Opinion

IN THE UNITED STATES DISTRICT COURT February 04, 2026

FOR THE SOUTHERN DISTRICT OF TEXAS Nathan Ochsner, Clerk

HOUSTON DIVISION

§

§

§

IN RE NEW ERA ENTERPRISES INC. § CIVIL ACTION NO. H-25-732

DATA INCIDENT LITIGATION, §

§

§

§

MEMORANDUM AND OPINION

This case is about an alleged breach of confidential health information from several related

insurance companies. The plaintiffs’ complaint, filed on behalf of a putative class, alleges

negligence, negligence per se, breach of an implied contract, and unjust enrichment. The

defendants have moved to dismiss. (Docket Entry No. 41). Based on the complaint, the motion,

the briefs, and the applicable law—and with the benefit of oral argument by able counsel for all

parties—the motion to dismiss is granted in part and denied in part. The rulings and reasons are

set out below.

I. Background

New Era Enterprises, Inc. is a life insurance company that operates New Era Life Insurance

Company, New Era Life Insurance Company of the Midwest, Philadelphia American Life

Insurance Company, and Life of America Insurance Company. (Docket Entry No. 27 ¶ 2). New

Era collects and maintains personally identifiable information and protected health information.

(Id. ¶¶ 3–5). The named plaintiffs, Maria Sanchez, Ernest Williams, Ebony White, Steven Stapp,

and Timothy Kirker, allege that they are current and former customers or employees of New Era:

Sanchez, Williams, White, and Stapp allege that they are current and former customers, (id. ¶¶

152, 162, 176, 190), and Kirker alleges that he was a former employee, (id. ¶ 204).

Between December 9 and 18, 2024, New Era became aware that an unauthorized third

party had accessed certain parts of its information technology network. (Id. ¶ 34). The

unauthorized third party copied files from New Era’s network. (Id.). In February 2025, New Era

sent written notices to the plaintiffs explaining that their information may have been involved in

this data incident. (Id.). The copied files included some combination of names, Social Security

numbers, addresses, dates of birth, health insurance policy numbers, Medicare identification

numbers, and data related to medical treatments and diagnoses. (Id. ¶ 5).

The plaintiffs allege that, as a result of this breach, cybercriminals obtained everything

needed to commit identity theft and wreak havoc on their financial and personal lives. (Id. ¶¶ 13–

15, 64). They allege that that their personal information has already been misused: it has been

posted to the dark web; cybercriminals have attempted to access their financial accounts; and they

have experienced an increase in spam calls and texts. (Id. ¶¶ 170, 184, 198, 212). They allege that

they have been forced to take steps to mitigate the harms of identity theft, have experienced

emotional distress and diminution in the value of their private information, and remain at

substantial risk of future harm. (Id. ¶¶ 152–217).

On February 19, 2025, the plaintiffs sued New Era. (Docket Entry No. 1). They assert

claims of (i) negligence, (ii) negligence per se, (iii) breach of implied contract, and (iv) unjust

enrichment, and seek certification of a nationwide class. (Id. ¶¶ 234–317).

II. The Legal Standards

A. Standing

Article III of the Constitution limits federal courts to deciding “Cases” and

“Controversies.” U.S. CONST. art. III, § 2. This standing limit and requirement “defines with

2

respect to the Judicial Branch the idea of separation of powers on which the Federal Government

is founded.” Allen v. Wright, 468 U.S. 737, 750 (1984).

To establish standing, a plaintiff must meet the “irreducible constitutional minimum” of

Article III, which requires that the plaintiff’s injury be: (1) concrete, particularized, and actual or

imminent; (2) fairly traceable to the defendant’s challenged action; and (3) likely redressable by a

favorable ruling. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992). The party asserting

federal jurisdiction bears the burden of demonstrating standing. See TransUnion LLC v. Ramirez,

594 U.S. 413, 430–31 (2021). When courts assess standing, they “assum[e] that on the merits the

plaintiffs would be successful in their claims.” Polelle v. Fla. Sec’y of State, 131 F.4th 1201, 1211

(11th Cir.) (quoting Culverhouse v. Paulson & Co., 813 F.3d 991, 994 (11th Cir. 2016)), cert.

denied, 146 S. Ct. 298 (2025)

The “concreteness” requirement ensures that the alleged injury is “‘real,’ and not

‘abstract,’” so that the plaintiff has a real stake in the litigation. Spokeo, Inc. v. Robins, 578 U.S.

330, 340 (2016). Injuries are concrete if they have “a close relationship to harms traditionally

recognized as providing a basis for lawsuits in American courts.” TransUnion, 594 U.S. at 425.

“Those include, for example, reputational harms, disclosure of private information, and intrusion

upon seclusion.” Id.

B. Rule 12(b)(6)

Rule 12(b)(6) allows dismissal if a plaintiff fails “to state a claim upon which relief can be

granted.” FED. R. CIV. P. 12(b)(6). Rule 12(b)(6) must be read in conjunction with Rule 8(a),

which requires “a short and plain statement of the claim showing that the pleader is entitled to

relief.” FED. R. CIV. P. 8(a)(2). “[A] complaint must contain sufficient factual matter, accepted as

3

true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678,

(2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)).

Rule 8 “does not require ‘detailed factual allegations,’ but it demands more than an

unadorned, the-defendant-unlawfully-harmed-me accusation.” Id. (quoting Twombly, 550 U.S. at

555). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court

to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. “The

plausibility standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer

possibility that a defendant has acted unlawfully.” Id. (quoting Twombly, 550 U.S. at 556).

“Conversely, when the allegations in a complaint, however true, could not raise a claim of

entitlement to relief, this basic deficiency should be exposed at the point of minimum expenditure

of time and money by the parties and the court.” Eli Lilly & Co. v. Revive Rx, LLC, ___ F. Supp.

3d ___, 2025 WL 3640703, at *5 (S.D. Tex. Dec. 15, 2025) (quoting Cuvillier v. Taylor, 503 F.3d

397, 401 (5th Cir. 2007)).

III. Analysis

New Era moves to dismiss the complaint (1) because the plaintiffs do not have standing to

sue; and (2) because it fails to state a claim. The plaintiffs have standing, but several of their

claims must be dismissed: their request for damages based on emotional harm; their claim of

negligence per se; and their implied-contract claim.

A. Standing

Throughout the complaint, the plaintiffs assert that they will suffer: (i) invasion of privacy;

(ii) theft of their private information; (iii) lost or diminished value of private information; (iv) lost

time and opportunity costs associated with mitigating the consequences of the data breach; (v) loss

of benefit of their bargain with the insurance companies; (vi) lost opportunity costs associated with

4

attempts to mitigate the consequences of the data breach; (vii) nominal damages; and (viii) the

continued and certainly increased risk to their private information that: (a) remains unencrypted

and available for unauthorized third parties to access and abuse; and (b) remains backed up in New

Era’s possession and is subject to further unauthorized disclosures so long as New Era fails to

undertake appropriate and adequate measures to protect the private information. (Docket Entry

No. 27 ¶¶ 7, 116, 157, 265, 278, 302, 315). New Era contends that these injuries are not sufficient

to establish standing.

