# EMMETT v. CITRIX SYSTEMS, INC.

> District Court, W.D. Pennsylvania · July 11, 2025

URL: https://www.frixlaw.com/law-library/cases/11098687

## Case

- **Court:** District Court, W.D. Pennsylvania
- **Decided:** July 11, 2025
- **Opinion:** 100trialcourt
- **Cited by:** 0 later opinions in the Frix Law Library

## Citator (automated)

- No negative treatment found by the automated citator. That is not the same as a confirmation that the case is good law; read the citing cases.
- Full citator and citing cases: https://www.frixlaw.com/law-library/cases/11098687

## How later opinions describe it (automated extraction)

- holding that the doctrine only applies to deliberate inconsistencies that are “tantamount to a knowing misrepresentation to or even fraud on the court.”
- finding that the “combination of financial and personal information is particularly concerning as it could be used to perpetrate both identity theft and fraud.”

## Opinion text

IN THE UNITED STATES DISTRICT COURT
FOR THE WESTERN DISTRICT OF PENNSYLVANIA

RYAN EMMETT, individually and on behalf
of himself and others similarly situated,

Plaintiff, Civil Action No. 2:25-cv-546

v. Hon. William S. Stickman IV

CITRIX SYSTEMS, INC., et al,

Defendants.

MEMORANDUM OPINION

WILLIAM S. STICKMAN IV, United States District Judge
Defendants Comcast Cable Communications, LLC and Comcast Corporation (collectively,
“Comcast”) filed a Motion to Transfer Venue (ECF No. 22) requesting that the Court transfer this
litigation to the United States District Court for the Eastern District of Pennsylvania (“EDPA”).
Plaintiff Ryan Emmett (“Emmett”) opposed Comcast’s motion to transfer (ECF No. 27). Emmett
filed a Motion to Remand or, in the Alternative, Motion for a More Definite Statement (ECF No.
25) requesting that the Court remand this litigation to the Court of Common Pleas of Allegheny
County, Pennsylvania, or, in the alternative, order a more definite statement as to subject-matter
jurisdiction. Defendants Citrix Systems, Inc. and Cloud Software Group, Inc. (collectively,
“Citrix”) opposed Emmett’s motion to remand and requested that the Court transfer the litigation
to the EDPA. (ECF No. 28). Comcast also opposed Emmett’s motion for remand. (ECF No. 29).
For the following reasons, the Court will grant Emmett’s motion for remand and deny Comcast’s
motion to transfer.
I. FACTUAL BACKGROUND
Emmett filed this action in the Court of Common Pleas of Allegheny County,
Pennsylvania, on behalf of himself and all others similarly situated against Comcast and Citrix.
(See generally ECF No. 1-1).1 Comcast provides internet services and products, cable television,
a mobile 5G network, and landline telephone services and products to individuals and businesses

across the United States under the brand name Xfinity. (Id. ¶ 1). Citrix provides a variety of
business technology services including application and desktop virtualization, networking,
software, and cloud computing services. (Id. ¶ 2). This lawsuit centers around an alleged data
breach that occurred in October 2023 (“the Data Breach”) and allegations that Comcast and Citrix
failed to properly secure and safeguard the personally identifiable information (“PII”) of
approximately 36 million Comcast customers. (Id. ¶ 3).
Emmett seeks to represent a forty-nine (49) state class and subclass as detailed below:
49-State Class: All natural persons residing in the United States excluding
California, whose [PII] was compromised as a result of the Data Breach.

Cable Act Subclass: All natural persons residing in the United States, excluding
California, whose [PII] was compromised as a result of the Data Breach, and who
received Xfinity Residential Services (including Xfinity Cable Television, Xfinity
TV, Xfinity Internet, and/or Xfinity Voice).

(Id. ¶ 209).
The complaint contains the following counts:
• Count One (on behalf of Emmett and the 49-State Class, or alternatively, on behalf of
Emmett and the Cable Act Subclass, against Comcast): Emmett alleges that Comcast
violated various provisions of the Cable Communications Act, 47 U.S.C. §§ 551(a), (c),

