Colley

UNITED STATES DISTRICT COURT

EASTERN DISTRICT OF MISSOURI

EASTERN DIVISION

WILLIAM COLLEY, individually and )

on behalf of all others similarly situated, )

)

Plaintiffs, )

)

v. ) Case No. 4:25-cv-00687-SRC

)

NEIGHBORS CREDIT UNION, )

)

Defendant. )

Memorandum and Order

William Colley asserts—individually, and on behalf of a putative class—that his personal

identifying information sits for sale on the dark web, because hackers breached Neighbors’ data.

In response, Neighbors filed a motion to dismiss along with a motion to compel arbitration.

Having reviewed the parties’ briefing, the Court rules on Neighbors’ Motion.

I. Factual Background

The Court accepts the following well-pleaded facts as true for purposes of deciding

Neighbors’ Motion to Dismiss. Neighbors is a “full service” credit union based in St. Louis,

Missouri, with nine branches spread across the state. Doc. 21 at ¶ 2. Neighbors “offers a variety

of financial services and products” to its customers. Id. at ¶ 27. But its relationship with each

plaintiff in this case varies. Plaintiffs Johnson and Beinart are current Neighbors customers, doc.

21 at ¶¶ 181, 201, while Colley, Hollis, and Short-Shumate are former Neighbors customers, id.

at ¶¶ 104, 159, 238. Putney and Beatty Jr. state that Neighbors obtained their personal

identifying information, or PII, through its business and banking activities Id. at ¶¶ 123, 223.

Putney had a line of credit maintained by Neighbors. Id. at ¶ 122. Beatty Jr.’s exact relationship

with Neighbors goes unexplained in Plaintiffs’ Complaint. See id. at ¶¶ 222–37.

In addition to Putney and Beatty Jr., Colley and Wilbur also state that Neighbors obtained

their PII through its business and banking activities. Id. at ¶¶ 105, 142. However, in exhibits

attached in support of its Motion, Neighbors clarified Colley and Wilbur’s specific relationship

to it. See doc. 25. Colley purchased a vehicle on credit from “Mercedes Benz of Long at

Chattanooga.” Doc. 25-7 at 2 (The Court cites to page numbers as assigned by CM/ECF.). In

his secured-vehicle-loan contract, the creditor assigned its interest in the loan to Credit Union

Loan Source. Id. Similarly, Wilbur purchased a vehicle on credit from “U-J Chevrolet Co.,

Incorporated.” Doc. 25-9 at 2, 4. In Wilbur’s secured-vehicle-loan contract, the creditor also

assigned its interest to Credit Union Loan Source. Id.

Credit Union Loan Source then sold its interests in these secured-vehicle-loan contracts

to National Cooperative Bank. Doc. 25-6 at ¶ A. National Cooperative Bank then sold its

interests in these secured-vehicle-loan contracts to Neighbors pursuant to a master Purchase and

Sale Agreement. Id. at ¶ D; doc. 25-1 at ¶ 12.

The Purchase and Sale Agreement between National Bank Cooperative and Neighbors

stated that “the rights assigned by [National Cooperative Bank] to [Neighbors] . . . include the

right to,” among other things, “pursue all remedies at law or otherwise that [National

Cooperative Bank] may have with respect to the [secured-vehicle-loan contracts].” Doc. 25-6 at

4–5. And in Exhibit B to the Purchase and Sale Agreement, National Cooperative Bank assigned

its interests in these loans to Neighbors. Doc. 25-6 at 13. Neighbors’ Chief Finance Officer—

Janice Bennett—signed a declaration stating that “[t]he loan in which [Neighbors] ultimately

purchased an ownership interest pursuant to the Purchase and Sale Agreement included auto

loans for vehicle purchases made by Plaintiffs Colley and Wilbur.” Doc. 25-1 at ¶¶ 11–12. The

Court does not consider these matters outside the pleadings in deciding Neighbors’ 12(b)(6)

motion to dismiss, instead only considering them to decide (i) Neighbors’ challenge to the

Court’s jurisdiction and (ii) Neighbors’ Motion to Compel Arbitration. Osborn v. United States,

918 F.2d 724, 728 n.4 (8th Cir. 1990); City of Benkelman v. Baseline Eng’g Corp., 867 F.3d 875,

882 (8th Cir. 2017).

In January 2025, Neighbors concluded that in September 2024 an unauthorized actor

accessed files that contained Plaintiffs’ PII. Doc. 21 at ¶¶ 3, 33. According to Plaintiffs, the

culprit behind the breach is the “notorious cybercriminal group” known as “Black Suit.” Id. at

¶¶ 40–41. Just a month after the hack, Black Suit started offering the stolen PII for sale on the

“Dark Web.” Id. at ¶ 42. But Neighbors only started notifying individuals about the hack in

early May 2025. Id. at ¶ 34.

II. Procedural Background

A few days after receiving notice of the hack, Colley sued Neighbors, individually, and

on behalf of a putative class that currently includes seven other plaintiffs. See doc. 1; doc. 17 at

3 (consolidating Colley’s suit with seven identical putative class actions against Neighbors); doc.

21 (Plaintiffs’ operative complaint). Plaintiffs assert six common-law counts: (i) negligence, see

doc. 21 at ¶¶ 274–306, (ii) negligence per se, see id. at ¶¶ 307–20, (iii) breach of implied

contract, see id. at ¶¶ 321–32, (iv) unjust enrichment, see id. at ¶¶ 333–43, (v) breach of

confidence, see id. at ¶¶ 344–55, and (vi) invasion of privacy, see id. at ¶¶ 356–73.

A month later, Neighbors moved to dismiss Plaintiffs’ putative class action for lack of

Article III standing, see Fed. R. Civ. P. 12(b)(1), or for failure to state a claim upon which the

Court can grant relief, see Fed. R. Civ. P. 12(b)(6). Doc. 24. It also moved to compel arbitration

for Plaintiffs Johnson, Beinart, Colley, and Wilbur. Id. Plaintiffs filed their response a month

later, doc. 30, and a month after that, Neighbors filed its reply, doc. 31. Now with the issues

fully briefed, the Court addresses Neighbors’ challenge to the Court’s jurisdiction.

III. Art. III Standing

To resolve any case on the merits, a court must have jurisdiction to do so. That includes

ensuring that the plaintiff satisfies the requirements of Article III standing. Pucket v. Hot

Springs Sch. Dist. No. 23-2, 526 F.3d 1151, 1156–57 (8th Cir. 2008). Article III of the United

States Constitution, by its own terms, limits the jurisdiction of the federal courts to “Cases” and

“Controversies.” U.S. Const. art. III, § 2; Lujan v. Defs. of Wildlife, 504 U.S. 555, 559 (1992).

That limitation, along with the corpus of federal constitutional standing caselaw that it animates,

rests on a “single basic idea—the idea of separation of powers.” TransUnion LLC v. Ramirez,

594 U.S. 413, 422 (2021) (citation omitted). The separation-of-powers function performed by

constitutional standing doctrine is simple: it “serv[es] to identify those disputes which are

appropriately resolved through the judicial process.” Lujan, 504 U.S. at 560 (cleaned up). And

because standing doctrine performs this critical function, it constitutes “an essential and

unchanging part of the case-or-controversy requirement of Article III.” Id.

Federal courts are powerless to adjudicate disputes that do not qualify as “Cases” or

“Controversies.” See id. at 559–60; DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 340–42

(2006). Standing doctrine enforces that case-or-controversy requirement: it aims to ascertain

that before a federal court adjudicates a dispute, a bona fide case or controversy exists. See

DaimlerChrysler Corp., 547 U.S. at 342. At the heart of standing doctrine is a core question:

whether plaintiffs have a “personal stake” in the matter at hand. TransUnion LLC, 594 U.S. at

423. To put it in layman’s terms, “plaintiffs must be able to sufficiently answer the question:

‘What’s it to you?’” Id. (quoting Antonin Scalia, The Doctrine of Standing as an Essential

Element of the Separation of Powers, 17 Suffolk U. L. Rev. 881, 882 (1983)).