1. Substantial Risk of Future Harm

The main question presented in New Era’s motion to dismiss is whether the alleged harms

are sufficiently concrete and imminent. A plaintiff does not need to allege a past injury to establish

standing. But to prove standing based on a threat of future harm, plaintiffs must show that the

harm is “certainly impending” or that there is a “substantial risk” of the harm. Clapper v. Amnesty

Int’l USA, 568 U.S. 398, 414 & n.5 (2013). If a “risk” of these harms “hasn’t materialized, the

plaintiff hasn’t yet been injured.” Perez v. McCreary, Veselka, Bragg & Allen, P.C., 45 F.4th 816,

824 (5th Cir. 2022). Courts apply a three-factor test to determine whether a data breach is

sufficiently likely to harm plaintiffs to allow federal courts to adjudicate the case: (1) the data at

issue was compromised as the result of a targeted attack intended to obtain the plaintiffs’ data; (2)

at least some part of the compromised dataset has been misused, even if some plaintiffs’ particular

data has not yet been affected; and (3) the data at issue is more or less likely to subject plaintiffs

to a perpetual risk of identity theft or fraud once it has been exposed. See, e.g., McMorris v. Carlos

Lopez & Assocs., LLC, 995 F.3d 295, 303–05 (2d Cir. 2021); Clemens v. ExecuPharm Inc., 48

F.4th 146, 153–54, 157 (3d Cir. 2022); Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365,

375 (1st Cir. 2023).

5

These factors are important because a plaintiff cannot manufacture standing based on a

data breach without proving a risk of harm. See Clapper, 568 U.S. at 422 (a plaintiff cannot

“manufacture standing by incurring costs in anticipation of non-imminent harm”). In data-breach

cases, the courts of appeals have uniformly agreed that a plaintiff may not recover damages for

“money and time” unless they were spent “to correct an error that itself caused a concrete harm.”

Nelson v. Experian Info. Sols. Inc., 144 F.4th 1350, 1355 (11th Cir. 2025) (emphasis omitted); see,

e.g., Webb, 72 F.4th at 377; McMorris, 995 F.3d at 303; Clemens, 48 F.4th at 155–56; Hutton v.

Nat’l Bd. of Examiners in Optometry, Inc., 892 F.3d 613, 622 (4th Cir. 2018); Galaria v.

Nationwide Mut. Ins. Co., 663 F. App’x 384, 389 (6th Cir. 2016); Lewert v. P.F. Chang’s China

Bistro, Inc., 819 F.3d 963, 966 (7th Cir. 2016); In re U.S. Off. of Pers. Mgmt. Data Sec. Breach

Litig., 928 F.3d 42, 59 (D.C. Cir. 2019). A plaintiff’s response to a data breach is considered an

“additional harm[]” to the risk of concrete harm that itself satisfies standing. Nelson, 144 F.4th at

1355.

As discussed, the plaintiffs have alleged several theories of harm. In this case, a review of

each is not necessary. The plaintiffs can establish standing based on their primary theory of

injury—that there is a substantial risk of future harm. The plaintiffs have adequately alleged all

three McMorris factors.

First, there was “a targeted attack intended to obtain the plaintiffs’ data.” McMorris, 995

F.3d at 301. The notice letter that the plaintiffs received stated that “an authorized person

accessed” New Era’s “IT network . . . and . . . copied some” files containing personal information.

(Docket Entry No. 27 ¶ 34). The letter stated that someone hacked into New Era’s files to steal

the plaintiffs’ data. This intentional act by a malicious hacker suggests a high chance of misuse.

6

Second, “at least some part of the compromised dataset has been misused.” McMorris,

995 F.3d at 301; see OPM, 928 F.3d at 58 (“[A] hacker’s ‘intent’ to use breach victims’ personal

data for identity theft becomes markedly less important where, as here, several victims allege that

they have already suffered identity theft and fraud as a result of the breaches.”). White, Stapp, and

Kirker allege that they received notifications that their private information was posted to the dark

web following the data breach. (Docket Entry No. 27 ¶¶ 184, 198, 212). “That allegation is

critical.” Green-Cooper v. Brinker Int’l, Inc., 73 F.4th 883, 889 (11th Cir. 2023). “The fact that

hackers took [sensitive] data and corresponding personal information from . . . and affirmatively

posted that information for sale on . . . is the misuse” that is needed “for standing purposes . . . .”

Id. at 889–90. It “establishes both a present injury—[sensitive] data and personal information

floating around on the dark web—and a substantial risk of future injury—future misuse of personal

information associated with the hacked [data].” Id. at 890; accord McMorris, 995 F.3d at 302

(explaining that “allegations that the plaintiffs’ PII was available for sale on the Dark Web . . .

provided strong support . . . an Article III injury in fact”).

Third, because the data that New Era maintained included sensitive health and personal

identifying information, there is likely “a perpetual risk of identity theft or fraud once it has been

exposed.” McMorris, 995 F.3d at 302. “Naturally, the dissemination of high-risk information

such as Social Security numbers and dates of birth—especially when accompanied by victims’

names—makes it more likely that those victims will be subject to future identity theft or fraud.”

Id. (citing Attias v. CareFirst, Inc., 865 F.3d 620, 628 (D.C. Cir. 2017)); see In re Equifax Inc.

Customer Data Sec. Breach Litig., 999 F.3d 1247, 1262 (11th Cir. 2021) (“Given the . . . data

stolen, including Social Security numbers, names, and dates of birth, and the unequivocal damage

that can be done with this type of data, we have no hesitation in holding that Plaintiffs adequately

7

alleged that they face a ‘material’ and ‘substantial’ risk of identity theft . . . .”); OPM, 928 F.3d at

60 (even if a breach does not expose every piece of information necessary for immediate financial

fraud, the stolen data itself is sufficient to enable identity theft).

New Era concedes that the McMorris factors are a reformulation of the Clapper standard

for standing. (Docket Entry No. 45 at 3–4). New Era argues that the plaintiffs cannot establish

standing based on their belief that some of their information was sold or posted on the dark web.

(Id. at 3–5). But, at this stage in the litigation, courts must assume that the facts alleged to support

standing are true. Lujan, 504 U.S. at 561. The plaintiffs have plausibly alleged that their specific

information has been misused. Cf. Williams v. Bienville Orthopedic Specialists, LLC, 737 F. Supp.

3d 411, 421 (S.D. Miss. 2024). The complaint alleges, for instance, that “White has received

notice from her Smart Credit monitoring service that her information has been posted to the dark

web.” (Docket Entry No. 27 ¶ 184). This is the allegation that the Eleventh Circuit found sufficient

for standing in Green-Cooper. See 73 F.4th at 889–90.

New Era argues that the plaintiffs cannot establish standing because they have not shown

that the information posted on the dark web was the same information stolen in the data breach.

(Docket Entry No. 41 at 8). New Era relies primarily on a case in which the plaintiff gave “no

timeline of how soon after the breach he started to experience fraudulent activity.” Hemphill v.

Horne, LLP, No. 3:24-CV-178-KHJ-ASH, 2025 WL 837007, at *8 (S.D. Miss. Mar. 10, 2025).

But here, the plaintiffs allege that they are careful about sharing their private information; do not

knowingly transmit it online over unsecured and unencrypted channels; and, at least for White,

Stapp, and Kirker, that they received a message that their data was posted on the dark web shortly

after the New Era data breach. (Docket Entry No. 27 ¶¶ 153–55, 176–88, 190–200, 212). This

temporal proximity is sufficient to create a reasonable inference of traceability. See Hulse v.

8

Acadian Ambulance Serv. Inc., No. 6:24-CV-01011, 2025 WL 1453847, at *10 (W.D. La. May

19, 2025); see also Green-Cooper, 73 F.4th at 890–91 (concluding that proof that the plaintiffs

dined at a Chili’s during the at-risk period was sufficient to establish traceability).