1 Emmett’s counsel also filed a related action in California state court on behalf of only California
residents. See Scheirer v. Comcast Commc’ns Corp. LLC, et al., No. 25CV116323 (Alameda
Cnty. Super. Ct. Mar. 21, 2025).
and (e) by failing to prevent access to his and class members’ PII by unauthorized third
parties. (Id. ¶¶ 224-36).
• Count Two (on behalf of Emmett and the 49-State Class against Comcast): Emmett alleges
that Comcast acted negligently by protecting its customers’ PII with inadequate security

measures. (Id. ¶¶ 237-53).
• Count Three (on behalf of Emmett and the 49-State Class against Comcast): Emmett
alleges that Comcast was negligent per se by failing to provide fair, reasonable, or adequate
computer systems and data security practices to safeguard Emmett’s and proposed class
members’ PII. (Id. ¶¶ 254-66).
• Count Four (on behalf of Emmett and the 49-State Class against Comcast): Emmett
alleges that Comcast breached an express contract by failing to protect Emmett’s and
proposed class members’ PII. (Id. ¶¶ 267-76).
• Count Five (on behalf of Emmett and the 49-State Class against Comcast): Emmett alleged

that Comcast breached an implied contract with Emmett and the proposed class members
by failing to protect their PII. (Id. ¶¶ 276-87).
• Count Six (on behalf of Emmett and the 49-State Class against Comcast): Emmett alleges
that Comcast will be unjustly enriched if it is permitted to retain the benefits derived after
the alleged theft of Emmett’s and proposed class members’ PII. (Id. ¶¶ 287-303).
• Count Seven (on behalf of Emmett and the 49-State Class against Citrix): Emmett alleges
that Citrix negligently failed to implement adequate security measures to protect Emmett’s
and proposed class members’ PII. (Id. ¶¶ 303-20).
• Count Eight (on behalf of Emmett and the 49-State Class against Citrix): Emmett alleges
that Citrix was negligent per se in failing to implement reasonable data security measures
to protect and secure Emmett’s and proposed class members’ PII. (Id. ¶¶ 320-30).
• Count Nine (on behalf of Emmett and the 49-State Class against Comcast and Citrix):

Emmett seeks a declaratory judgment stating that (1) Comcast owes a legal duty to secure
customers’ PII under the common law, 15 U.S.C. § 45, and the Cable Communications
Policy Act; (2) Citrix owes a legal duty to secure customers’ PII under the common law
and 15 U.S.C. § 45; (3) Comcast and Citrix continue to breach this legal duty by failing to
employ reasonable data security measures to safeguard Emmett’s and proposed class
members’ PII. Emmett also requests corresponding injunctive relief requiring Comcast
and Citrix to employ adequate security protocols consistent with law and industry standards
to protect customers’ PII. (Id. ¶¶ 330-38).
II. STANDARD OF REVIEW
Under 28 U.S.C. § 1441(a), a defendant may remove a civil action filed in a state court if

the federal court would have had original jurisdiction over the action. “The defendants bear the
burden of establishing removal jurisdiction and compliance with all pertinent procedural
requirements.” Winnick v. Pratt, 2003 WL 21204467, at *2 (E.D. Pa. May 20, 2003) (citing Boyer
v. Snap–On Tools Corp., 913 F.2d 108, 111 (3d Cir. 1990)). The removal statutes “are to be strictly
construed against removal and all doubts should be resolved in favor of remand.” Boyer, 913 F.2d
at 111 (quoting Steel Valley Authority v. Union Switch & Signal Div., 809 F.2d 1006, 1010 (3d
Cir.1987)). 28 U.S.C. § 1447(c) states:
A motion to remand the case on the basis of any defect other than lack of subject
matter jurisdiction must be made within 30 days after the filing of the notice of
removal under section 1446(a). If at any time before final judgment it appears that
the district court lacks subject matter jurisdiction, the case shall be remanded.
28 U.S.C. § 1447(c). Remand to state court is therefore appropriate for “(1) lack of district court
subject matter jurisdiction or (2) a defect in the removal process.” PAS v. Travelers Ins. Co., 7
F.3d 349, 352 (3d Cir. 1993).
III. ANALYSIS
The Court must decide which motion to address first: the motion to remand or the motion
to transfer. There does not appear to be any precedent from the United States Court of Appeals
for the Third Circuit governing this issue. Other courts have held that “[w]hen presented with
competing motions to remand a case and to transfer venue, a court is to consider the remand motion
first, and then address the motion to transfer venue only if it first denies the motion to remand.”