Sufficiently answering that question requires plaintiffs to show that they satisfy three

specific conditions: (i) that they have alleged a cognizable injury, (ii) that the injury is “fairly

traceable to the defendant’s allegedly unlawful conduct,” (iii) and that the injury is likely to be

redressed by the requested relief. California v. Texas, 593 U.S. 659, 668–69 (2021) (cleaned

up). “[S]tanding is not dispensed in gross; rather, [a] plaintiff[] must demonstrate standing for

each claim that [he] press[es] and for each form of relief that [he] seek[s].” TransUnion LLC,

594 U.S. at 431 (citations omitted). But in the context of a putative class action, the suit may

proceed as long as one named plaintiff has standing. In re SuperValu, Inc., 870 F.3d 763, 768

(8th Cir. 2017). And “[a]t the pleadings stage, general factual allegations suffice to support

standing.” Rydholm v. Equifax Info. Servs. LLC, 44 F.4th 1105, 1108 (8th Cir. 2022).

A. Injury

“To establish an injury in fact, a plaintiff must show an injury that is ‘concrete and

particularized’ and ‘actual or imminent, not conjectural or hypothetical.” Auer v. Trans Union,

LLC, 902 F.3d 873, 877 (8th Cir. 2018) (quoting Spokeo, Inc. v. Robins, 578 U.S. 330, 338

(2016)) (cleaned up). And when a plaintiff alleges an intangible harm, the Court must consider

whether the alleged harm “has a close relationship to a harm that has traditionally been regarded

as providing a basis for a lawsuit in English or American courts.” Spokeo, 578 U.S. at 341.

Though a plaintiff need not allege “an exact duplicate in American history and tradition,” one

cannot judge an injury’s concreteness “based on contemporary, evolving beliefs about what kind

of suits should be heard in federal courts.” TransUnion LLC, 594 U.S. at 424–25; see also Jones

v. Bloomingdales.com, LLC, 124 F.4th 535, 540 (8th Cir. 2024) (“Breezy declarations of an

intangible yet concrete injury without support won’t suffice.”) (cleaned up).

Plaintiffs’ alleged concrete harms include: (i) invasion of privacy, (ii) theft of private

information, (iii) diminished value of PII (iv) mitigation and lost opportunity costs, (v) actual

misuse of the compromised data resulting in an increase of spam and attempts to open fraudulent

accounts, (vi) loss of the benefit of their bargain, and (vii) emotional harm. Doc. 21 at ¶ 8. In

sum, they allege various intangible harms resulting from having their PII in the hands of bad

actors. And as the Court noted above, in a putative class action only one plaintiff needs standing

for the suit to proceed. SuperValu, 870 F.3d at 768. So because each Plaintiff alleges similar

injuries to those of Colley, see doc. 25 at 22–23; see also doc. 21, the Court analyzes Colley’s

alleged injuries. For the following reasons, the Court finds that Colley, and Plaintiffs more

generally, have sufficiently pleaded an injury in fact.

1. Invasion of privacy

First consider Colley’s alleged invasion of privacy. See TransUnion, 594 U.S. at 425

(stating that the intangible harm of disclosure of private information can constitute a concrete

injury). Colley, a former Neighbors customer, states that he received a “personalized Data

Breach letter” from Neighbors. Doc. 21 at ¶ 104. The letter stated that “his name and Social

Security Number, had been exposed in the breach.” Id.; see also doc. 21-1 at 2 (a copy of

Wilbur’s letter). And that his PII “has already been published—or will be published

imminently” on the dark web. Doc. 21 at ¶ 111; see also id. at ¶ 114; id. at ¶¶ 41–42 (stating that

“Black Suit appears to have already leaked the stolen Private Information on the Dark Web . . . .

around October 18, 2024”).

In response, Neighbors argues that Plaintiffs’ harm is entirely speculative and therefore

not concrete. Doc. 25 at 22 (citing Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013)

(stating that the “threatened injury must be certainly impending to constitute injury in fact . . .

allegations of possible future injury are not sufficient”) (cleaned up)). After all, though

Neighbors’ notice-of-breach letter indicated that Social Security numbers were stolen, see doc.

21-1 at 2, the letter’s very next sentence states “[w]e have no evidence that your personal

information has been misused for the purpose of committing fraud or identity theft.” Id.

The Court finds Neighbors’ argument unconvincing. Common sense dictates that when

hackers steal sensitive PII—like Social Security numbers—and post it for sale on the dark web,

one’s PII has been misused. Cf. SuperValu, 870 F.3d at 770 (holding that stolen credit card

information, which “does not include any personally identifying information, such as social

security numbers,” presents little risk of fraudulent activity).

Unlike a ransomware attack, where the hack is a means to an end—extorting payment

from the hacked party—here, the hack is a means to a secondary harm: selling Colley’s PII to

bad actors. Cf. In re Practicefirst Data Breach Litig., No. 1:21-cv-00790-JLS/MJR, 2022 WL

354544 at *5 (W.D.N.Y. Feb. 2, 2022). Colley plausibly alleges that his sensitive PII—at the

very least—sits on the Dark Web awaiting a willing and able buyer, doc. 21 at ¶¶ 41–42, 105;

see also TransUnion, 594 U.S. at 440–42 (holding that class members whose incorrect credit

reports were disseminated to a third-party business possessed a concrete injury). At this stage in

the litigation, Colley need not show more. Rydholm, 44 F.4th at 1108 (“At the pleadings stage,

general factual allegations suffice to support standing.”). While the Court reserves for the merits

whether the pleaded facts plausibly fit the common-law elements, the Court finds that Colley

sufficiently pleaded a clearly imminent injury.

2. Mitigation and opportunity costs

Next consider Colley’s mitigation and opportunity costs arising from the hack. See doc.

21 at ¶¶ 8, 116–17. Neighbors argues, again citing to Clapper, that one “cannot manufacture

standing merely by inflicting harm on themselves based on their fears of hypothetical future

harm.” Doc. 25 at 26 (citing Clapper, 568 U.S. at 416). But Colley, and Plaintiffs in general,

haven’t manufactured anything. Colley alleges that Black Suit stole sensitive PII, and so he took

“necessary and appropriate action to prevent further damages.” Mackey v. Belden, Inc., No.

4:21-cv-00149-JAR, 2021 WL 3363174 at *5 (E.D. Mo. Aug. 3, 2021); cf. SuperValu, 870 F.3d

at 771 (holding that mitigation costs cannot confer standing where plaintiffs only had a

speculative risk of future identity theft). And while “time and effort” injuries alone may be

insufficiently concrete, doc. 21 at ¶ 117; cf. Ojogwu v. Rodenburg L. Firm, 26 F.4th 457, 463

(8th Cir. 2022) (finding that a plaintiff lacked standing where he did not act to his detriment to

protect his interests after receiving a copy of garnishment summons), here, Colley also alleged

“out-of-pocket [mitigation] expenses,” doc. 21 at ¶ 8. The Court finds that Colley pleaded a

sufficiently concrete injury to confer standing.

3. Breach of implied contract

In connection with their breach-of-implied-contract claim, see doc. 21 at ¶¶ 321–32,

Plaintiffs allege harms from the lost benefit of their bargain with Neighbors. Id. at 3. Parties to a

breached contract have “a judicially cognizable interest for standing purposes, regardless of the

merits of the breach alleged.” Kuhns v. Scottrade, Inc., 868 F.3d 711, 716 (8th Cir. 2017)

(holding that customers whose PII was stolen had standing to pursue contract-related claims).

The Court finds that Plaintiffs have standing, at the pleadings stage, to assert their

breach-of-implied-contract claim.

4. Diminished value of PII

Plaintiffs also allege that the hack diminished the value of their PII, causing them an

economic loss. Doc. 21 at ¶¶ 8, 99. Neighbors disagrees, see doc. 25 at 25, but neither party

directs the Court to any binding precedent in support of its argument. Though not binding, the

Court finds the Pulliam court’s analysis persuasive. See Pulliam v. W. Tech. Grp., LLC, No.

8:23-cv-159, 2024 WL 356777 at *8 (D. Neb. Jan. 19, 2024). While the Court agrees that

Plaintiffs’ PII has value, the Court doubts whether any diminution in value is sufficiently

concrete to confer standing. Id. Plaintiffs do not allege, and the Court does not see how this type

of harm bears, a “close relationship to a harm that has traditionally been regarded as providing a

basis for lawsuit in English or American courts.” Spokeo, 578 U.S. at 341.

