Opinion

NOT FOR PUBLICATION

UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF NEW JERSEY

DAWN O’HARA PAGAN, individually and on

behalf of all others similarly situated,

Plaintiff, Case No. 2:25-cv-14907 (BRM) (JSA)

v. OPINION

AVANTIC MEDICAL LAB, INC.,

Defendant.

MARTINOTTI, DISTRICT JUDGE

Before the Court is Plaintiff Dawn O’Hara Pagan’s (“Plaintiff”) Motion for Class

Certification pursuant to Federal Rule of Civil Procedure (“Rule”) 23 and for Default Judgment as

to the issue of liability only pursuant to Rule 55(b) (the “Motion”). (ECF No. 14.) Defendant

Avantic Medical Lab, Inc. (“Avantic”) has not appeared in this matter. The Court has jurisdiction

under 28 U.S.C. § 1332.1 Having reviewed the submission filed in connection with the Motion and

having declined to hold a hearing pursuant to Federal Rule of Civil Procedure 78(b), for the reasons

set forth below and for good cause having been shown, Plaintiff’s Motion for Class Certification

(ECF No. 14) is GRANTED and Plaintiff’s Motion for Default Judgment (ECF No. 14) is

GRANTED IN PART and DENIED IN PART.

1 The Court specifically has jurisdiction over this action under the Class Action Fairness Act,

because the amount in controversy exceeds five million dollars, the number of proposed class

members is greater than one hundred, and at least one member of the proposed class is a citizen of

a state diverse from Avantic. 28 U.S.C. § 1332(d)(2).

I. BACKGROUND

For the purpose of a class certification motion, the Court must conduct a “rigorous

analysis” of the facts, evidence, and arguments submitted. See In re Lamictal Direct Purchaser

Antitrust Litig., 957 F.3d 184, 187 (3d Cir. 2020). Upon a motion for default class certification,

the Court accepts all of Plaintiff’s well pleaded facts as true, which “extends to specific allegations

relating to the prerequisites for class certification” and then performs the Rule 23 analysis. Lehman

v. Calls After Hours, LLC, Civ. A. No. 18-2601, 2019 WL 8405591, at *2 (N.D. Ohio Aug. 16,

2019). The Court may also consider any “document integral to or explicitly relied upon in the

complaint.” In re Burlington Coat Factory Sec. Litig., 114 F.3d 1410, 1426 (3d Cir. 1997) (quoting

Shaw v. Digit. Equip. Corp., 82 F.3d 1194, 1220 (1st Cir. 1996)).

A. Factual Background

This action arises out of a cyberattack and data breach, which allegedly targeted Avantic’s

IT Network on July 3, 2025 (the “Data Breach”). (ECF No. 1 ¶ 1.) The Data Breach resulted in

unauthorized access to the Private Information (“PI”), including the Private Health Information

(“PHI”) and Personally Identifiable Information (“PII”)2, of approximately 1,400 individuals

(proposed “Class Members”), including named plaintiff Dawn O’Hara Pagan. (ECF No. 14-1 at

1.) Plaintiff seeks to recover damages on behalf of the Class Members for Avantic’s failure to

secure its IT Network. (ECF No. 1 ¶¶ 16–19.)

2 Because the Health Insurance Portability and Accountability Act (“HIPAA”) protects PHI and

the Federal Trade Commission (“FTC”) Act empowers the FTC to enforce various forms of PII,

the Court will refer to the total private information disclosed in the Data Breach as “PI.” Citizens

for Health v. Leavitt, 428 F.3d 167, 173 (3d Cir. 2005) (explaining HIPAA prohibits “‘covered

entities’. . . from using or disclosing an individual's ‘protected health information’); F.T.C. v.

Wyndham Worldwide Corp., 799 F.3d 236, 248 (3d Cir. 2015) (explaining the various acts of

Congress which protect consumers’ personal information, information collected from children,

and consumer data, within the FTC’s ambit).

Avantic is a full-service clinical laboratory, which provides a wide array of diagnostic

testing services. (Id. ¶ 25.) As a clinical laboratory, the proposed Class Members entrusted Avantic

with their necessary and highly sensitive PI. (Id. ¶ 26.) Plaintiff alleges Avantic “promise[d] and

represent[ed]” to these individuals the PI collected from them would be kept safe and confidential,

and the privacy of the information would be maintained. (Id. ¶ 27.) Avantic, however, neither

encrypted the PI nor deleted information when it was no longer needed. (Id. ¶ 35.)

Non-party Everest Ransomware Group (“Everest”) is a notorious cybercriminal group,

which has been active since December 2020. (Id. ¶ 33.) Everest targets organizations across

different industries and regions, which has included a number of high-profile victims such as

NASA and the Brazilian Government. (Id. ¶ 33.) On June 10, 2025, Everest added a listing to its

leak site, accompanied by a one-week countdown clock and four screenshots containing patient

information as proof of its claims of obtaining PI stored in Avantic’s IT Network. (Id. ¶ 30.) On

July 3, 2025, Everest leaked thirty-one gigabytes of proposed Class Members’ files, including PI

such as names, addresses, telephone numbers, Social Security numbers, medical record numbers,

referring doctors, and their personal health insurance, medical, and financial information. (Id.