Callen v. Callen, 827 F. Supp. 2d 214, 215 (S.D.N.Y. 2011). Because Emmett’s motion to remand
implicates the Court’s subject-matter jurisdiction, a threshold issue, the Court will first address
whether remand is appropriate.
A. Judicial Estoppel
Citrix removed this litigation from the Court of Common Pleas of Allegheny County under
28 U.S.C. § 1441 and the Class Action Fairness Act (“CAFA”), codified at 28 U.S.C. §§ 1332(d)
and 1453. (ECF No. 1, p. 1). Emmett is seeking to remand the litigation in part based on the
doctrine of judicial estoppel. (ECF No. 25-1). Specifically, Emmett points to Hasson v. Comcast
Cable Commc’ns, LLC, et. al., Case No. 2:23-cv-05039 (E.D. Pa.) (“the Hasson action”). The
Hasson action, which is comprised of over twenty related class action cases, involves the same

Defendants, identically situated plaintiffs, and “nearly identical allegations.” (Id. at 2, 8 n.3); (see
also id. (describing the Hasson action as “a nearly identical case”)). In Hasson, Comcast and
Citrix filed a motion to dismiss arguing that the court lacks jurisdiction over the action because the
plaintiffs do not have Article III standing. (Id. at 2). Emmett frames Citrix’s position in this
litigation and Hasson as inconsistent and irreconcilable. He contends that the doctrine of judicial
estoppel prevents Citrix from removing this litigation to federal court (and therefore contending
that the Court has jurisdiction over the matter), while contending in a nearly identical case that the
plaintiffs lack Article III standing.
The Court applies federal judicial estoppel law (regardless of the basis of jurisdiction)

because “[a] federal court’s ability to protect itself from manipulation by litigants should not vary
according to the law of the state in which the underlying dispute arose.” G-I Holdings, Inc. v.
Reliance Ins. Co., 586 F.3d 247, 261 (3d Cir. 2009). Judicial estoppel is a judge-made doctrine
that seeks to prevent a litigant from asserting a position inconsistent with one that he has previously
asserted in the same or in a previous proceeding. It is not intended to eliminate all inconsistencies,
however slight or inadvertent. It is designed to prevent litigants from “playing fast and loose with
the courts.” Scarano v. Central R. Co. of New Jersey, 203 F.2d 510, 513 (3d Cir. 1953) (internal
citations omitted). “The basic principle . . . is that absent any good explanation, a party should not
be allowed to gain an advantage by litigation on one theory, and then seek an inconsistent

advantage by pursuing an incompatible theory.” Ryan Operations G.P. v. Santiam-Midwest
Lumber Co., 81 F.3d 355, 358 (3d Cir. 1996). While there is no rigid test for judicial estoppel, the
Third Circuit has enumerated the following factors for courts to consider when determining
whether to apply the doctrine:
Judicial estoppel may be imposed only if: (1) the party to be estopped is asserting
a position that is irreconcilably inconsistent with one he or she asserted in a prior
proceeding; (2) the party changed his or her position in bad faith, i.e., in a culpable
manner threatening to the court’s authority or integrity; and (3) the use of judicial
estoppel is tailored to address the affront to the court’s authority or integrity.

Montrose Med. Grp. Participating Sav. Plan v. Bulger, 243 F.3d 773, 777-78 (3d Cir. 2001).
“A party has not displayed bad faith for judicial estoppel purposes if the initial claim was
never accepted or adopted by a court or agency.” Id. at 778 (holding that because earlier statements
in the same litigation were never accepted or adopted by the court, judicial estoppel was
inappropriate); G-I Holdings, 586 F.3d at 262 (“We do not consider [the judicial estoppel factors],
however, because, in our Circuit judicial estoppel is generally not appropriate where the defending

party did not convince the District Court to accept its earlier position.”). Nevertheless, it is not
impossible for judicial estoppel to apply when a court has not accepted the initial position at issue.
It should be applied to “neutralize threats to judicial integrity however they may arise.” Id. For
example, in the bankruptcy context, the Third Circuit has applied judicial estoppel, even though
no court relied on the debtor’s initial position, because the creditors almost certainly relied on the
position, weakening their bargaining position. Krystal Cadillac–Oldsmobile GMC Truck, Inc. v.
General Motors Corp., 337 F.3d 314, 324-25 (3d Cir. 2003); see also New Hampshire v. Maine,
532 U.S. 742, 750-51 (2001) (“[C]ourts regularly inquire whether the party has succeeded in
persuading a court to accept that party’s earlier position, so that judicial acceptance of an