For one, Plaintiffs do not allege that a legitimate market exists for the type of PII

involved in this case. Doc. 21 at ¶ 98 nn.28 & 29 (citing to articles that state that a market exists

to buy an individual’s internet browsing history, app usage data, or location data). And even if

Plaintiffs plausibly alleged that a legitimate market did exist for the PII in this case, they do not

allege with any particularity that they intended to sell their PII but were forced to accept a

decreased price. See Prestby v. A&A Servs., LLC, No. 8:24-cv-204, 2026 WL 26128, at *10–11

(D. Neb. Jan. 5, 2026); see also Pulliam, 2024 WL 356777 at * 8. Nor do they allege any facts

explaining how the breach devalued their PII. See Prestby, 2026 WL 26128, at *10–11. The

Court finds that Plaintiffs do not allege a type of harm sufficient to have standing to assert

damages arising from the diminished value of their PII.

5. Emotional harm

Finally, Plaintiffs allege that the hack and its aftermath left them with increased anxiety

and emotional distress. Doc. 21 at ¶¶ 117, 134, 154, 173, 196, 216, 235, 252, 255, 302, 355.

Neighbors responded that emotional distress without more cannot constitute concrete injury.

Doc. 25 at 24. The Court agrees with Neighbors that emotional harm alone cannot constitute a

concrete injury. SeeDenmon v. Kan. Couns., Inc., 149 F.4th 1010, 1013 (8th Cir. 2025) (“In

general, allegations of intangible injury such as distress and alarm fall short of cognizable injury

as a matter of general tort law”) (cleaned up). But Plaintiffs don’t allege emotional harm alone,

they also allege financial injuries and several intangible injuries. Doc. 21 at ¶ 8; see Rydholm,

44 F.4th at 1108 (holding that “tangible financial harm and intangible emotional injury . . . are

sufficient to establish standing”). The Court finds that Plaintiffs, at this stage, have standing to

assert damages arising from the emotional harm they suffered because of the hack.

B. Traceability

Typically, to satisfy the traceability prong of Article III standing, a plaintiff must show

that a “causal connection between the injury and the conduct complained of” exists. Lujan, 504

U.S. at 560. The alleged injury must, in other words, “result[] from the putatively illegal action”

or the “challenged action” of the defendant. Simon v. E. Ky. Welfare Rts. Org., 426 U.S. 26, 41

(1976)). But at the pleadings stage, Plaintiffs’ burden is “relatively modest.” Bennett v. Spear,

520 U.S. 154, 171 (1997). Plaintiffs must only show that their injury is “fairly traceable” to the

hack. Id.

Neighbors argues that Colley, and Plaintiffs, cannot even make that lesser showing

because “[it] was not responsible for the Security Incident; third-party cybercriminals were

responsible.” Doc. 25 at 26–27. To be sure, at a high level of generality, Neighbors is correct.

Many events in life have multiple but-for causes. And on the merits, Plaintiffs bear the burden to

show that Neighbors’ negligence was the proximate cause of Plaintiffs’ damages. But

“[p]roximate causation is not a requirement of Article III standing.” Lexmark Int’l, Inc. v. Static

Control Components, Inc., 572 U.S. 118, 134 n.6 (2014). Here, the issue is whether Plaintiffs’

harms are fairly traceable to Neighbors’ conduct as pleaded. And Plaintiffs’ Complaint, taken as

true, sufficiently pleads that Plaintiffs’ alleged harms are fairly traceable to Neighbors’ allegedly

deficient cybersecurity practices.

For one, Plaintiffs allege that Neighbors only discovered the hack nearly four months

after it occurred, and it took about another four months for it to notify Plaintiffs of the breach.

Doc. 21 at ¶¶ 32–34. Plaintiffs also allege that Neighbors failed “to employ reasonable and

appropriate measures to protect against unauthorized access to Plaintiffs’ and Class Members’

Private Information” as required by “Section 5 of the [Federal Trade Commission Act].” Doc.

21 at ¶ 53. And they allege that it failed to “implement industry-standard cybersecurity measures

. . . thereby permitting the Data Breach to occur.” Id. at ¶¶ 57–58. Finally, Plaintiffs allege that

“[h]ad [Neighbors] remedied the deficiencies in its information storage and security systems,

followed industry guidelines, and adopted security measures recommended by experts in the

field, it could have prevented intrusion into its information storage and security systems and,

ultimately, the theft of Plaintiffs’ and Class Members’ confidential Private Information.” Id. at

¶ 62.

In sum, Neighbors allegedly failed to secure Plaintiffs’ PII, it got hacked, and the hackers

posted the stolen PII on the Dark Web. The Court therefore finds that Plaintiffs’ harm is fairly

traceable to Neighbors’ alleged conduct and that Plaintiffs’ harm will likely be redressed by a

favorable decision. Lujan, 504 U.S. at 661. And so, the Court finds that Plaintiffs have standing

at this early stage in the litigation.

IV. Motion to Compel Arbitration

Having found that Plaintiffs have standing, the Court turns to Neighbors’ Motion to

Compel Arbitration. Doc. 24. Neighbors alleges that Plaintiffs Johnson, Beinart, Colley, and

Wilbur’s claims are subject to mandatory arbitration. Doc. 25 at 10. It therefore moves the

Court to compel arbitration for these four plaintiffs. Doc. 24 at 1. For the following reasons, the

Court grants in part, and denies in part without prejudice, Neighbors’ Motion to Compel

Arbitration. Doc. 24.

A. Standard

The Federal Arbitration Act (FAA) governs arbitration agreements. Hoffman v. Cargill

Inc., 236 F.3d 458, 461 (8th Cir. 2001). The FAA mandates broad enforcement of arbitration

provisions:

A written provision in . . . a contract evidencing a transaction involving commerce

to settle by arbitration a controversy thereafter arising out of such contract or

transaction . . . or an agreement in writing to submit to arbitration an existing

controversy arising out of such a contract, transaction, or refusal, shall be valid,

irrevocable, and enforceable, save upon such grounds as exist at law or in equity

for the revocation of any contract.

9 U.S.C. § 2. Likewise, it provides that:

A party aggrieved by the alleged failure, neglect, or refusal of another to arbitrate

under a written agreement for arbitration may petition any United States district

court which, save for such agreement, would have jurisdiction under title 28, in a

civil action or in admiralty of the subject matter of a suit arising out of the

controversy between the parties, for an order directing that such arbitration proceed

in the manner provided for in such agreement.

9 U.S.C. § 4.

The FAA establishes a “liberal federal policy favoring arbitration.” AT&T Mobility LLC

v. Concepcion, 563 U.S. 333, 339 (2011). Accordingly, “courts must place arbitration

agreements on an equal footing with other contracts” and enforce them according to their terms.

Id.; see also Morgan v. Sundance, Inc., 596 U.S. 411, 418 (2022) (“[A] court must hold a party

to its arbitration contract just as the court would to any other kind.”). But “[a] matter should not

be sent to arbitration unless there is a valid agreement to arbitrate and the underlying dispute falls

within the scope of that agreement.” Northport Health Servs. of Ark., LLC v. Posey, 930 F.3d

1027, 1030 (8th Cir. 2019) (quoting Telectronics Pacing Sys., Inc. v. Guidant Corp., 143 F.3d

428, 433 (8th Cir. 1998)). The Court, rather than the arbitrator, decides these substantive

questions of arbitrability unless the parties clearly delegated that issue to the arbitrator. First

Options of Chi., Inc. v. Kaplan, 514 U.S. 938, 944 (1995). Courts must address “questions of

arbitrability . . . with a healthy regard for the federal policy favoring arbitration.” Moses H. Cone

Mem’l Hosp. v. Mercury Constr. Corp., 460 U.S. 1, 24 (1983). “[A]ny doubts concerning the

scope of arbitrable issues should be resolved in favor of arbitration.” Id. at 24–25. And because

“arbitration is a matter of contract,” state-law contract principles govern the validity of an

arbitration agreement. Torres v. Simpatico, Inc., 781 F.3d 963, 968 (8th Cir. 2015) (citations

omitted). “If a valid and enforceable arbitration agreement exists under state-law contract

principles, any dispute that falls within the scope of that agreement must be submitted to

arbitration.” Id. (citation omitted).