New Era relies on one case in which a court broadly questioned whether even a close

temporal proximity is sufficient to establish traceability because there are many places from which

a plaintiff’s data could be stolen. See, e.g., Williams v. Bienville Orthopaedic Specialists, LLC,

737 F. Supp. 3d 411, 424–25 (S.D. Miss. 2024). This court respectfully disagrees with the opinion

in Williams, which imposes too high a bar on a motion to dismiss. See Hulse, 2025 WL 1453847,

at *10 (disagreeing with the Williams traceability analysis). The plaintiffs have alleged that they

are careful with their data and do not needlessly expose it online. At this stage, the court must

draw the reasonable inference that the data incident, not some other hack, is the reason their

personal data was shortly thereafter available on the dark web; the plaintiffs do not need to

anticipate and negate other potential causes of their injuries at the outset of litigation. See Texas

v. Mayorkas, No. 2:22-CV-094-Z, 2024 WL 455337, at *3 (N.D. Tex. Feb. 6, 2024) (“Plaintiff, at

this stage, is under no obligation to prove its injury actualized or to define and eliminate all possible

factors contributing to it.”).

The complaint adequately alleges each of the McMorris factors and a substantial risk of

injury for the plaintiffs. See Webb, 72 F.4th at 376 (the allegation that “at least some information

stolen in a data breach has already been misused also makes it likely that other portions of the

stolen data will be similarly misused”); McMorris, 995 F.3d at 301 (“[C]ourts have been more

likely to conclude that plaintiffs have established a substantial risk of future injury where they can

show that at least some part of the compromised dataset has been misused—even if plaintiffs’

particular data subject to the same disclosure incident has not yet been affected.”). New Era may

9

again raise standing issues as the record develops, including as to specific injuries for which the

plaintiffs seek redress. See Lujan, 504 U.S. at 561.1

2. Loss of Privacy

New Era argues that the plaintiffs’ alleged injury for loss of privacy is not concrete.

(Docket Entry No. 41 at 9; Docket Entry No. 45 at 10–11). New Era argues that plaintiffs cannot

allege a privacy harm without factual allegations of dissemination and intentional conduct on New

Era’s part.

New Era is correct that one cannot allege a privacy-related harm without showing

dissemination. In TransUnion, the Court held that some plaintiffs had standing because incorrect

information in their credit file was disseminated to third parties, but that other plaintiffs did not

have standing because TransUnion never sent the false credit file to anyone else. 594 U.S. at 417–

18. But here, the plaintiffs allege that their information was disseminated when the hackers stole

it and posted it to the dark web. (Docket Entry No. 27 ¶¶ 41, 167, 184, 198, 212). Courts have

held that this kind of alleged dissemination or public disclosure of private facts is sufficiently

analogous to common-law injuries to support standing. See Bohnak v. Marsh & McLennan

Companies, Inc., 79 F.4th 276, 285 (2d Cir. 2023) (“[T]he core injury here—exposure of Bohnak’s

private PII to unauthorized third parties—bears some relationship to a well-established common-

law analog: public disclosure of private facts.”). Whether the plaintiffs can establish substantial

1 New Era argues that many of the specific damages that the plaintiffs alleged are insufficient to confer

standing. (Docket Entry No. 41 at 7–14). For the most part, these arguments are a subset of the argument

that the plaintiffs did not adequately allege a substantial risk of future harm. Because the plaintiffs have

alleged standing based on a risk of future harm, the court does not need to address in detail some of the

remaining standing arguments that New Era raises. See Cabezas v. Mr. Cooper Grp. Inc., No. 3:23-CV-

2453-N, 2025 WL 2053287, at *7 (N.D. Tex. July 22, 2025) (concluding that “where courts have already

established a risk of future harm, emotional distress and mitigation costs, when coupled with the risk of

harm is a concrete injury sufficient to confer standing” (cleaned up)); Bruno v. Donohoe, 754 F. Supp. 3d

737, 748 (W.D. Tex. 2024) (similar).

10

damages based on this theory of injury is immaterial at this stage. When a concrete interest is

allegedly violated (here, the privacy of personal information), plaintiffs can establish standing

because nominal damages are traditionally appropriate relief. See Uzuegbunam v. Preczewski, 592

U.S. 279, 292–93 (2021) (“[N]ominal damages provide the necessary redress for a completed

violation of a legal right.”). Whether the plaintiffs can prove a tort and recover even nominal

damages for this asserted injury is a merits question under state law that cannot be resolved at this

stage of the litigation.

New Era’s argument that it did not intentionally disclose the plaintiffs’ private information

does not affect the plaintiffs’ standing. A “scienter element does not affect the concreteness of [a

plaintiff’s] injury because it is not ‘essential to the harm’ in the relevant common-law comparator.”

Polelle, 131 F.4th at 1210 n.6 (citation omitted). “Instead, mens rea presents a question of a

defendant’s ‘culpability’ and ‘blameworth[iness].’ Id. (alterations in original) (quoting Morissette

v. United States, 342 U.S. 246, 252 (1952)). In some cases, a “defendant’s mental state may relate

to the degree of injury or causation; some courts have concluded intentional conduct is more likely

to cause a more severe injury than would result in the case of an accident or negligence.” Id.

(citing Raybon v. United States, 867 F.3d 625, 632 (6th Cir. 2017)). “But a defendant’s mental

state does not change the kind of injury a defendant inflicts upon a plaintiff.” Id. The Fifth Circuit

has focused on the kind of injury, not the degree of injury, in determining whether a harm is

sufficiently concrete. See Perez, 45 F.4th at 822. If a defendant exposed or disseminated a

plaintiff’s private information, the plaintiff suffers the same harm whether the defendant did so

“intentionally, unintentionally, in good-faith, or in bad-faith.” Polelle, 131 F.4th at 1210 n.6.

Based on the present record, the plaintiffs have standing to assert privacy-based injuries.

3. Spam Calls and Text Messages

11

Williams, White, and Stapp allege that they have experienced an increase in spam phone

calls and emails since the data breach and have lost time and productivity by screening those spam

calls and emails. (Docket Entry No. 27 ¶¶ 170–71, 184–85, 198–99). New Era argues that these

spam calls and text messages are not fairly traceable to the data breach because the plaintiffs’

contact information was not part of the breach. (Docket Entry No. 41 at 12). The plaintiffs respond

that the data breach enabled cybercriminals to spam them by using “Fullz” packages to link stolen

information to the plaintiffs’ phone numbers, email addresses, and other personal identifiers.

(Docket Entry No. 27 ¶ 126).

Some courts have relied on allegations of “Fullz” packages to find that plaintiffs’ alleged

increase in spam texts after a data breach are traceable to that breach. See Fox v. Iowa Health Sys.,

399 F. Supp. 3d 780, 792 (W.D. Wis. 2019) (concluding that the “allegations plausibly explain[ed]

why, for example, Fox started getting phone calls related to medical scams after the data breach”).