inconsistent position in a later proceeding would create ‘the perception that either the first or the
second court was misled . . . .’ Absent success in a prior proceeding, a party’s later inconsistent
position introduces no ‘risk of inconsistent court determinations,’ and thus poses little threat to
judicial integrity.” (internal citations omitted)). An inconsistent argument sufficient to invoke
judicial estoppel must be attributable to intentional wrongdoing. See Chaveriat v. Williams Pipe
Line Co., 11 F.3d 1420, 1428 (7th Cir. 1993); see also Total Petroleum, Inc. v. Davis, 822 F.2d
734 (8th Cir. 1987) (holding that the doctrine only applies to deliberate inconsistencies that are
“tantamount to a knowing misrepresentation to or even fraud on the court.”).
Comcast and Citrix filed motions to dismiss in the Hasson action arguing that the district
court lacked jurisdiction over the action because the plaintiffs failed to establish Article III
standing, a prerequisite to jurisdiction. (2:23-cv-05039, ECF Nos. 158, 160). The district court
has not yet ruled on these pending motions. Oral argument on the motions is scheduled for
September 3, 2025. (2:23-cv-05039, ECF No. 201). Thus, to date, no federal court has accepted

Comcast and Citrix’s arguments that plaintiffs in Hasson lack Article III standing.
Even assuming that Citrix’s positions are inconsistent, the Court does not perceive threat
to judicial integrity. Further, the Court does not find that Citrix is acting in a manner that amounts
to a knowing misrepresentation or fraud on the Court.
Comcast, in opposing the remand to state court, highlights that its argument in the Hasson
action was formulated after its review of discovery requests and business records specific to the
plaintiffs in that litigation. (ECF No. 29, p. 3). None of these facts have been established with
regard to Emmett because, unlike in Hasson, discovery has not yet commenced. (Id. at 4).
Comcast correctly states that it cannot assume that the facts regarding Emmett will match those of

the plaintiffs in the Hasson action. (Id.).
In sum, because Citrix’s position in the Hasson action has not been accepted by any court,
and because that litigation is at a more advanced stage, the Court does not find that Citrix’s removal
of this action was done in bad faith, or that it presents an affront to the Court’s authority or integrity.
The Court holds that judicial estoppel does not apply to prevent Citrix from removing this action
from state court.2

2 The Court need not delve into an analysis of whether Citrix’s position in the Hasson action is
irreconcilably inconsistent with its position in this matter.
B. Subject-Matter Jurisdiction & Article III Standing
The next issue is whether removal of this litigation from state court was proper. Emmett
does not contend that there was a defect in the removal process. He argues that Citrix did not meet
its burden to show that he has Article III standing. (ECF No. 31, p. 6). The Court will focus on
whether Emmett has Article III standing, and therefore, whether Citrix established that the Court

has subject-matter jurisdiction over this action.3
Article III of the United States Constitution provides that federal courts may only exercise
jurisdiction over “Cases” and “Controversies.” U.S. CONST. art. III, § 2. The doctrine of standing
is “an essential and unchanging part of the case-or-controversy requirement of Article III.” Lujan
v. Defs. of Wildlife, 504 U.S. 555, 559 (1992). To establish standing, a part must have “(1) suffered
an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that
is likely to be redressed by a favorable judicial decision.” Id. at 560–61. “To establish injury in
fact, a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that
is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Lujan,

504 U.S. at 560. “A threatened injury must be ‘certainly impending’ to constitute injury in fact,”

3 The posture of this case is somewhat unusual as all parties appear to dance around their positions
in the Hasson action. For example, Emmett does not contend that he does not have Article III
standing. Instead, he argues that Defendants cannot meet their burden to establish that he does.
(ECF No. 25-1, p. 7). Likewise, Citrix does not argue that Emmett has Article III standing.
Instead, it acknowledges in its notice of removal that, “Although the Defendants have argued in
Hasson that those plaintiffs cannot meet the Article III standing requirements, Plaintiffs disagree
and maintain federal court jurisdiction is appropriate (consistent with their filing the Hasson action
originally in federal court).” (ECF No. 1, p. 4). No party briefed the standing issue or offers any
argument on what element of standing is lacking. Because courts have an independent obligation
to assess whether standing exists and “can dismiss a suit sua sponte for lack of subject [matter]
jurisdiction at any stage in the proceeding,” Zambelli Fireworks Mfg. Co., Inc. v. Wood, 592 F.3d
412, 420 (3d Cir. 2010), the Court will analyze whether Emmett has Article III standing despite
the parties’ lack of briefing on the issue.
and “[a]llegations of possible future injury” are insufficient. Whitmore v. Arkansas, 495 U.S. 149,
158 (1990). Standing may be demonstrated at the pleading stage based upon the complaint’s
factual allegations. Lujan, 504 U.S. at 561. In the context of a class action, the standing
requirement must be satisfied “by at least one named plaintiff.” McNair v. Synapse Grp. Inc., 672
F.3d 213, 223 (3d Cir. 2012); see also O’Shea v. Littleton, 414 U.S. 488, 494 (1974) (“[I]f none