The Eighth Circuit has instructed that a motion to compel arbitration should be “analyzed

under a standard akin to [that for] summary judgment.” Neb. Mach. Co. v. Cargotec Sols., LLC,

762 F.3d 737, 741 (8th Cir. 2014). Accordingly, the Court must view the evidence in the light

most favorable to the nonmoving party, resolving all factual disputes in their favor. Id. at 742.

The Court cannot compel arbitration where any genuine dispute of material fact remains as to

whether a valid arbitration agreement exists. Id.

B. Plaintiffs Johnson & Beinart

Because neither of these Plaintiffs nor Neighbors dispute what law applies, doc. 25 at 14–

17; doc. 30 at 14–17, the Court applies Missouri law, BBSerCo, Inc. v. Metrix Co., 324 F.3d 955,

960 n.3 (8th Cir. 2003). Plaintiffs Johnson and Beinart are both current Neighbors customers.

Doc. 21 at ¶¶ 181, 201. The Account Agreement that they signed nearly twenty years ago,

states:

By signing, the CU is authorized to make inquiries, view credit report or otherwise,

necessary to process the account also, by signing, the signers agree to the by-laws

of this Credit Union and applicable account terms and conditions, as amended from

time to time . . . .

Doc. 25-2 at 2 (Johnson’s Account Agreement); doc. 25-3 at 2 (Beinart’s Account Agreement).

Fast forward to March 2020: Neighbors mailed its customers a Notice of Amendment to

Neighbors Credit Union Membership and Account Agreement (“Notice of Amendment”). Doc.

25-4. The Notice of Amendment stated that, after the effective date, a new account agreement—

the Membership and Account Agreement—will replace customers’ Account Agreement with

Neighbors. Id. The Notice of Amendment also gave recipients notice of the Membership and

Account Agreement’s arbitration provision:

On the Effective Date, your Account(s) will be subject to a mandatory arbitration

provision and you will no longer be able to elect to resolve any disputes related to

your Account(s) in court or resolve a dispute through a class action . . . . . If you

do not want to agree to mandatory arbitration and class action waiver contact

Neighbors Credit Union . . ., in writing, that You reject this arbitration provision

within thirty (30) days of receiving this arbitration provision, including Your name,

as listed on Your account, Your account number, and a statement that You reject

this arbitration provision.

Doc. 25-4 at 2; see also doc. 25-5 at 8–9 (Membership and Account Agreement). Neighbors

argues that because Johnson and Beinart failed to opt out of the arbitration provision, doc. 25 at

15; see also doc. 25-1 at ¶ 10, they must arbitrate their claims against Neighbors.

Plaintiffs argue in response that: (i) Neighbors failed to produce the original agreements

that established its right to amend the original Account Agreement, (ii) even if Neighbors

produced the original agreements, a unilateral right to amend is unenforceable, and

(iii) Neighbors failed to provide evidence that Johnson and Beinart received notice of the

Membership and Account Agreement. Doc. 30 at 14–16. The Court addresses each argument

in turn.

First, Plaintiffs argue that Neighbors failed to produce the original agreements. Doc. 30

at 14–15. But as Neighbors notes, doc. 31 at 2–3, it produced the original Account Agreements

that gave it a unilateral right to amend, see docs. 25-2, 25-3.

Then Plaintiffs argue that Neighbors’ Notice of Amendment operated as an

unenforceable, unilateral amendment to the original Account Agreement. Doc. 30 at 15. And

because Neighbors doesn’t have an independent contractual right to retroactively amend the

original Account Agreement, the Amended Agreement doesn’t bind Johnson and Beinart. Id.

Neighbors disagrees: first, the plain terms of their Account Agreement contemplated

amendment. Doc. 31 at 2–3; see also doc. 25-3 at 2 (“[B]y signing, the signers agree to the by-

laws of this Credit Union and applicable account terms and conditions, as amended from time to

time . . . .”). Second, Neighbors states that it is not “attempting to compel arbitration as to any

matter that predated the amendment.” Doc. 31 at 4. Instead, Neighbors seeks only to compel

arbitration as to issues arising from a data breach that “occurred more than four years after the

arbitration provision was incorporated into the agreement.” Id.; see Patrick v. Altria Grp.

Distrib. Co., 570 S.W.3d 138, 143–44 (Mo. Ct. App. 2019) (holding that consideration

supporting a unilateral right to amend is not illusory when it applies prospectively and advance

notice is given).

Thus, the crux of the matter is whether Johnson and Beinart received the Notice of

Amendment, which gave them thirty days to opt out of arbitration provision. Arbitration

agreements, like all contracts, require three essential elements: (i) offer, (ii) acceptance, and (iii)

consideration. Bridgecrest Acceptance Corp. v. Donaldson, 648 S.W.3d 745, 752–54 (Mo.

2022) (citation omitted). “An offer may . . . be accepted by the offeree’s conduct or failure to

act.” Citibank (S.D.), N.A. v. Wilson, 160 S.W.3d 810, 813 (Mo. Ct. App. 2005).

If Johnson and Beinart received the Notice of Amendment, failed to opt out of the

arbitration provision, yet continued using their accounts, then they accepted the arbitration

provision in the Membership and Account Agreement. Id. (“If this party receives the benefit of

the services in silence, when there was a reasonable opportunity to reject them, this party is

manifesting assent to the terms proposed and thus accepts the offer.”); see Cicle v. Chase Bank

USA, 583 F.3d 549, 555 (8th Cir. 2009) (holding that an arbitration agreement that was deemed

accepted by failure to opt out not unconscionable under Missouri law); cf. Lopez v. H & R Block,

Inc., 491 S.W.3d 221, 227 (Mo. Ct. App. 2016) (refusing to compel arbitration when customer

properly opted out of the arbitration provision).

Simply put, Johnson and Beinart’s receipt of the Notice of Amendment coupled with

their continued use of their accounts can constitute acceptance of the arbitration provision. See 1

Corbin on Contracts § 3.18 (2026) (“Often, however, silence coupled with conduct . . . can

reasonably be understood by the offeror as an acceptance.”); 2 Williston on Contracts § 6:71 (4th

ed.) (stating that an offeree’s silence constitutes acceptance when the “offeree, by previous

words or conduct, has led the offeror to believe that by remaining silent in this particular case it

nevertheless intends to accept”); Restatement (Second) of Contracts § 69(1)(a) (A.L.I. 1981)

(“Where an offeree fails to reply to an offer, his silence and inaction operate as an acceptance

. . . [w]here an offeree takes the benefit of offered services with reasonable opportunity to reject

them and reason to know that they were offered with the expectation of compensation.”). The

parties agree that Johnson and Beinart never opted out of the arbitration provision. Doc. 25 at

12; see doc. 30 at 14. The Court therefore addresses whether Johnson and Beinart received the

Notice of Amendment.

Missouri law presumes receipt of duly mailed materials. Am. Fam. Mut. Ins. Co. v. Vein

Ctrs. for Excellence, Inc., 912 F.3d 1076, 1083 (8th Cir. 2019) (citing Ins. Placements, Inc. v.

Utica Mut. Ins. Co., 917 S.W.2d 592, 595 (Mo. Ct. App. 1996)). For Neighbors to properly raise

this presumption, it must introduce evidence that the “letter was properly addressed, stamped,

and placed in the mail.” Crutcher v. MultiPlan, Inc., 22 F.4th 756, 767 (8th Cir. 2022).

“[E]vidence of the settled custom and usage of the sender in the regular and systematic

transaction of its business gives rise to this presumption.” Id. (citation modified). If Neighbors

properly raises this presumption, then Plaintiffs can rebut with evidence that “it was not, in fact,

received.” Id. (citation omitted). “Evidence of non-receipt, however, does not nullify the

presumption but leaves the question for the determination of the jury under all of the facts and

circumstances of the case.” Id. (citation omitted).