Others have found sufficient allegations of a sudden, rapid uptick in spam calls after plaintiffs’

contact information was leaked. See, e.g., Baldwin v. Nat’l W. Life Ins. Co., No. 2:21-CV-04066-

WJE, 2021 WL 4206736, at *4 (W.D. Mo. Sept. 15, 2021). Courts also note that traceability is

not as demanding as causation; “[e]ven if the data accessed in the Data Breaches did not provide

all the information necessary to inflict these harms, they very well could have been enough to aid

therein.” Mednax Servs., Inc., Customer Data Sec. Breach Litig., 603 F. Supp. 3d 1183, 1206

(S.D. Fla. 2022); see, e.g., Solomon v. ECL Grp., LLC, No. 1:22-CV-526, 2023 WL 1359662, at

*4 (M.D.N.C. Jan. 31, 2023).

Several courts have doubted the concreteness and traceability of spam text messages and

calls, finding that “an increase in spam email and text as a time-based injury [is] insufficient to

constitute a concrete injury.” Hulse, 2025 WL 1453847, at *8. Other courts have noted that

12

“[s]pam calls, texts, and e-mails have become very common in this digitized world,” Hemphill,

2025 WL 837007, at *8 (quoting McCombs v. Delta Grp. Elecs., Inc., 676 F. Supp. 3d 1064, 1074

(D.N.M. 2023)); In re ESO Sols., Inc. Breach Litig., No. 1:23-CV-1557-RP, 2024 WL 4456703,

at *5 (W.D. Tex. July 30, 2024); In re Sci. Applications Int’l Corp. (SAIC) Backup Tape Data

Theft Litig., 45 F. Supp. 3d 14, 33 (D.D.C. 2014), finding that more factual allegations of injury

were required. The Hemphill and ESO courts needed “more,” Hemphill, 2025 WL 837007, at *8;

In re ESO Sols., 2024 WL 4456703, at *5, and the McCombs and SIAC courts needed factual

allegations that contact information was stolen and “detail[s of] the content or frequency of the

spam communications,” McCombs, 676 F. Supp. 3d at 1074; SAIC, 45 F. Supp. 3d at 33.

Under these principles, the plaintiffs have pleaded enough facts to show standing to assert

injuries based on the increased spam calls and messages after the data breach. Repeated spam

calls and messages can constitute concrete harm. See Perez, 45 F.4th at 826 n.6 (explaining that

“unwanted communications can inflict a concrete injury analogous to a nuisance or a public

nuisance”). And the plaintiffs have adequately alleged that their injuries are traceable to the data

breach. Although the plaintiffs’ contact information was not included in the breach, the plaintiffs

explain, through their discussion of “Fullz” packages, how the breach allows cybercriminals to

contact them more easily. See Fox, 399 F. Supp. 3d at 792. In addition, the plaintiffs allege that

they experienced “a significant increase in the number of spam emails and telephone calls.”

(Docket Entry No. 27 ¶ 170). They allege that the increase was close in “time proximity” to the

data breach and something that they have “never experienced . . . prior to now.” (Id.). Although

spam calls and emails are relatively common today, Hemphill, 2025 WL 837007, at *8, the

plaintiffs allege that the post-breach frequency of spam calls, emails, and texts was significantly

greater and a noticeable deviation from their usual experience. These allegations are sufficient to

13

create a reasonable inference that the increase is fairly traceable to New Era’s alleged role in

allowing the data breach.

The plaintiffs have standing to assert an injury based on an increase in spam calls and

emails and text messages after the breach.

B. Failure to State a Claim

New Era moves to dismiss the complaint for failure to state a claim. It argues: (1) that the

plaintiffs cannot prove damages to support their claims; (2) that the economic-loss rule bars the

plaintiffs’ tort claims; (3) that the plaintiffs have not adequately alleged a claim for negligence per

se; (4) that the plaintiffs have not adequately alleged a breach of an implied contract; and (5) that

the plaintiffs have not adequately alleged a claim for unjust enrichment.

1. Damages

“To support a claim for negligence, a plaintiff must establish (1) a legal duty owed by

Defendant to plaintiff; (2) a breach of that duty, and (3) damages proximately caused by the

breach.” Bruno v. Donohoe, 754 F. Supp. 3d 737, 748 (W.D. Tex. 2024). To state a claim for

breach of contract, implied or express, a plaintiff must also establish damages because of a breach.

Smith Int’l, Inc. v. Egle Grp., LLC, 490 F.3d 380, 387 (5th Cir. 2007). New Era argues that the

plaintiffs’ damages theories are not cognizable under Texas law or are inadequately pleaded.

Specifically, New Era argues that the plaintiffs: (1) cannot recover damages based on speculative

risks of future harm; (2) cannot recover for the diminution of the value of their personal

information; (3) cannot recover for the lost time spent responding to the data breach; (4) have not

adequately alleged emotional harm; and (5) cannot recover on a theory that they overpaid for

insurance services. The court addresses the first four arguments and leaves New Era’s fifth for its

discussion of the merits of the plaintiffs’ implied-contract claim.

14

i. Risk of Future Harm

Texas courts have not squarely addressed whether parties can recover damages for the risk

of harm posed by data breaches. Section 919 of the Restatement (Second) of Torts states that

“[o]ne whose legally protected interests have been endangered by the tortious conduct of another

is entitled to recover for expenditures reasonably made or harm suffered in a reasonable effort to

avert the harm threatened.” RESTATEMENT (SECOND) OF TORTS § 919(1) (AM. L. INST. 1979). This

principle extends to those who, by “lack of reasonable care . . . foreseeably . . . permit[] the

improper conduct of . . . a third party.” RESTATEMENT (THIRD) OF TORTS: PHYS. & EMOT.

HARM § 19 (AM. L. INST. 2010). Under this principle, a company that fails to reasonably protect

confidential or sensitive information can be liable for reasonable expenses required to mitigate the

risk of harm caused by a data breach. See RESTATEMENT (THIRD) OF TORTS: LIAB. FOR ECON.

HARM § 6 (AM. L. INST. 2020) (“An actor who, in the course of his or her business . . . performs a

service for the benefit of others is subject to liability for pecuniary loss caused to them by their

reliance upon the service, if the actor fails to exercise reasonable care in performing it.”).

Texas case law includes some examples of the Section 919 principle in practice. A Texas

court allowed recovery for reasonable expenses and attorneys’ fees necessary to avert the risk of

the loss of title to property caused by a defendant’s tortious conduct. Donnelly v. Young, 471

S.W.2d 888, 890, 897 (Tex. Civ. App.—Fort Worth 1971, writ ref’d n.r.e.); see also Moore v.

Kyles, No. 05-92-00238-CV, 1992 WL 368034, at *4 (Tex. App.—Dallas Dec. 14, 1992, no pet.)

(applying Section 919(1) to allow recovery of expenses incurred in a bankruptcy court to avert the

damage caused by fraud and conspiracy). In other cases, the Texas Supreme Court has cautioned

that the risk of future harm may be too low to permit compensatory damages, such as when people

who have only been exposed to asbestos sue for emotional damages based on the risk of contracting

15

future illnesses. See, e.g., Temple-Inland Forest Prods. Corp. v. Carter, 993 S.W.2d 88, 93 (Tex.

1999). But the Texas Supreme Court made clear that the viability of a plaintiff’s claim depends

on the “circumstances” and the “types of fears” of future harm at issue. Id. at 95.

Courts in the Fifth Circuit have allowed plaintiffs to pursue negligence claims if they allege

a sufficient risk of future injury to establish standing, as the plaintiffs have done here. See, e.g.,

Hawkins v. Scout Energy Mgmt., LLC, No. 3:24-CV-01545-N, 2025 WL 2244327, at *5, *8 (N.D.