of the named plaintiffs purporting to represent a class establishes the requisite of a case or
controversy with the defendants, none may seek relief on behalf of himself or any other member
of the class.”).
A specific line of standing case law has been developed in the data breach context. In
Reilly v. Ceridian Corporation, 664 F.3d 38 (3d Cir. 2011), the Third Circuit considered “whether
an alleged risk of future identity theft or fraud stemming from a data breach in which an unknown
hacker potentially accessed sensitive personal and financial information from a company’s
network was sufficiently imminent for purposes of standing.” Clemens v. ExecuPharm Inc., 48
F.4th 146, 153 (3d Cir. 2022) (citing Reilly, 664 F.3d at 38). “Because the plaintiffs in Reilly

alleged a future, hypothetical risk of identity theft or fraud, [the Third Circuit] concluded that they
had not suffered an injury-in-fact.” Id. (citing Reilly, 664 F.3d at 42). There, the future harm was
“dependent on entirely speculative, future actions of an unknown third-party.” Reilly, 664 F.3d at
42. The Third Circuit noted that it could not “describe how [the plaintiffs] will be injured in th[e]
case without beginning [its] explanation with the word ‘if’: if the hacker read, copied, and
understood the hacked information, and if the hacker attempts to use the information, and if he
does so successfully, only then will [the plaintiffs] have suffered an injury.” Id. at 43 (emphasis
in original). In Reilly, the Third Circuit considered that there was no evidence that the exfiltration
was intentional or malicious, that the plaintiffs had not alleged misuse, and that no identifiable
taking had occurred. Id. at 44.
Thereafter in Clemens v. ExecuPharm Inc., 48 F.4th 146, 153 (3d Cir. 2022), the Third
Circuit clarified that it did not create a “bright line rule” in Reilly precluding standing based on
identity theft or fraud. Clemens, 48 F.4th at 153. “Instead, Reilly requires consideration of whether

an injury is present versus future, and imminent versus hypothetical.” Id. In determining whether
an injury is imminent, the Third Court listed non-exhaustive factors courts should consider: (1)
whether the data breach was intentional; (2) whether the data was misused; and (3) whether the
nature of the information accessed through the data breach could subject a plaintiff to a risk of
identity theft (i.e., disclosure of social security numbers, birth dates, and names—though,
disclosure of financial information alone, without corresponding personal information, is
insufficient). Id. at 154. No single factor is dispositive. Id. In determining whether the injury is
concrete—that is, “real, and not abstract”—“where the asserted theory of injury is a substantial
risk of identity theft or fraud, a plaintiff suing for damages can satisfy concreteness as long as he

alleges that the exposure to that substantial risk caused additional, currently felt concrete harms.”
Id. at 155–56.
Applying these principles in Clemens, the Third Circuit concluded that the plaintiff alleged
a future injury that was sufficiently imminent because (1) the breach was conducted by a known
hacking group, which intentionally stole the information, held it for ransom, and published it on
the dark web, making it accessible to criminals worldwide; and (2) the nature of the information—
a combination of personal and financial information—was the type of data that could be used to
perpetrate identity theft or fraud. Id. at 159. Moreover, because intangible harms like the
publication of personal information can qualify as concrete, the risk of identity theft or fraud in
Clemens constituted an injury-in-fact. Id. Since Clemens, courts within the Third Circuit have
analyzed standing in data breach cases using the three-factor test outlined in that case. See, e.g.,
Alonzo v. Refresco Beverages US, Inc., 2024 WL 4349592, at *5 (D.N.J. Sept. 30, 2024); In re
Samsung Data Sec. Breach Litig., 761 F. Supp. 3d 781, 793-800 (D.N.J. 2025).
1. Whether the Data Breach was Intentional

Based on the factual allegations in the complaint, the Court first considers whether the
breach was intentional. “[A]ll cyber-attacks involve some degree of intentional conduct just by
the very nature of the attack.” McGowan v. CORE Cashless, LLC, 2023 WL 8600561, at *9 (W.D.
Pa. Oct. 17, 2023), report and recommendation adopted, 2024 WL 488318 (W.D. Pa. Feb. 8,
2024). Here, Emmett alleges that Comcast and Citrix failed to properly secure and safeguard the
personal identifying information of approximately 36 million Comcast customers. (ECF No. 1-1,
¶ 3). He alleges that unknown third-party cybercriminals exploited a vulnerability known in the
cybersecurity community as “Citrix Bleed” which allowed the actors to gain unauthorized access
to sensitive data contained on Comcast’s internal systems. (ECF No. 1-1, ¶ 126). The complaint