Here, Neighbors filed a declaration by its Chief Financial Officer—Janice Bennett—

stating that, “[o]n or about March 25, 2020,” Neighbors mailed “all then-current members,

including Plaintiffs Johnson and Beinart” the Notice of Amendment and the Membership and

Account Agreement. Doc. 25-1 at ¶¶ 7–8; see also doc. 31-1 at ¶¶ 4–8 (explaining Neighbors’

“customary and regular practice to use a third-party vendor for printing and mailing”). Bennett

stated she reviewed records “kept in the ordinary course of [Neighbors’] regularly conducted

business activities,” doc. 25-1 at ¶ 2, and “Johnson and Beinart did not notify [Neighbors] in

writing that they desired to opt out of the arbitration provision,” id. at ¶ 10. Bennett further

states that Neighbors never received any returned mail for Johnson or Beinart. Doc. 31-1 at ¶ 9;

cf. id. at ¶¶ 11–12 (noting that Neighbors mailed the notice of data breach letter to Johnson and

Beinart at the same addresses); doc. 21 at ¶¶ 181, 201 (noting that Johnson and Beinart received

Neighbors’ notice of breach letter). The Court finds that Neighbors properly raised the

presumption that Johnson and Beinart received the Notice of Amendment. See Am. Fam. Mut.

Ins. Co., 912 F.3d at 1083.

To rebut, Plaintiffs filed identical declarations signed by Johnson and Beinart denying

receipt. Docs. 30-1, 30-2. While Plaintiffs’ denials of receipt are insufficient to rebut the

presumption, they do create a genuine dispute of material fact. Kohler v. Anderson, 986 F.2d

503, *1 (8th Cir. 1993); see also Stephenson v. El-Batrawi, 524 F.3d 907, 913 (8th Cir. 2008).

As stated above, the Eighth Circuit instructs district courts to analyze a motion to compel

arbitration “under a standard akin to [a motion for] summary judgment.” Neb. Mach. Co., 762

F.3d at 741. Accordingly, the Court must view the evidence in the light most favorable to the

nonmoving parties, resolving all factual disputes in their favor. Id. at 743. And the Court cannot

compel arbitration where any genuine dispute of material fact remains as to whether a valid

arbitration agreement exists. Id.

Applying this standard, the Court finds that Johnson and Beinart raise a genuine dispute

of material fact regarding their receipt of the Notice of Amendment. Id. The Court accordingly

denies Neighbors’ Motion to Compel Arbitration as to Johnson and Beinart.

The FAA provides: “If the making of the arbitration agreement or the failure, neglect, or

refusal to perform the same be in issue, the court shall proceed summarily to the trial thereof.” 9

U.S.C. § 4; see also Neb. Mach. Co., 762 F.3d at 744.

The Eighth Circuit has observed that, in an appropriate case, “the [FAA’s] summary trial

can look a lot like summary judgment.” Neb. Mach. Co., 762 F.3d at 743. Although the Court

analyzed Neighbors’ Motion to Compel Arbitration under a summary-judgment standard, the

parties briefed the motion without the benefit of discovery. After a reasonable period of

discovery, perhaps no genuine dispute of material fact will remain. So, the Court denies

Neighbors’ present Motion to Compel Arbitration without prejudice, and the Court enters a

separate order governing the limited discovery.

C. Plaintiffs Colley & Wilbur

Plaintiffs Colley and Wilbur are not Neighbors’ customers—at least not traditional

banking customers. Neighbors seeks to compel arbitration for Colley and Wilbur based on the

arbitration clauses in their secured-vehicle-loan contracts, of which as explained above,

Neighbors is the assignee. Doc. 25 at 17–21; see supra Part I.

1. Choice of law

The Court first addresses a choice-of-law issue. As noted, before compelling arbitration,

a court first determines whether a valid arbitration agreement exists. Robinson v. EOR-ARK,

LLC, 841 F.3d 781, 783–84 (8th Cir. 2016). And when determining that question, courts look to

state-law contract principles. Torres, 781 F.3d at 968. Here, the parties dispute what law applies

to Colley and Wilbur’s alleged arbitration agreements. See docs. 25 at 30, 30 at 13, 31 at 2.

“[F]ederal courts in diversity of citizenship cases are governed by the conflict of laws

rules of the courts of the states in which they sit.” Griffin v. McCoach, 313 U.S. 498, 503 (1941)

(citing Klaxon Co. v. Stentor Elec. Mfg. Co., 313 U.S. 487, 496–97 (1941); see also Day &

Zimmermann, Inc. v. Challoner, 423 U.S. 3, 4 (1975) (reaffirming Klaxon Co., 313 U.S. at 496–

97). Missouri applies the “Restatement (Second) of Conflict of Laws” to determine what law

applies. Ameristar Jet Charter, Inc. v. Dodson Int’l Parts, Inc., 155 S.W.3d 50, 58 (Mo. 2005);

see also Fruin-Colnon Corp. v. Mo. Highway & Transp. Comm’n, 736 S.W.2d 41, 44 (Mo.

1987) (applying the Restatement (Second) of Conflict of Laws); Est. of Brown, 955 S.W.2d 940,

944–45 (Mo. Ct. App. 1997) (“Missouri follows the Restatement (Second) Conflict of Laws in

contract actions.”). And under section 187, “[t]he law of the state chosen by the parties to

govern their contractual rights and duties will be applied.” Est. of Brown, 955 S.W.2d at 945

(citing Restatement (Second) of Conflict of Laws § 187 (A.L.I. 1971)); Eagle Tech. v. Expander

Ams., Inc., 783 F.3d 1131, 1137 (8th Cir. 2015) (“Under Missouri law, a choice-of-law clause in

a contract generally is enforceable . . . .”).

Here, Colley signed a secured-vehicle-loan contract with a Tennessee choice-of-law

provision. Doc. 25-7 at 3. Wilbur signed a secured-vehicle-loan contract with an Alabama

choice-of-law provision. Doc. 25-9 at 2. The Court therefore applies Tennessee law to Colley’s

contract and Alabama law to Wilbur’s contract. Est. of Brown, 955 S.W.2d at 945 (citing

Restatement (Second) of Conflict of Laws § 187 (A.L.I. 1971)); Eagle Tech., 783 F.3d at 1137.

2. Colley and Wilbur’s secured-vehicle-loan contracts were validly

assigned to Neighbors

Neighbors seeks to compel arbitration with Colley and Wilbur based on the arbitration

clauses in their secured-vehicle-loan contracts. Doc. 25 at 17–18. Plaintiffs, however, argue that

the Court cannot compel arbitration because Neighbors failed to prove each assignment in the

chain. Doc. 30 at 18. In response, Neighbors argues that “the chain is clear,” and “Plaintiffs

attempt to introduce confusion where there is none.” Doc. 31 at 6. As noted above, the Court

finds that Neighbors has sufficiently demonstrated that it is the assignee of these contracts. See

supra Part I.

Tennessee and Alabama both permit the assignee of a valid arbitration agreement to

enforce those agreements and compel arbitration. Blue Water Bay at Ctr. Hill, LLC v. Hasty, No.

M2016-02382-COA-R3-CV, 2017 WL 5665410, at *6 (Tenn. Ct. App. Nov. 27, 2017); Ocwen

Loan Servicing, LLC v. Washington, 939 So. 2d 6, 9–10 (Ala. 2006). Neighbors, as the assignee

of Colley and Wilbur’s loans, may enforce the arbitration clauses in those contracts. Blue Water

Bay, 2017 WL 5665410, at *6; Ocwen, 939 So. 2d at 9–10. The Court now turns to address

whether Colley and Wilbur’s claims fall within the scope of their arbitration clauses contained in

their secured-vehicle-loan contracts. See Torres, 781 F.3d at 968.

3. Colley and Wilbur’s disputes fall within the scope of the arbitration

clauses in their secured-vehicle contract loans

The Court analyzes the scope of the arbitration clauses. While “state contract law

governs the threshold question of whether an enforceable arbitration agreement exists,” federal

law governs whether Colley and Wilbur’s dispute “falls within the scope of the arbitration

agreement.” Donaldson Co. v. Burroughs Diesel, Inc., 581 F.3d 726, 731 (8th Cir. 2009)

(citation omitted). The Court starts with Colley’s secured-vehicle-loan contract. Colley agreed

to arbitrate:

[A]ny claim, dispute, or controversy relating to this agreement and/or any other

dispute with dealer including employees and agents, including claims involving the

applicability of this arbitration clause or the validity of the entire agreement, shall

be resolved by binding arbitration.