Tex. Aug. 5, 2025); Cabezas v. Mr. Cooper Grp. Inc., No. 3:23-CV-2453-N, 2025 WL 2053287,

at *7, *11 (N.D. Tex. July 22, 2025); Castillo v. Berry Bros Gen. Contractors Inc., No. 6:24-CV-

01723, 2025 WL 1062091, at *5 (W.D. La. Apr. 8, 2025); Hulse, 2025 WL 1453847, at *7, *11–

12; Smith v. Am. Pain & Wellness, PLLC, 747 F. Supp. 3d 989, 1002–04 (E.D. Tex. 2024); Bruno,

754 F. Supp. 3d at 749. These conclusions track the Restatement and Texas case law. The

plaintiffs have adequately alleged damages based on their risk of future harm.

ii. Diminution in Value of Personal Information

The plaintiffs allege “that consumers can actually sell their non-public information directly

to a data broker who, in turn, aggregates the information and provides it to marketers or app

developers” and that “[c]onsumers who agree to provide their web browsing history to the Nielsen

Corporation can receive up to $50.00 a year.” (Docket Entry No. 27 ¶¶ 139–40). They allege that

the value of their information “has been damaged and diminished by its compromise and

unauthorized release” because the information “is now readily available, and the rarity of the Data

has been lost, thereby causing additional loss of value.” (Id. ¶ 141).2

2 New Era argues that a diminution in the value of one’s personal information is not concrete for the purpose

of standing. But the basis of the injury is economic, and monetary harm is a prototypical concrete injury.

TransUnion, 594 U.S. at 417. This court assumes that state law recognizes personal information as a

commodity and property interest for purposes of standing. See Polelle, 131 F.4th at 1211 (explaining that

courts must accept, for the purpose of standing, the plaintiff’s interpretation of the laws on which the

complaint relies).

16

New Era argues that loss of value for personally identifiable information is not cognizable.

Courts are split on the issue. There is a “growing trend across courts . . . to recognize the lost

property value of this information.” In re Marriott Int’l, Inc., Customer Data Sec. Breach Litig.,

440 F. Supp. 3d 447, 461 (D. Md. 2020); accord In re Mednax, 603 F. Supp. 3d at 1204; Klein v.

Facebook, Inc., 580 F. Supp. 3d 743, 803–04 (N.D. Cal. 2022). Texas courts have been skeptical

of these claims. See In re ESO Sols., 2024 WL 4456703, at *6 (collecting cases). But neither the

Texas Supreme Court nor the Fifth Circuit have addressed the issue directly. Cf. Somer v.

OakBend Med. Ctr., No. 01-24-00187-CV, 2025 WL 2446015, at *13–15 (Tex. App.—Houston

[1st Dist.] Aug. 26, 2025) (holding that government immunity barred the plaintiffs’ suit arising out

of a data breach of a hospital because the diminished value of their personal information is a

financial, not a personal, injury under the Tort Claims Act’s waiver).

In the absence of controlling precedent, the cases recognizing a diminution in the value of

one’s personally identifiable information are more persuasive. The Texas legislature has defined

“property” broadly to include “any matter or thing capable of private ownership.” TEX. TAX

CODE § 1.04(1). Texas law also recognizes property rights in, and has provided specific remedies

for misuses of, individuals’ name, image, and likeness. TEX. PROP. CODE § 26.013(a)(3). Texas

courts would likely recognize a property interest in personal data, which is similar to a person’s

name, image, and likeness and is capable of ownership and commoditization.

The complaint alleges that personally identifiable information has market value, which the

data breach diminished by making the information readily accessible on the dark web. New Era

cites cases finding similar allegations insufficient because the plaintiffs did not allege that they

will attempt to sell, or have in the past sold, their personally identifiable information. See In re

ESO Sols., 2024 WL 4456703, at *6–7; Hawkins, 2025 WL 2244327, at *4. This logic is

17

unpersuasive because in other contexts plaintiffs may recover the lost value of their damaged

property without showing that they plan to sell it. For example, to recover damages for trespass

to chattel, a plaintiff need only show harm to his interest in the quality or value of the chattel. See

Cranor v. 5 Star Nutrition, L.L.C., 998 F.3d 686, 692–93 (5th Cir. 2021) (citing RESTATEMENT

(SECOND) OF TORTS § 218(c) & cmt. e). Similarly, if a bailee negligently damages property in his

care, a plaintiff can establish damages simply by showing the reduction in the value of the bailed

property. See, e.g., Whitley v. Kinsel Motor Co., 94 S.W.2d 202, 202 (Tex. Civ. App.—San

Antonio 1936) (holding that the value of damages for a car crashed in a bailee’s custody is the

change in the market value). These principles apply to the allegations by some of the plaintiffs

that New Era’s negligence caused their personal information to be posted on the dark web, (Docket

Entry No. 27 ¶ 184, 212), and diminished the market value of their property (their personally

identifiable information), (id. ¶ 141).

New Era’s argument may prove persuasive at the summary-judgment stage or at trial, when

the plaintiffs must produce evidence that their personally identifiable information has lost value.

A factfinder might not find that the plaintiffs have been harmed because they cannot show that

they would sell their data soon or that they can only do so at a diminished price. But at this stage

in the litigation, the court must take the plaintiffs’ allegations as true. Iqbal, 556 U.S. at 678. The

plaintiffs have sufficiently alleged a diminution in the market value of their personally identifiable

information.

iii. Lost Time Damages

The plaintiffs repeatedly allege that they have suffered the “lost time and opportunity costs

associated with attempting to mitigate the actual consequences of the Data Breach.” (Docket Entry

18

No. 27 ¶ 7). New Era argues that Texas law does not recognize a tort for wasting another’s time.

(Docket Entry No. 41 at 18).

New Era argues that there is not a “tort that makes a person liable for wasting another’s

time,” Perez, 45 F.4th 825, and that “[l]ost time alone does not establish compensable damages,”

Smallman v. MGM Resorts Int’l, 638 F. Supp. 3d 1175, 1192 (D. Nev. 2022). But under Texas

law, plaintiffs may “estimate[] the value of wasted time” as a measure of damages, so long as they

introduce “evidence about the value of that time—either the quantity or the cost of it.” MBM Fin.

Corp. v. Woodlands Operating Co., L.P., 292 S.W.3d 660, 664 (Tex. 2009); see, e.g., Success

Motivation Inst., Inc. v. Lawlis, 503 S.W.2d 864, 868 (Tex. Civ. App.—Houston [1st Dist.] 1973,

writ ref’d n.r.e.) (upholding a jury award of $20,000 for “lost and wasted time and energy in

pursuing the distributorship venture” that was “directly traceable to wrongful acts” of the

appellant). The plaintiffs’ allegations of wasted time are downstream of the material risk of harm

they faced because of New Era’s alleged role in allowing the data breach. The plaintiffs have

alleged a claim for damages for this lost time. See, e.g., Cabezas, 2025 WL 2053287, at *7;

Hawkins, 2025 WL 2244327, at *5; Bruno, 754 F. Supp. 3d at 749; Smith, 747 F. Supp. 3d at 1002;

see Webb, 72 F.4th at 377 (“[T]ime spent responding to a data breach can constitute a concrete

injury sufficient to confer standing, at least when that time would otherwise have been put to

profitable use.”).

The plaintiffs bear the burden of proving that their lost time would otherwise have been

spent on profitable or productive activities that warrant compensable damages. New Era has not

moved to dismiss on the theory that Texas law requires proof of an economic, as opposed to leisure,

opportunity cost. Factual issues of the plaintiffs’ proof, and the legal issues that might accompany

their specific proof of damages, are still open.