is silent as to the identity of the third-party cybercriminals.
As stated by the Court in McGowan:
At one end of the “intentionality” spectrum is the situation in Reilly where it was
unknown whether the hacker read, copied or understood the data. At the other end
of the “intentionality” spectrum is the situation in Clemens where a known hacking
group accessed the defendant’s servers through a phishing attack, installed malware
to encrypt the data stored on the defendant’s servers, and then held the decryption
tools for ransom, threatened to release the information to the Dark Web if the
ransom was not paid and did indeed carry out their threat.

McGowan, 2023 WL 8600561 at *9. The Court holds that, like in McGowan, this case is more
akin to Reilly than Clemens. Emmett does not allege any facts indicating that the cybercriminals
in the data breach at issue had the same type of malicious and sophisticated intent that existed in
Clemens. See Clemens, 761 F. Supp. at 157 (holding that the first factor, whether the breach was
intentional, weighed in favor of the plaintiffs establishing standing when the plaintiffs alleged that
“CLOP,” “a sophisticated ransomware group,” accessed the plaintiff’s data, held it for ransom,
and then published it on the dark web”). The complaint does not plead any other facts supporting
a finding that the breach had a high degree of intentionality or sophistication. This factor weighs

against finding that Emmett has suffered an injury in fact sufficient to confer Article III standing.
2. Whether the Data was Misused
With regard to the second factor, whether the data at issue was misused, Emmett alleges
that
Plaintiff’s and Class Members’ PII from the Data Breach is already circulating on
the “dark web. . . .” Additionally, multiple sets of Comcast/Xfinity data were
uploaded to a Torrent site called “Fox Store” where cybercriminals sell and
purchase stolen PII. This data was uploaded on October 16, 2023, and October 23,
2023—the first day and one week after the Data Breach. Comcast/Xfinity data
affiliated with Plaintiff and Class Members were also uploaded to BlackBet in July
and September 2024.

(ECF No. 1-1, ¶ 179); (see also id. ¶ 196 (“The harm faced by Plaintiff and Class Members is
substantial and imminent, as unauthorized cybercriminals now have possession of their
information, available for their use however and whenever they see fit, including posting or selling
that information on the dark web.”); id. ¶ 16 (“Upon information and belief, Plaintiff’s PII has
already been stolen and misused.”)). Emmett’s allegations are somewhat undermined by other
paragraphs of the complaint. For instance, Emmett alleged: “On information and belief, Plaintiff’s
name, date of birth, last four digits of Social Security number, phone number, address, email
address, Comcast username(s) and password(s), and/or Comcast security questions and answers
were potentially compromised in the Data Breach.” (Id. ¶ 11 (emphasis added)). Emmett
acknowledges that Comcast failed to disclose how many consumers’ PII was breached “leaving
customers to speculate whether it was likely that their own PII” had been compromised. (Id. ¶
146). It is unclear how Emmett can assert that cybercriminals have possession of his PII and that
his sensitive data is circulating on the “dark web” when he simply asserts that his personally
identifying information was “potentially compromised” in the October 2023 Data Breach.
The Court finds that Emmett has failed to allege sufficient facts to plausibly show that his

PII was misused by unknown cybercriminals. Emmett does not definitely assert that his
information was compromised in the Data Breach. Stating that his information was “potentially
compromised” implies that he is speculating as to whether his information was even involved in
the Data Breach. Emmett asks the Court to find that his information was misused because it was
potentially compromised in the Data Breach and thus potentially may be circulating on the dark
web. See Tignor v. Dollar Energy Fund, Inc., 745 F. Supp. 3d 189, 201 (W.D. Pa. 2024) (“[The
plaintiff] is not certain that the hackers behind the Data Breach even accessed her [personal
identifying information]. [The plaintiff’s] allegations are more akin to the facts presented in Reilly
where the Third Circuit held that a plaintiff did not have standing if hackers potentially gained