Doc. 25-8 at 2. Neighbors argues that because it obtained Colley’s PII “in connection with its

business activities, which included the purchase of Colley’s vehicle loan . . . ., Colley’s claims

‘clearly relate to the agreement.’” Doc. 25 at 19.

The Court agrees. The Eighth Circuit has explained that the phrase “arising out of or

relating to” captures all claims that have “some logical connection” to the agreement. Vondeylen

v. Aptive Env’t, LLC, No. 24-3578, 2026 WL 621880, at *1 (8th Cir. Mar. 5, 2026). Colley

agreed to arbitrate “any claim . . . relating to this agreement and/or any other dispute with

dealer.” Doc. 25-8 at 2. Colley asserted that Neighbors obtained his PII “pursuant to

[Neighbors’] business and/or banking activities.” Doc. 21 at ¶ 105. And the Court has found

that Neighbors is the proper successor in interest to “dealer.” The Court therefore finds that

Colley’s claims fall within the scope of the arbitration clause. See Torres, 781 F.3d at 968.

Similarly, Wilbur’s arbitration clause states:

You and we agree that any claim or dispute, whether in contract, tort, statute or

otherwise . . ., between you and us or our employees, agents, successors, or assigns,

which arises out of or relates to your credit application, purchase, lease, or condition

of the vehicle, any retail installment sale contract or lease agreement or any

resulting transaction or relationship . . . shall, at your or our election, be resolved

by neutral, binding arbitration . . . .

Doc. 25-10 at 2. Here too, Wilbur agreed that “any claim or dispute . . . between you and us

or . . . successors, or assigns, which arises out of or relates to . . . any resulting transaction or

relationship . . . shall . . . be resolved by neutral, binding arbitration.” Doc. 25-10 at 2. This

broad language encompasses Wilbur’s claim, which relates to a resulting transaction or

relationship with a successor in interest—Neighbors. Vondeylen, 2026 WL 621880, at *1. The

Court therefore finds that Colley’s claims fall within the scope of the arbitration clause. See

Torres, 781 F.3d at 968.

So, because Neighbors has valid and enforceable arbitration agreements with Colley and

Wilbur, respectively, and because this dispute falls within the scope of the agreements, the Court

grants Neighbors’ Motion to Compel as to these plaintiffs. Doc. 24. Four Plaintiffs without

arbitration agreements remain in this case, so the Court now turns to Neighbors’ Motion to

Dismiss.

V. Motion to dismiss

A. Legal standard

Under Federal Rule of Civil Procedure 12(b)(6), a party may move to dismiss a claim for

“failure to state a claim upon which relief can be granted.” The pleading standard of

Rule 8(a)(2) requires a plaintiff to give “a short and plain statement . . . showing that the pleader

is entitled to relief.” Fed. R. Civ. P. 8(a)(2). To meet this standard and to survive a

Rule 12(b)(6) motion to dismiss, “a complaint must contain sufficient factual matter, accepted as

true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678

(2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). This requirement of

facial plausibility means the factual content of the plaintiff’s allegations must “allow[] the court

to draw the reasonable inference that the defendant is liable for the misconduct alleged.”

Whitney v. Guys, Inc., 700 F.3d 1118, 1128 (8th Cir. 2012) (quoting Iqbal, 556 U.S. at 678). The

Court must grant all reasonable inferences in favor of the nonmoving party. Lustgraaf v.

Behrens, 619 F.3d 867, 872–73 (8th Cir. 2010).

When ruling on a motion to dismiss, a court “must liberally construe a complaint in favor

of the plaintiff.” Huggins v. FedEx Ground Package Sys., Inc., 592 F.3d 853, 862 (8th Cir.

2010). But if a claim fails to allege one of the elements necessary to recover on a legal theory,

the Court must dismiss that claim for failure to state a claim upon which relief can be granted.

See Crest Constr. II, Inc. v. Doe, 660 F.3d 346, 355 (8th Cir. 2011). “Threadbare recitals of the

elements of a cause of action, supported by mere conclusory statements, do not suffice.” Iqbal,

556 U.S. at 678; see also Twombly, 550 U.S. at 555. Nor does a “pleading that merely pleads

‘labels and conclusions,’ or a ‘formulaic recitation’ of the elements of a cause of action, or

‘naked assertions’ devoid of factual enhancement” suffice. Hamilton v. Palm, 621 F.3d 816, 817

(8th Cir. 2010) (quoting Iqbal, 556 U.S. at 678). Although courts must accept all factual

allegations as true, they are not bound to take as true a legal conclusion couched as a factual

allegation. Twombly, 550 U.S. at 555; Iqbal, 556 U.S. at 677–78.

Only a complaint that states a plausible claim for relief survives a motion to dismiss.

Iqbal, 556 U.S. at 679. Therefore, the Court must determine if the well-pleaded factual

allegations “plausibly give rise to an entitlement to relief.” Id. This “context-specific task”

requires the Court to “draw on its judicial experience and common sense.” Id.

B. Discussion

The Court only decides Neighbors’ Motion to Dismiss for the four Plaintiffs it has not yet

addressed: Hollis, Short-Shumate, Beatty Jr., and Putney. Plaintiffs allege six common-law

counts of: (i) negligence, see doc. 21 at ¶¶ 274–306, (ii) negligence per se, see id. at ¶¶ 307–20,

(iii) breach of implied contract, see id. at ¶¶ 321–32, (iv) unjust enrichment, see id. at ¶¶ 333–43,

(v) breach of confidence, see id. at ¶¶ 344–55, and (vi) invasion of privacy, see id. at ¶¶ 356–73.

The Court notes that because neither party disputes what law applies for the remaining four

plaintiffs, doc. 25 at 30; doc. 30 at 26, the Court applies Missouri law, BBSerCo, Inc., 324 F.3d

at 960 n.3. For the reasons stated below, the Court grants Neighbors’ Motion. Doc. 24.

1. Negligence

While negligence has four elements, the Court focuses on whether Neighbors owed the

duty these Plaintiffs claim. Finding no such duty exists under Missouri law, the Court dismisses

Plaintiffs’ negligence claim.

a. Duty

Plaintiffs allege various theories of Neighbors’ duty to safeguard Plaintiffs’ PII. First,

because Neighbors “required, collected, possessed, and maintained” Plaintiffs’ PII, Plaintiffs

claim it had a “duty to exercise reasonable care in safeguarding” such PII from misuse. Doc. 21

at ¶¶ 275–77. Second, Plaintiffs allege Neighbors owed a duty to exercise reasonable care based

on their “special relationship.” Id. at ¶ 281. Third, they allege it owed Plaintiffs a statutory duty

to protect their PII under a negligence-per-se theory. Id. at ¶¶ 279–80.

“Whether a duty exists is purely a question of law.” State ex rel. Tyler Techs., Inc. v.

Chamberlain, 679 S.W.3d 474, 477 (Mo. 2023) (quoting Tharp v. St. Luke’s Surgicenter-Lee’s

Summit, LLC, 587 S.W.3d 647, 654 (Mo. 2019)). Thus, the Court can properly resolve the

question of duty on a motion to dismiss. See Nat’l Union Fire Ins. Co. of Pittsburgh, Pa. v.

Raczkowski, 764 F.3d 800, 802 (8th Cir. 2014) (affirming the dismissal of a negligence claim for

lack of duty under Missouri law).

In Missouri, a duty of care arises when: (i) “prescribed by the legislature,” (ii) “the

common law imposes a duty based on the relationship between the parties, or because under a

particular set of circumstances a party must exercise due care to avoid foreseeable injury,” or (iii)

“a party has assumed a duty by contract or conduct.” Scales v. Whitaker, 615 S.W.3d 425, 431

(Mo. Ct. App. 2020). “The touchstone for the creation of a duty is foreseeability.” Wielandv.

Owner-Operator Servs., Inc., 540 S.W.3d 845, 848 (Mo. 2018).