19

The plaintiffs’ alleged damages based on lost time survive New Era’s motion to dismiss.

iv. Emotional Distress

New Era argues that the plaintiffs have not alleged sufficiently severe mental anguish to

recover for emotional distress under Texas law. (Docket Entry No. 41 at 19). The plaintiffs briefly

respond with cases suggesting that they can recover for emotional distress. (Docket Entry No. 44

at 10–11, 17). New Era’s argument is persuasive. The cases the plaintiffs cite do recognize that

emotional distress can be a concrete injury for the purpose of standing. See, e.g., Hawkins, 2025

WL 2244327, at *5; In re ESO Sols., 2024 WL 4456703, at *6; Hulse, 2025 WL 1453847, at *8.

The court agrees that the plaintiffs have standing to pursue damages based on emotional distress.

But New Era argues that Texas substantive law does not permit recovery on the alleged facts. The

court agrees with New Era’s reading of Texas law.

“Without intent or malice on the defendant’s part, serious bodily injury to the plaintiff, or

a special relationship between the two parties,” Texas courts “permit recovery for mental anguish

in only a few types of cases involving injuries of such a shocking and disturbing nature that mental

anguish is a highly foreseeable result,” such as in “suits for wrongful death and actions by

bystanders for a close family member’s serious injury.” City of Tyler v. Likes, 962 S.W.2d 489,

496 (Tex. 1997) (internal citations omitted); see Motor Exp., Inc. v. Rodriguez, 925 S.W.2d 638,

639 (Tex. 1996) (listing examples of cases in which “a claimant who is not physically injured by

the defendant’s breach of a duty may recover mental anguish damages”). Even when plaintiffs

may recover for mental anguish, “it is necessary to offer proof of more than mere worry, anxiety,

vexation or anger.” Grp. Hosp. Servs., Inc. v. Daniel, 704 S.W.2d 870, 878 (Tex. App.—Corpus

Christi-Edinburg 1985, no pet.). Mental anguish “implies a relatively high degree of mental pain

and distress,” such as “mental sensation of pain resulting from such painful emotions as grief,

20

severe disappointment, indignation, wounded pride, shame, despair and/or public humiliation.”

Id. (quoting Trevino v. Southwestern Bell Telephone Co., 582 S.W.2d 582 (Tex. Civ. App.—

Corpus Christi 1979, writ ref’d n.r.e.)).

The plaintiffs allege “stress, anxiety, and concern due to the loss of [their] privacy and

concern over the impact of cybercriminals accessing and misusing” their private information.

(Docket Entry No. 27 ¶¶ 173, 187, 201, 215; see also id. ¶ 158). These allegations are insufficient

to state a claim for emotional distress under Texas law. Nor does it appear that the alleged torts,

which sound in simple negligence and contract, provide a remedy for mental anguish.

The plaintiffs’ payer for damages based on emotional distress is dismissed, without

prejudice. The plaintiffs have one more opportunity to plead, consistent with Rule 11, that they

have suffered emotional damages for which Texas law would permit recovery.

2. Economic-Loss Rule

New Era argues that because the plaintiffs alleged a breach of an implied contract and

because they alleged purely economic injuries, Texas’s economic-loss rule bars their claims for

negligence and negligence per se. (Docket Entry No. 41 at 20).

Under the economic-loss rule, when damage allegedly resulting from the defendant’s

tortious conduct is limited to the loss of a contractual benefit, the action in tort is barred. See

Chapman Custom Homes, Inc. v. Dallas Plumbing Co., 445 S.W.3d 716, 718 (Tex. 2014) (per

curiam); Formosa Plastics Corp. USA v. Presidio Eng’rs & Contractors, Inc., 960 S.W.2d 41, 47

(Tex. 1998); Sw. Bell Tel. Co. v. DeLanney, 809 S.W.2d 493, 494–95 (Tex. 1991). But “the

economic loss rule does not preclude recovery in tort when the defendant, in performing a contract,

breaches a legal duty owed to the plaintiff that is independent of the contractual undertaking and

that results in damage to the plaintiff above and beyond the mere economic loss of the contractual

21

benefit itself.” ConocoPhillips Co. v. Koopmann, 542 S.W.3d 643, 664–65 (Tex. App.—Corpus

Christi–Edinburg 2016), aff’d on other grounds, 547 S.W.3d 858 (Tex. 2018). “Accompanying

every contract is a common-law duty to perform with care, skill, reasonable expedience and

faithfulness the thing agreed to be done, and a negligent failure to observe any of these conditions

is a tort, as well as a breach of the contract.” DeLanney, 809 S.W.2d at 494 (quoting Montgomery

Ward & Co. v. Scharrenbeck, 204 S.W.2d 508, 510 (Tex. 1947)).

The relevant questions are whether “the defendant’s conduct” gives “rise to liability only

because it breaches the parties’ agreement,” id., and whether the plaintiffs assert damages “above

and beyond the mere economic loss of the contractual benefit itself,” Koopmann, 542 S.W.3d at

665. The plaintiffs’ allegations meet this test. First, the plaintiffs allege that New Era breached

its duties under the FTC Act, the Gramm-Leach-Bliley Act, and the common law to prevent

foreseeable harm. (Docket Entry No. 27 ¶¶ 38, 240–45). The plaintiffs’ claims depend on duties

independent of the parties’ alleged contractual relationship. See, e.g., Hawkins, 2025 WL

2244327, at *9; Cabezas, 2025 WL 2053287, at *11. Second, the plaintiffs seek damages for their

mitigation costs, lost time, and violations of their privacy. (Docket Entry No. 27 ¶¶ 7, 14, 158–

59, 170–71, 173–74, 184–85, 187–88, 198–99, 201–02, 212–13, 215–16, 265–66). The plaintiffs

allege harm separate from and in addition to the value of the parties’ contracts. See, e.g., Hawkins,

2025 WL 2244327, at *9; Cabezas, 2025 WL 2053287, at *11; In re Solara Med. Supplies, LLC

Customer Data Sec. Breach Litig., 613 F. Supp. 3d 1284, 1295–96 (S.D. Cal. 2020). The

economic-loss rule does not bar the plaintiffs’ damages in tort.

New Era argues in reply that if the plaintiffs’ “claim for breach of implied contract survives,

its negligence claims cannot.” (Docket Entry No. 45 at 14). But the plaintiffs are permitted to

plead in the alternative. FED. R. CIV. P. 8(d)(3). The alleged inconsistency between the plaintiffs’

22

contract claims and tort claims need not be resolved at this early stage of the litigation. See

Occidental Petro. Corp. v. Wells Fargo Bank, N.A., 573 F.Supp.3d 1161, 1171 (S.D. Tex. 2021)

(holding that “it is premature to resolve” the economic-loss rule “argument at the motion to dismiss

stage” because the plaintiff “is entitled to plead alternative theories for relief, and will face the

economic-loss rule if and when it recovers, depending on the basis of recovery”).

3. Negligence Per Se

The plaintiffs have alleged claims of negligence per se based on breaches of the FTC Act

and the Gramm-Leach-Bliley Act. (Docket Entry No. 27 ¶¶ 89–110). New Era argues that the

plaintiffs’ negligence per se claims should be dismissed because Texas law governs each of their

negligence per se claims and because Texas law does not permit negligence per se claims based

on those statutes. (Docket Entry No. 41 at 14–15, 21–22).

