allegations of actual unauthorized access or disclosure of data. See, e.g., Foster, 493
F. Supp. 3d at 632; McKenzie v. Allconnect, Inc., 369 F. Supp. 3d 810, 816 (E.D. Ky.
2019).
Targeted Fraudulent Emails. After the Data Incident, Plaintiff alleges that
he received cryptocurrency links and “strange and concerning military-related
emails, including fraudulent offers for a military translation job, that appear to be
of Russian origin … sent from unfamiliar Gmail addresses that Plaintiff does not
recognize.” (FAC, ¶ 56.) Despite the explicit conjecture in these allegations, the

Court will consider the receipt of unsolicited commercial email communications to
be a concrete harm, particularly in light of Plaintiff’s sensitive geopolitical military
background. See Tate, 2023 WL 6383467, at *5 (citing Dickson v. Direct Energy, LP,
69 F.4th 338, 345 (6th Cir. 2023), and observing that plaintiffs’ receipt of “a
significantly increased number of scam and phishing calls, texts, and emails”
amounted to “a concrete and particularized injury—if barely”).
Delayed Notice. Plaintiff argues that MEG’s failure to discover and timely

provide notification of the Data Incident made its employees “vulnerable” to
“identity theft, without any warnings … to monitor their financial accounts and
credit reports” and “imminent physical danger, without any warnings about how
the Data Breach renders them sitting ducks for identification, capture and
interrogation by terrorists and hostile government actors, particularly if they leave
American soil.” (FAC, ¶¶ 6, 7.) This speculative allegation is insufficient to establish

an actual injury.
Violation of Privacy Rights. Plaintiff contends that his privacy rights were
violated “when his private information was disclosed to cybercriminals” and “when
cybercriminals disclosed his private information on the dark web—as evidenced by”
his receipt of targeted scam emails. (FAC, ¶¶ 34, 53, 56; Resp., PAGEID # 302.)
These allegations also fail because he has not alleged an actual disclosure or breach
occurred. Plaintiff’s reliance on Allen v. Wenco Mgmt., LLC, 696 F. Supp. 3d 432,
437 (N.D. Ohio 2023), is unavailing—in Allen, the plaintiff alleged that he “received
a data breach notification informing him that his personally identifiable

information was accessed in the breach,” and the defendant admitted that “an
unauthorized person gained access to its network.” ECF No. 1-1, Allen v. Wenco
Mgmt., No. 1:23-cv-103, ¶¶ 12, 29 (Jan. 18, 2023); id., ECF No. 15, ¶¶ 12, 29 (Oct.
13, 2023).
Property Damage to PII. Finally, Plaintiff asserts diminution in the value of
his PII because of the Data Incident and argues that “[c]ourts have held that a loss
in value of personal information supports a finding that a plaintiff has suffered an

injury in fact.” (FAC, ¶¶ 54, 75; Resp., PAGEID # 301.) But, as discussed, he has
failed to plead a data breach.
Moreover, Plaintiff does not allege that he ever tried to derive any value from
his PII. See, e.g., Marlin v. Associated Materials, LLC, No. 5:23CV1621, 2024 WL
2319115, at *3 (N.D. Ohio May 22, 2024); Tate, 2023 WL 6383467, at *12; Lochridge
v. Quality Temp. Servs., Inc., No. 22-CV-12086, 2023 WL 4303577, at *4 (E.D. Mich.

June 30, 2023) (“Plaintiff does not allege any specific facts showing he planned to
sell his information, just that it must have decreased in value because of the data
breach … the court does not find that this suffices as an independent injury in fact
sufficient to confer standing.”). Plaintiff’s contention that a “transfer of value”
occurred because his PII “is likely already available on the dark web” is an
assumption that does not equate to injury. (FAC, ¶ 75.)
C. Traceability
Because Plaintiff has sufficiently alleged an injury-in-fact for his receipt of
allegedly targeted scam emails, the Court looks to whether he has adequately

proven traceability. Lujan, 504 U.S. at 560–61; Spokeo, 578 U.S. at 338.
To establish standing, a plaintiff must demonstrate a “causal connection
between the injury and the conduct complained of—the injury has to be fairly
traceable to the challenged action of the defendant, and not the result of the
independent action of some third party not before the court.” Lujan, 504 U.S. at 560
(internal quotations and citations omitted). The plaintiff “must plausibly tie the
claimed harm to the challenged conduct.” Tate, 2023 WL 6383467, at *6. A

defendant is not liable for injuries that are too remote, purely contingent, or
indirect. Holmes v. Sec. Inv. Prot. Corp., 503 U.S. 258, 268 (1992). “The standard for
establishing traceability for standing purposes is less demanding than the standard
for proving tort causation.” Buchholz v. Tanick, 946 F.3d 855, 866 (6th Cir. 2020).
Here, Plaintiff has not demonstrated that the fraudulent emails he received
are fairly traceable to the Data Incident or MEG’s actions. Among other failures, he

does not allege that his email address was accessed during the Data Incident.
Although he insists that the PII possibly accessed in the Data Incident (including
his name and Social Security number) can be “combined” with other sources to
create “Fullz” packages that can be sold or used to commit fraud (FAC, ¶¶ 65–67),
this chain of events relies not only upon the assumption that PII in MEG’s
possession was improperly accessed, but also upon speculation about the actions of
independent actors in combining the PII with information obtained elsewhere.
Additionally, various other actors could have sent Plaintiff the at-issue

emails, including non-malicious commercial entities like recruiters seeking
applicants for military-related jobs. His hypothetical and conclusory contentions of
menacing connections between the emails and their senders will not suffice to prove
traceability. See Mezibov, 411 F.3d at 716.
D. Redressability
Because Plaintiff has not demonstrated an injury-in-fact that is traceable to
MEG or the Data Incident, the Court need not evaluate redressability.

V. CONCLUSION
Plaintiff is correct that “a plaintiff whose Social Security number is stolen in
a data breach suffers concrete injury for the purpose of Article III standing.” (Resp.,
PAGEID # 294 (citing Galaria, 663 Fed. App’x at 387–90).) However, he has not
adequately pleaded that any of his PII was improperly accessed, let alone stolen.
For this reason, and the reasons set forth above, MEG’s Motion to Dismiss is

GRANTED.

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/cases/10665130. Public record. Not legal advice.