Typically, Courts do not impose a duty on businesses to “protect against the criminal acts

of third parties,” because criminal acts are “rarely foreseeable.” Id.;L.A.C. ex rel. D.C. v. Ward

Parkway Shopping Ctr. Co., L.P., 75 S.W.3d 247, 257 (Mo. 2002) (citing Madden v. C & K

Barbecue Carryout, Inc., 758 S.W.2d 59, 62 (Mo. 1988)). The Supreme Court of Missouri,

however, recognizes an exception when a “special relationship exists between the parties.” J.M.

v. Shell Oil Co., 922 S.W.2d 759, 765 (Mo. 1996). Missouri has recognized the following

special relationships: “innkeeper-guest, common carrier-passenger, [and] school-student . . . .”

Earley v. Dunn, 670 S.W.3d 47, 52 (Mo. Ct. App. 2023).

The parties dispute whether Missouri law recognizes a special relationship between

Plaintiffs and Neighbors. See doc. 25 at 31–32, doc. 31 at 10–11; see also doc. 30 at 27–28.

Much of their dispute hinges on whether the Court should follow the approach of Mackey, 2021

WL 3363174 at *6–7. In Mackey, the court found that an employer owes its employees a duty of

care to protect employee PII due to the special “employer-employee relationship.” Id. At the

time, Missouri case law indicated that a special relationship between an employer and employee

can exist, see id., but since then, the Missouri Court of Appeals noted that its past statements

were dicta, see Earley, 670 S.W.3d at 53. Moreover, unlike in Mackey, Plaintiffs never had an

employer-employee relationship with Neighbors. See doc. 21.

Mackey therefore offers Plaintiffs little support. Unlike in Mackey, Plaintiffs do not

possess a single, recognized special relationship with Neighbors. Here, Hollis and Short-

Shumate are former customers. Id. at ¶¶ 159, 238. And they allege Neighbors obtained Beatty

Jr. and Putney’s PII through Neighbors’ undefined business and banking activities. Id. at ¶¶ 123,

223. While Putney alleges that she had a line of credit maintained by Neighbors, id. at ¶ 122,

Beatty Jr.’s exact relationship with Neighbors goes unexplained in Plaintiffs’ Complaint. See id.

at ¶¶ 222–37. Plaintiffs have not cited, nor has the Court found, a Missouri court that imposed a

duty based on a special relationship between a business and former customers, or between a

business and individuals with an opaque relationship to the business. Plaintiffs also cite to

Baldwin v. Nat’l W. Life Ins. Co., No. 2:21-cv-04066-WJE, 2021 WL 4206736, at *3–4 (W.D.

Mo. Sept. 15, 2021) for support. But Baldwin didn’t address whether plaintiffs owed a common

law duty of care. Id. at *2–4.

Federal courts sitting in diversity should not expand state law “in ways not foreshadowed

by state precedent,” Ashley Cnty. v. Pfizer, Inc., 552 F.3d 659, 673 (8th Cir. 2009), because

courts “sitting in diversity do not create state law,” Crozier v. Wint, 736 F.3d 1134, 1138–39 (8th

Cir. 2013). In the absence of direct Missouri precedent, the Court must predict, to the best of its

ability, how the Supreme Court of Missouri would rule. See Salier v. Walmart, Inc., 76 F.4th

796, 801 (8th Cir. 2023).

Before extending a legal duty to a novel set of facts, the Court must exercise caution. In

National Union, an insurance company sued a bank for negligence after the bank failed to

inquire into whether an employee had the authority to open an account on the employer’s behalf.

Nat’l Union, 764 F.3d at 801–802. The district court dismissed the complaint for failure to state

a claim because the bank owed no duty to the employer. Id. And the Eighth Circuit affirmed.

Id. For the proposition that the Supreme Court of Missouri would recognize a duty, the

insurance company relied on a Supreme Court of Missouri decision that was “materially

different” from the case at hand and “limited in scope” compared to the insurance company’s

proposed duty. Id. at 804. To extend that precedent to the case before it, the court held, would

be to establish a rule with “no practical limitation.” Id. at 805.

Here, Plaintiffs fail to convince the Court that the Supreme Court of Missouri would

recognize a special relationship between Neighbors and Plaintiffs on these facts. See Nat’l

Union, 764 F.3d at 806. The Court finds that—on this record—Neighbors does not owe

Plaintiffs a duty of care. The Court therefore grants Neighbors’ motion to dismiss Plaintiffs’

negligence claim.

2. Negligence per se

To assert a negligence-per-se claim, Plaintiffs must plausibly plead, among other

elements, that Neighbors violated a statute or regulation. Parr v. Breeden, 489 S.W.3d 774, 781

(Mo. 2016). Here, Plaintiffs rely on section 5 of the Federal Trade Commission Act (FTCA) to

establish their claim. See doc. 21 at ¶¶ 307–320. But under Missouri law, only statutes that

create a private cause of action can serve as the basis of a negligence-per-se claim. Howland v.

Truman Med. Ctr., Inc., 719 S.W.3d 98, 109 (Mo. Ct. App. 2025) (citing Bradley v. Ray, 904

S.W.2d 302, 314 (Mo. App. W.D. 1995)). And “[t]he FTCA creates no private right of action.”

In re SuperValu, 925 F.3d 955, 963 (8th Cir. 2019). Plaintiffs also do not cite any case law that

recognizes a negligence-per-se action based on a duty supplied by federal law. See doc. 30; cf.

Parr, 489 S.W.3d at 780–81 (stating that state law doesn’t support imposing an independent,

personal duty in a negligence action based on a federal regulation). The Court therefore grants

Neighbors’ motion to dismiss Plaintiffs’ negligence-per-se claim.

3. Breach of implied contract

To assert a breach-of-implied contract claim, Plaintiffs must plausibly plead that they had

an implied contract with Neighbors, and it breached the contract. Westerhold v. Mullenix Corp.,

777 S.W.2d 257, 263 (Mo. Ct. App. 1989). An implied contract—unlike an express contract—

exists when the parties’ make mutual promises by words or conduct rather than by written text.

Id. But like any contract, consideration must support the parties’ mutual promises. See

Bridgecrest Acceptance Corp., 648 S.W.3d at 752–53; Westerhold, 777 S.W.2d at 263 (citing

Bailey v. Interstate Airmotive, 219 S.W.2d 333, 1132 (1949) (“There is no difference in legal

effect between an express contract and one implied in fact. The distinction lies merely in the

manner of manifesting mutual assent.”)); see also 17A Am. Jur. 2d Contracts § 14 (stating that a

“contract implied in fact must embody all the elements of an express contract”). The Court must

find that “there was a meeting of the minds on the agreement’s essential elements,” that the

parties’ intended “to enter into a contract upon defined terms,” and that Plaintiffs “relied in good

faith upon the alleged contract.” Nickel v. Stephens Coll., 480 S.W.3d 390, 397 n.6 (Mo. Ct.

App. 2015) (citing 17A Am. Jur. 2d Contracts § 14).

Plaintiffs contend that Neighbors made several implied promises to them. Doc. 21 at

¶ 327. At bottom, Plaintiffs argue that Neighbors impliedly promised to reasonably protect their

PII. Id. For consideration, Plaintiffs state that they paid Neighbors money or turned over PII in

return for its implied promise to securely maintain their PII. Id. at ¶ 324. And Neighbors

breached this implied contract or series of implied contracts when it failed to “employ reasonable

and adequate security measures” to secure their PII. Id. at ¶ 331.

Neighbors responds that Plaintiffs failed to plead that any meeting of the minds occurred

as to the essential terms. Doc. 25 at 35. The Court agrees. Plaintiffs state, in a conclusory

manner, that they “formed implied contracts with Neighbors regarding the provision of those

services through their collective conduct.” Doc. 21 at ¶ 322. But Plaintiffs’ Complaint does not

clarify how or when they plausibly formed these implied contracts through their collective

conduct. See doc. 21. As noted above, Hollis and Short-Shumate are former Neighbors

customers. Id. at ¶¶ 159, 238. And Beatty Jr. and Putney state that Neighbors obtained their PII

through its business and banking activities . Id. at ¶¶ 123, 223. Plaintiffs fail to plausibly plead

how these Plaintiffs—with such vaguely-stated relationships to Neighbors—could have “formed

implied contracts . . . through their collective conduct.” See id. at ¶ 322.