Texas law does not recognize a negligence per se claim for breaches of the FTC Act or

Gramm-Leach-Bliley Act. “Negligence per se is a common-law doctrine that allows courts to rely

on a penal statute to define a reasonably prudent person’s standard of care.” Reeder v. Daniel, 61

S.W.3d 359, 361–62 (Tex. 2001). “But it is well established that [even] criminal statutes do not

always represent a standard for civil liability.” Id. “Courts ‘must consider whether recognizing

such an accompanying civil action would be inconsistent with legislative intent’ in ‘determining

whether a penal statute provides the basis for a civil cause of action.’” Eli Lilly, 2025 WL 3640703,

at *8 (quoting Reliable Ambulance Serv., Inc. v. Mercy Hosp. of Laredo, No. 04-02-00188-CV,

2003 WL 21972724, at *3 (Tex. App.—San Antonio Aug. 20, 2003, pet. denied)). “Reeder

directed Texas courts to assess how the legislature has regulated the area, whether it enacted

separate criminal and civil schemes relating to the conduct, whether the legislature considered and

rejected a private right of action, and whether courts in other jurisdictions have recognized a similar

23

cause of action.” Id. (citing Reeder, 61 S.W.3d at 363–64); see, e.g., Reliable, 2003 WL 21972724,

at *6 (concluding that violations of the federal anti-kickback statute could not support “a common

law cause of action by a competitor for damages and injunctive relief”); Eli Lilly, 2025 WL

3640703, at *11 (holding that Texas courts likely would not allow a tort claim based on violations

of the Texas FDCA).

Although the plaintiffs identify numerous cases that have allowed negligence per se claims

based on violations of the FTC Act and the GLBA, Texas courts applying Texas law have

consistently rejected negligence per se claims based on the FTC Act and similar statutes that do

not include private rights of action but include government-enforcement schemes. See, e.g., Smith,

747 F. Supp. 3d at 1004 (FTC Act); Bruno, 754 F. Supp. 3d at 748 n.3 (same); In re ESO, 2024

WL 4456703, at *11 (same); Lowman v. Enter. Fin. Grp., Inc., No. 3:24-CV-02752-L, 2025 WL

2778380, at *3 (N.D. Tex. Sept. 30, 2025) (same); see also Hall v. Phenix Investigations, Inc., No.

3:14-CV-0665-D, 2014 WL 5697856, at *9 (N.D. Tex. Nov. 5, 2014) (holding that there is no

private right of action under the GLBA); Haynes v. Am.’s Car-Mart, Inc., No. 5:24-CV-00067-

RWS-JBB, 2024 WL 4729491, at *9 (E.D. Tex. Sept. 23, 2024) (same), report and

recommendation adopted, No. 5:24-CV-67-RWS-JBB, 2024 WL 4533301 (E.D. Tex. Oct. 21,

2024). The plaintiffs cannot state a claim of negligence per se based on violations of the FTC Act

and the GLBA under Texas law.

These statutes may come into play, because federal law may provide “evidence of the

relevant standard of care.” Century Next Bank v. JPMorgan Chase Bank, No. CV H-25-2461,

2026 WL 179558, at *5 (S.D. Tex. Jan. 23, 2026). “Experts routinely opine on the standard of

care,” and “references to statutes and administrative regulations is one method of establishing a

standard of care.” Texas Health Harris Methodist Hosp. Sw. Fort Worth v. Davis, No. 02-23-

24

00055-CV, 2024 WL 3611269, at *19 (Tex. App.—Fort Worth Aug. 1, 2024, pet. denied) (mem.

op) (quoting Doe v. Kerrville I.S.D., SA-21-CV-00369-XR, 2023 WL 5313889, at *6 (W.D. Tex.

Aug. 16, 2023)); Hernandez v. Nueces Cnty. Med. Soc’y Cmty. Blood Bank, 779 S.W.2d 867, 871

(Tex. App.—Corpus Christi–Edinburg 1989, no pet.) (explaining that “[i]t is well-established that

state health regulations, national standards, and organizational bylaws are admissible to define the

standard of care customarily offered”). The FTC Act and the GLBA “may speak to the relevant

standard of care,” but “they cannot show an automatic breach of duty to establish negligence per

se.” In re ESO, 2024 WL 4456703, at *11.

Second, although Texas law would not recognize the plaintiffs’ negligence per se claims,

“a law other than Texas law may apply.” Cabezas, 2025 WL 2053287, at *12; Hawkins, 2025 WL

2244327, at *10. A federal court applies the choice-of-law rules of the state in which it sits.

Klaxon Co. v. Stentor Elec. Mfg. Co., 313 U.S. 487, 496 (1941). Texas courts apply the law of the

state with the most significant relationship to the particular substantive issue. Taylor v. U.S. Bank

Nat. Ass’n, No. 4:12-cv-03550, 2015 WL 507526, at *5 (S.D. Tex. Feb. 6, 2015). Relevant factors

are: 1) the place where the injury occurred; 2) the place where the conduct causing the injury

occurred; 3) the domicile, residence, nationality, place of incorporation and place of business of

the parties, and 4) the place where the relationship, if any, between the parties is centered.

RESTATEMENT (SECOND) OF CONFLICT OF LAWS § 145(2) (AM. L. INST. 1971).

“Courts have specifically recognized that ‘[t]he data breach context raises unique problems

in choice-of-law analysis’ because it is not always clear where the breach occurred and where the

harm from the breach can be said to have accrued.” Tjahjono v. Westinghouse Air Brake Techs.

Corp., No. 2:23-CV-531, 2024 WL 1287085, at *5 (W.D. Pa. Mar. 26, 2024) (alterations in

original) (quoting In re Mednax, 603 F. Supp. 3d at 1199). Data is no longer “stored on local

25

servers or mainframes,” but perhaps in the “cloud,” meaning that the location of the breach or

injury is not “readily determined.” In re Mednax, 603 F. Supp. 3d at 1199. “A substantial number

of cases addressing the issue in the context of data breach cases have accordingly held that it is

inappropriate to decide which law applies at the motion to dismiss stage.” Tjahjono, 2024 WL

1287085, at *5; see, e.g., In re Am. Med. Collection Agency, Inc. Customer Data Sec. Breach

Litig., No. 19-md-2904, 2021 WL 5937742, at *13–14 (D.N.J. Dec. 16, 2021); Carr v. Oklahoma

Student Loan Auth., 699 F. Supp. 3d 1241, 1246–47 (W.D. Okla. 2023).

It is not clear whether these factual issues are material to the choice-of-law analysis. Some

courts have recognized that the location of breached servers would not alter the conflicts analysis.

See, e.g., In re MOVEit Customer Data Sec. Breach Litig., No. 23-MD-3083-ADB-PGL, 2025 WL

2176590, at *5 (D. Mass. July 31, 2025). In any event, the parties did not spend much time briefing

the choice-of-law issue, which offers another reason to defer resolving the question at this stage.

See id. at *6 (collecting cases that defer choice-of-law questions due to limited briefing).

The plaintiffs’ claims for negligence per se are not viable under Texas law, but their claims

are not dismissed with prejudice because the laws of other states may apply and may allow them.