access to their sensitive information. Without sufficient allegations of misuse, the Court cannot
find her alleged injury to be imminent.” (internal citations omitted) (emphasis in original)). While
Emmett alleges that “multiple sets of Comcast/Xfinity data” was uploaded to “Fox Store” and
“BlackBet,” Emmett does not allege that his PII was involved in either of these uploads. (ECF
No. 1-1, ¶ 179).
Unlike in Clemens, Emmett has not alleged any attempted identity theft or fraud using any
of his PII from which he could assert a heightened risk that he might experience identity theft or
fraud in the future. See also Hood v. Educ. Computer Sys., Inc., 2025 WL 1284737, at *5 (W.D.
Pa. May 2, 2025) (holding that the plaintiff’s data was misused when the plaintiffs alleged that
unauthorized tax returns were filed in their names and unauthorized credit inquiries and attempts
to open new accounts were made using their PII); Tignor, 745 F. Supp. at 200-01 (holding that one
of the plaintiff’s suffered an actual injury when two alleged fraudulent credit card applications
were submitted in her name). Emmett’s allegations are hypothetical and focused on events that
may occur in the future. (ECF No. 1-1, ¶ 185 (“Plaintiffs and Class Members who were Xfinity

Mobile or NOW Mobile customers specifically also face an imminent risk of falling victim to
‘SIM-swap’ fraud.”)); (id. ¶ 186 (stating that Emmett and proposed class members “face a
substantial and imminent risk of ‘port-out’ fraud discussed previously, whereby cybercriminals
hijack a victim’s phone number using the victim’s name, address, birth date, passwords, and the
last four digits of his or her Social Security number”)); (id. ¶ 190 (“Plaintiff and Class Members
are particularly at risk of additional data breaches because part of the PII stolen in the Data Breach
involved their usernames and passwords, which makes it far more likely that Plaintiff and Class
Members will be victims of a future ‘credential stuffing’ attack.”)). Emmett alleges that “malicious
actors often wait months or years to use the [personal identifying information] obtained in data

breaches.” (Id. ¶ 188). This may very well be so. Nonetheless, the Court cannot find that
Emmett’s data was misused based off an unrealized prospect of future fraud or identity theft. See
Reilly, 664 F.3d at 41 (““[A]llegations of hypothetical, future injury do not establish standing under
Article III.”). Courts have found that data breach plaintiffs lacked standing under similar
circumstances. See In re Am. Fin. Res., Inc. Data Breach Litig., 2023 WL 3963804, at *5 (D.N.J.
Mar. 29, 2023) (finding that a plaintiff alleging a “criminal” hack by unknown individuals that
could not “meaningfully allege that the information accessed in the breach was mass-published
onto the dark web, or otherwise disseminated” lacked standing). Further, the alleged “deep
psychological impact,” (ECF No. 1-1, ¶ 192) that data breaches have on their victims does not
constitute misuse of data. This factor weighs against finding that Emmett has suffered an injury
in fact sufficient to confer Article III standing.
3. The Type of Data Implicated in the Breach
Finally, the type of information implicated in a data breach may affect whether a plaintiff
has standing. Clemens, 48 F.4th at 154. In particular, the “disclosure of social security numbers,

birth dates, and names is more likely to create a risk of identity theft or fraud.” Id. However, even
in cases involving disclosure of highly sensitive information, standing is not automatic. See
McMorris v. Carlos Lopez & Assocs., LLC, 995 F.3d 295, 304 (2d Cir. 2021) (“[W]hile the
information that was inadvertently disclosed by [the defendant] included the sort of PII that might
put [p]laintiffs at a substantial risk of identity theft or fraud, in the absence of any other facts
suggesting that the PII was intentionally taken by an unauthorized third party or otherwise misused,
this factor alone does not establish an injury in fact.”). Emmett alleges that the highly valuable
PII of approximately 36 million Comcast customers was compromised, including customers’
usernames and hashed passwords, names, contact information, full and partial social security

numbers, driver’s license numbers, dates of birth, secret security questions and answers, and other
personal data. (ECF No. 1-1, ¶ 3). See Clemens, 48 F.4th at 150 (holding that the third factor
weighed in favor of finding standing where the stolen information included “social security
numbers, dates of birth, full names, home addresses, taxpayer identification numbers, banking
information, credit card numbers, driver’s license numbers, sensitive tax forms, and passport
numbers”). The Court finds that, due to the sensitive nature of the potentially impacted data,
particularly social security numbers, names, and dates of birth, this factor cuts in favor of a finding
that Emmett has alleged an injury in fact. See id. at 157 (finding that the “combination of financial
and personal information is particularly concerning as it could be used to perpetrate both identity
theft and fraud.”).
4. Weighing of the three Clemens factors
Having considered the factors set forth above, the Court concludes that Citrix, as the
removing party, has not met its burden of establishing that Emmett has the standing required for

the Court’s subject-matter jurisdiction. On balance, Emmett’s allegations are more consistent with
those in Reilly than in Clemens. Even accepting all of his well-pled allegations as true, Emmett
has only pled that he will suffer future injuries, which is not necessarily fatal to his claim but
requires him to plead that his “injury is certainly impending, or there is a substantial risk that the
harm will occur.” See Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158 (2014) (internal
quotation marks omitted); Rauhala v. Greater New York Mut. Ins., Inc., 2022 WL 16553382, at
*3 (E.D. Pa. Oct. 31, 2022) (“Although an injury that will occur in the future is not fatal to standing,
the risk of injury cannot be hypothetical or speculative.” (internal citations omitted)). Emmett has
not done so.