Plaintiffs also failed to plausibly plead that Neighbors, in fact, impliedly assented to

protect their PII as part of its services. Plaintiffs only plead that “Plaintiffs formed implied

contracts with Neighbors” by “paying for services.” Id. at ¶ 322. They don’t sufficiently plead a

“meeting of the minds” to protect their PII as part of Neighbors’ services. See Nickel, 480

S.W.3d at 397 n.6. Rather, Plaintiffs allege that by “delivering their [PII] to Neighbors and/or

paying for service,” Plaintiffs “intended and understood that Neighbors would adequately

safeguard [their PII] as part of that service.” Doc. 21 at ¶ 326.

But Plaintiffs don’t plausibly plead that Neighbors had the same intent or understanding,

or agreed to Plaintiffs’ unexpressed intentions. See doc. 21. While Plaintiffs “need not set forth

detailed factual allegations, or specific facts that describe the evidence to be presented, the

complaint must include sufficient factual allegations to provide the grounds on which the claim

rests.” Warmington v. Bd. of Regents, 998 F.3d 789, 795–96 (8th Cir. 2021) (citation modified).

Because Plaintiffs failed to plausibly plead that “a meeting of the minds [existed] on the

agreement’s essential elements,” see Nickel, 480 S.W.3d at 397 n.6, the Court grants Neighbors’

motion to dismiss Plaintiffs’ breach-of-implied-contract claim.

4. Unjust enrichment

To state an unjust-enrichment claim, Plaintiffs must plausibly plead that: (i) Plaintiffs

enriched Neighbors by conferring a benefit, (ii) that its enrichment came at Plaintiffs’ expense,

and (iii) that it would be unjust to allow Neighbors to retain the benefit. See Beeler v. Martin,

306 S.W.3d 108, 112 (Mo. Ct. App. 2010). Plaintiffs contend that they conferred a benefit on

Neighbors when they exchanged their PII for adequate cybersecurity protection. Doc. 21 at

¶ 335. And they also contend that a portion of the revenue made from Plaintiffs’ contribution

should have gone to providing adequate cybersecurity protection. Id. at ¶ 336. But instead

Neighbors retained the revenue it should have been spent on protecting Plaintiffs’ PII. Id. at

¶ 337. And Plaintiffs alleged various harms resulting from Neighbors’ alleged enrichment. Id. at

¶ 341. Plaintiffs therefore conclude that it’s unjust to allow Neighbors to “retain the benefit of its

wrongful conduct.” Id. at ¶ 340.

The Court disagrees. Plaintiffs allege, in a conclusory manner, that they conferred a

benefit on Neighbors when they exchanged their PII for adequate cybersecurity information.

Doc. 21 at ¶ 335. But they provide no well-pleaded facts from which the Court can plausibly

infer that, in fact, such an exchange plausibly occurred. See doc. 21. And without sufficient

well-pleaded facts to support their claim, the Court finds it implausible that Plaintiffs—with such

vaguely-stated relationships to Neighbors—exchanged their PII for adequate cybersecurity

information. Warmington, 998 F.3d at 795–96 (holding that a district court need not “conjure up

unpled allegations to save a complaint”).

Plaintiffs may have paid for financial services. But Plaintiffs fail to plausibly plead that

they paid “a premium for a side order of data security.” SuperValu, 925 F.3d at 966 (cleaned

up). Nor do they plausibly allege that “any specific portion of [their] payment went toward data

protection.” Id.; see also Carlsen v. GameStop, Inc., 833 F.3d 903, 912 (8th Cir. 2016) (finding

that because plaintiff did not allege that a specific portion of his subscriber fee went toward data

protection, he failed to allege a benefit conferred in exchange for his PII). Because Plaintiffs

don’t plausibly allege that a specific portion of their payment went towards data protection, see

doc. 21 at ¶ 337 (alleging only that some portion “should have been used for adequate

cybersecurity practices”) (emphasis added)). The allegations don’t plausibly suggest that

Neighbors received some benefit in exchange for providing data security. SuperValu, 925 F.3d

at 966; Carlsen, 833 F.3d at 912). The Court therefore grants Neighbors’ motion to dismiss

Plaintiffs’ unjust-enrichment claim.

5. Breach of confidence

Plaintiffs assert that Neighbors breached their confidence by failing to adequately protect

their PII. See id. at ¶¶ 344–55. Neighbors asserts that Missouri courts don’t recognize a

breach-of-confidence claim outside of the disclosure-of-trade-secrets context. Doc. 25 at 38.

The Court agrees with Neighbors. The Court has not found any cases applying a breach of

confidence claim to an analogous context. See Mackey, 2021 WL 3363174 at *9 (finding that

“Missouri courts have only recognized the validity of this claim in the trade secret context”).

The Court declines to extend state law “in ways not foreshadowed by state precedent.” Ashley

Cnty., 552 F.3d at 673. The Court grants Neighbors’ motion to dismiss Plaintiffs’

breach-of-confidence claim.

6. Invasion of privacy

Finally, to assert a claim for the public disclosure of private facts, Plaintiffs must

plausibly plead that Neighbors: (i) “publication or publicity,” (ii) “absent any waiver or

privilege,” (iii) “of private matters in which the public has no legitimate interests,” (iv) “so as to

bring shame or humiliation to a person of ordinary sensibilities.” Balke v. Ream, 33 S.W.3d 589,

594 (Mo. Ct. App. 2000). The Court notes that Plaintiffs refer to Neighbors’ intentional

disclosure of “PII and PHI[,]” though they don’t define “PHI.” See doc. 21 at ¶¶ 367–69.

Plaintiffs similarly don’t allege with any particularity that Neighbors possessed their “PHI,”

which the Court takes to mean their private health information. See doc. 21.

Though Plaintiffs allegedly suffered the theft of their PII, and perhaps their PHI, the facts

don’t fit their legal theory. See Negron v. Ascension Health, No. 4:24-cv-00669, 2025 WL

2710014 at *13 (E.D. Mo. Sept. 23, 2025). Neighbors didn’t intentionally publish Plaintiffs’ PII

(or, for that matter, any PHI, assuming Neighbors had any); hackers did. See id. Plaintiffs’

attempt to impute the hackers conduct to Neighbors due to its allegedly inadequate security

“essentially reprise[s] [Plaintiffs’] negligence claim.” See id.

And even assuming that one could consider a hacker’s post on the Dark Web to be a

common-law “publication,” the Court remains unpersuaded that the published information would

shame or humiliate the reasonable person. See Restatement (Second) of Torts § 652D, cmt. c

(1977) (“Complete privacy does not exist in this world except in a desert, and anyone who is not

a hermit must expect and endure the ordinary incidents of the community life.”); see also Y.G. v.

Jewish Hosp. of St. Louis, 795 S.W.2d 488, 498 (Mo. Ct. App. 1990) (holding that “the elements

and scope of [a public-disclosure-of-private-facts claim], recognized in Missouri, are embodied

in the Restatement (Second) of Torts”). The PII in this case, while sensitive, doesn’t approach

the sort of intimate information that this claim covers. See, e.g., Y.G., 795 S.W.2d at 502–503

(holding that a patient pleaded a public-disclosure-of-private-facts claim when the hospital

disclosed her IVF treatment to the media). The Court therefore grants Neighbors’ motion to

dismiss Plaintiffs’ invasion-of-privacy claim.

VI. Conclusion

Accordingly, the Court finds that, at this stage, Plaintiffs have standing to survive

Neighbors’ Motion to Dismiss under Rule 12(b)(1). But after some discovery, the Court may

revisit its decision. The Court also grants in part, and denies in part without prejudice,

Neighbors’ [24] Motion to Compel Arbitration. The Court will allow the parties a reasonable

period of time to engage in limited discovery—on the terms to set out in a separate order—

limited to the issue of Johnson and Beinart’s receipt of the Notice of Amendment. Finally, the

Court grants Neighbors’ [24] Motion to Dismiss, and dismisses without prejudice Plaintiffs

Hollis, Short-Shumate, Beatty Jr., and Putney. A separate order of dismissal accompanies this

Memorandum and Order.

So ordered this 30th day of March 2026.

STEPHEN R. CLARK

CHIEF UNITED STATES DISTRICT JUDGE

34