4. Breach of Implied Contract

A breach of an implied-contract claim requires that the plaintiff show an enforceable

contract, including: (1) an offer, (2) an acceptance, (3) a meeting of the minds, (4) mutual consent,

and (5) execution and delivery. Plotkin v. Joekel, 304 S.W.3d 455, 476 (Tex. App.—Houston [1st

Dist.] 2009, pet. denied). The difference between express contracts and implied contracts is the

evidence used to prove the meeting of minds to form a legal agreement. Id. at 476–77; see

Southwell v. Univ. of the Incarnate Word, 974 S.W.2d 351, 354–55 (Tex. App.—San Antonio

1998, pet. denied). The parties’ objective actions, not their subjective state of minds, control the

26

analysis. Lindsey Constr., Inc. v. AutoNation Fin. Servs., LLC, 541 S.W.3d 355, 363 (Tex. App.—

Houston [14th Dist.] 2017, no pet.).

The plaintiffs rely on two theories of contract formation: (1) an agreement to adhere to the

terms of New Era’s privacy policy; and (2) an implied agreement based on the sensitive nature of

the data given to New Era. (Docket Entry No. 27 ¶¶ 284–304). New Era argues that the plaintiffs

lack standing to sue for breach of the implied contract and that no such contract exists as a matter

of Texas law. (Docket Entry No. 41 at 10–11, 22–25). If the plaintiffs’ allegations are sufficient,

then they have standing to pursue their contract claims. See TransUnion, 594 U.S. at 417

(explaining that economic harms are sufficient to confer standing). The implied-contract claim is

appropriately addressed on the merits. And on the merits, the plaintiffs’ implied-contract claim

fails.

The plaintiffs allege that they were customers or employees of New Era and had purchased

policies (or had employment contracts) with them. (Docket Entry No. 27 ¶ 4, 29, 30). In other

words, the plaintiffs have or had an express contract with New Era. Under Texas law, “there can

be no implied contract where the subject matter is covered by a valid express contract.” Morales

v. Dalworth Oil Co., 698 S.W.2d 772, 774 (Tex. App.—Forth Worth 1985, writ ref’d n.r.e.); see

1 WILLISTON ON CONTRACTS § 4:21 (4th ed. 2025) (“There can be no implied in fact if there is an

express contract covering the subject matter involved.”). To facilitate New Era’s performance

under the parties’ contracts, the plaintiffs provided New Era with personal and confidential

information. (Docket Entry No. 27 ¶ 30). If the plaintiffs wanted New Era, as a condition of the

contract, to provide a level of cybersecurity to their information, then they should have added such

a term to the agreement. Arguing that an implied-in-fact contract exists between these parties is

an attempt “to change the parties’ express agreement.” Iiitec Ltd. v. Weatherford Tech. Holdings,

27

LLC, No. CV H-19-3386, 2021 WL 2635380, at *13 (S.D. Tex. June 25, 2021). The mere

provision of sensitive data in exchange for services is insufficient to create an implied-in-fact

contract when the plaintiffs provided that data under an express contract that excludes the term

that they hope to imply. Cf. In re Mednax, 603 F. Supp. 3d at 1221 (declining to imply a contract

based on allegations that the plaintiffs merely “provided their personal information as required to

receive healthcare services from Defendants”).

New Era’s privacy policy does not change the analysis. Multiple documents can form a

single contract, or one document may incorporate by reference the promises made in another

document. Polyflow, LLC v. Specialty RTP, LLC, No. 4:15-CV-02817, 2016 WL 6909383, at *6

(S.D. Tex. May 17, 2016). But there is no allegation that the plaintiffs’ insurance agreements with

New Era incorporated by reference the privacy policy. Nor are there allegations that the privacy

policy was furnished to the plaintiffs during negotiations over the insurance policies or

employment contracts, such that all the documents should be part of the same agreement. See

Mobil Expl. & Producing U.S., Inc. v. Dover Energy Expl., L.L.C., 56 S.W.3d 772, 777 (Tex.

App.—Houston [14th Dist.] 2001, no pet.) (“A court may determine, as a matter of law, that

multiple documents, even if they are executed at different times and do not reference each other,

comprise a single, unified contract.”). Without more, New Era’s privacy policy does not create

enforceable contractual obligations. Compare Day & Zimmermann, Inc. v. Hatridge, 831 S.W.2d

65, 69 (Tex. App.—Texarkana 1992, writ denied) (explaining that “a statement of company policy,

unaccompanied by an express agreement, does not create contractual rights”), with Fort Worth

Transp. Auth. v. Thomas, 303 S.W.3d 850, 859 (Tex. App.—Fort Worth 2009, pet denied) (“The

CBA and the Operator Handbook related to the same transaction, and their terms do not clearly

prevent them from being considered together.”).

28

The plaintiffs have not stated a breach of contract claim against New Era. The court grants

New Era’s motion to dismiss this claim, without prejudice, and grants the plaintiffs leave to amend

their complaint to attempt to state a contract, misrepresentation, or fraud claim under Texas law.

Failure to sufficiently allege this claim in the amended complaint will result in a dismissal of that

claim with prejudice.

5. Unjust Enrichment

Under Texas law, unjust enrichment “is an equitable concept that arises in situations in

which another person has ‘wrongfully secured a benefit or has passively received one in which it

would be unconscionable to retain.’” Houle v. Casillas, 594 S.W.3d 524, 554 (Tex. App.—El

Paso 2019, no pet.) (quoting Eun Bok Lee v. Ho Chang Lee, 411 S.W.3d 95, 111–12 (Tex. App.—

Houston [1st Dist.] 2013, no pet.)). New Era argues that the plaintiffs’ unjust enrichment claim

fails because they “do not allege that Defendant did anything that was fraudulent or that involved

duress or undue advantage.” (Docket Entry No. 41 at 25).

Texas law “recognizes two theories or species of unjust enrichment: one for passive receipt

of a benefit that would be unconscionable to retain, and another for wrongfully securing a benefit.”

Digital Drilling Data Sys., LLC v. Petrolink Servs., Inc., 965 F.3d 365, 379 (5th Cir. 2020); see In

re KP Eng’g, L.P., 63 F.4th 452, 457 (5th Cir. 2023) (“If a plaintiff’s unjust enrichment claim is

based on passive receipt of a benefit that would be unconscionable to retain, then the plaintiff does

not need to plead or prove that the defendant acted wrongfully.”). The existence of fraud, duress,

or the taking of undue advantage is not an element of unjust enrichment, “even though the doctrine

is typically found to apply under one of those scenarios.” Walker v. Walker, 631 S.W.3d 259, 266

(Tex. App.—Houston [14th Dist.] 2020, no pet.) (cleaned up). A claim for unjust enrichment

29

“does not depend on the existence of a wrong” and instead arises when a party retains benefits

under circumstances where it would be unjust to retain them. /d. (citation omitted).

New Era does not move to dismiss the plaintiffs’ unjust-enrichment claim on any other

ground. New Era’s motion to dismiss the plaintiffs’ unjust-enrichment claim is denied.

IV. Conclusion

New Era’s motion to dismiss, (Docket Entry No. 41), is granted in part and denied in part.

The plaintiffs’ allegations of emotional harm are dismissed, without prejudice. The plaintiffs’

claims of negligence per se are dismissed, without prejudice, subject to this court’s later ruling on

choice-of-law issues. The plaintiffs’ claims for implied breach of contract are dismissed, without

prejudice. The plaintiffs are granted leave to amend their complaint within 14 days of the issuance

of this Memorandum and Opinion.

SIGNED on February 4, 2026, at Houston, Texas.

LW Cnt

Lee H. Rosenthal

Senior United States District Judge

30