Further, the Court holds that Emmett’s alleged time and money expenditures to monitor
his financial information does not establish standing because costs incurred to prevent or monitor
a speculative chain of future events based on hypothetical criminal acts are no more “actual”
injuries than the alleged “increased risk of injury” which form the basis of Emmett’s claims. See
Randolph v. ING Life Ins. & Annuity Co., 486 F.Supp.2d 1, 8 (D.D.C. 2007) (“[T]he ‘lost data’
cases . . . clearly reject the theory that a plaintiff is entitled to reimbursement for credit monitoring
services or for time and money spent monitoring his or her credit.”). That Emmett willingly
incurred costs to protect against an alleged increased risk of identity theft is not enough to
demonstrate a “concrete and particularized” or “actual or imminent” injury. Id.; see also See
Amburgy v. Express Scripts, Inc., 671 F. Supp. 2d 1046, 1053 (E.D. Mo. 2009) (holding that the
plaintiff lacked standing even though he allegedly spent time and money to protect himself from
risk of future injury); Hammond v. Bank of N.Y. Mellon Corp., 2010 WL 2643307, at *4, *7
(S.D.N.Y. June 25, 2010) (noting that the plaintiffs’ “out-of-pocket expenses incurred to
proactively safeguard and/or repair their credit” and the “expense of comprehensive credit

monitoring” did not confer standing); Allison v. Aetna, Inc., 2010 WL 3719243, at *5 n.7 (E.D.
Pa. Mar. 9, 2010) (rejecting claims for time and money spent on credit monitoring due to a
perceived risk of harm as the basis for an injury in fact).
In sum, the bulk of Emmett’s alleged injuries are hypothetical and concern only the
possibility that he may suffer adverse consequences in the future. (See ECF No. 1-1 ¶¶ 85,185-
86, 188, 190, 198). Emmett’s claims rely on the same speculative chain of events that the Third
Circuit rejected in Reilly: “if the hacker read, copied, and understood the hacked information, and
if the hacker attempts to use the information, and if he does so successfully, only then will
[plaintiff] have suffered an injury.” Reilly, 664 F.3d at 43 (emphasis in original). Emmett’s

allegations do not establish that he has suffered an “actual or imminent” injury because he has not
connected his forward-looking concerns to an imminent injury. Courts in this circuit have
routinely held that the plaintiffs do not have standing in cases factually analogous to the instant
case. See, e.g., Reilly, 664 F.3d 38; In re Retreat Behav. Health LLC, 2024 WL 1016368 (E.D.
Pa. Mar. 7, 2024); In re Am. Fin. Res., Inc. Data Breach Litig., 2023 WL 3963804 (D.N.J. Mar.
29, 2023); McGowan, 2023 WL 8600561.
Since the Court finds that Emmett’s claims involve future harms that are merely
hypothetical, it finds that Emmett did not allege that he suffered an injury in fact. Thus, he does
not have Article III standing, and the Court does not have subject-matter jurisdiction over this
action.4 Citrix failed to meet its burden to establish that removal from state court was proper. The
Court will remand Emmett’s complaint to the Court of Common Pleas of Allegheny County.
Defendants Comcast Cable Communications, LLC and Comcast Corporation’s Motion to Transfer
Venue will be denied as moot.
IV. CONCLUSION

For the foregoing reasons, the Court will grant Plaintiff’s Motion to Remand or, in the
Alternative, Motion for a More Definite Statement (ECF No. 25). The Court will deny Comcast’s
Motion to Transfer Venue (ECF No. 22). An Order of Court will follow.
BY THE COURT:

s/ William S. Stickman IV
WILLIAM S. STICKMAN IV
UNITED STATES DISTRICT JUDGE

July 11, 2025
Dated

4 The Court will not address whether the other standing requirements are met (whether the
purported injury was fairly traceable to Defendants’ conduct and whether the injury would be
redressable by a favorable judicial decision) because of its finding that no injury in fact exists.

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/cases/11098687. Public record. Not legal advice.