¶ 31.)

B. Procedural History

Plaintiff filed her Class Action Complaint against Avantic on August 26, 2025. (ECF No.

1.) Plaintiff seeks to recover damages on behalf of the 1,400 individuals whose files were leaked

in the Data Breach. (Id. ¶¶ 16–19.) Plaintiff asserts four counts in her Complaint: (1) Negligence;

(2) Negligence Per Se; (3) Breach of Implied Contract; and (4) Unjust Enrichment. (See id.)

Plaintiff served Avantic on September 3, 2025. (ECF No. 5.) Avantic’s deadline to file a responsive

pleading was September 24, 2025. (Id.) To date, Avantic has neither filed a responsive pleading

nor appeared in this action. (ECF No. 14-1 at 2.) On December 3, 2025, Plaintiff filed a request

for entry of default pursuant to Rule 55(a) (ECF No. 10), which the Clerk entered against Avantic

(Clerk’s Entry dated December 4, 2025).

On December 29, 2025, Plaintiff filed this Motion for Class Certification and Default

Judgment on the issue of liability pursuant to Rules 23 and 55(b).3 (ECF No. 14-1.) To date,

Avantic has not opposed the Motion or appeared in this action.

II. DEFAULT CLASS CERTIFICATION

A. Legal Standard

A class action under Rule 23 is “an exception to the usual rule that litigation is conducted

by and on behalf of the individual named parties only.” Wal-Mart Stores v. Dukes, 564 U.S. 338,

348 (2011) (citing Califano v. Yamasaki, 442 U.S. 682, 700–01 (1979)). “To invoke this exception,

every putative class action must satisfy the requirements of Rule 23(a) and the requirements of

either Rule 23(b)(1), (2), or (3).” Marcus v. BMW of N. Am., LLC, 687 F.3d 583, 590 (3d Cir.

2012). A party seeking class certification must first demonstrate the proposed class satisfies the

four requirements of Rule 23(a):

(1) the class is so numerous that joinder of all members is

impracticable;

(2) there are questions of law or fact common to the class;

(3) the claims or defenses of the representative parties are typical of

the claims or defenses of the class; and

(4) the representative parties will fairly and adequately protect the

interests of the class.

3 As of the filing of the motion, Avantic had not provided notice to Plaintiff or the proposed Class

Members of the Data Breach. (ECF No. 1 ¶ 32.)

These four requirements are customarily referred to as: (1) numerosity, (2) commonality, (3)

typicality, and (4) adequate representation, respectively. Dukes, 564 U.S. at 349.

Under Rule 23(b)(3), a class action may be maintained if “the court finds that the questions

of law or fact common to class members predominate over any questions affecting only individual

members, and that a class action is superior to other available methods for fairly and efficiently

adjudicating the controversy.” These requirements are known as “predominance” and

“superiority,” respectively. In re Hydrogen Peroxide Antitrust Litig., 552 F.3d 305, 310 (3d Cir.

2008), as amended (Jan. 16, 2009). The issues pertinent to these findings include:

(A) the class members’ interests in individually controlling the

prosecution or defense of separate actions;

(B) the extent and nature of any litigation concerning the

controversy already begun by or against class members;

(C) the desirability or undesirability of concentrating the litigation

of the claims in the particular forum; and

(D) the likely difficulties in managing a class action.

Fed. R. Civ. P. 23(b)(3). Superiority “asks the court ‘to balance, in terms of fairness and efficiency,

the merits of a class action against those of “alternative available methods” of adjudication.’” In

re Prudential Ins. Co. Am. Sales Prac. Litig. Agent Actions, 148 F.3d 283, 316 (3d Cir. 1998)

(quoting Georgine v. Amchem Prods., Inc., 83 F.3d 610, 632 (3d Cir. 1996)). “Predominance tests

whether proposed classes are sufficiently cohesive to warrant adjudication by representation, a

standard far more demanding’ than the commonality requirement of Rule 23(a).” In re Insulin

Pricing Litig., Civ. A. No. 17-699, 2024 WL 416500, at *14 (D.N.J. Feb. 5, 2024) (internal

quotation marks omitted). The Third Circuit has held for proposed classes under Rule 23(b)(3),

there is an “implicit requirement that class members be ascertainable,” meaning a plaintiff’s

proposed class must be “currently and readily ascertainable based on objective criteria.” In re

Niaspan Antitrust Litig., 67 F.4th 118, 129−30, 133 (3d Cir. 2023) (quoting Hargrove v. Sleepy’s

LLC, 974 F.3d 467, 477 (3d Cir. 2020)).

“Class ‘certification is proper only if the trial court is satisfied, after a rigorous analysis’

that all of the necessary Rule 23 requirements have been fulfilled.” Ferreras v. Am. Airlines, Inc.,

946 F.3d 178, 183 (3d Cir. 2019) (quoting Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350–51

(2011)). “The party seeking certification bears the burden of establishing each element of Rule 23

by a preponderance of the evidence.” Marcus, 687 F.3d at 591 (citing In re Hydrogen Peroxide,

552 F.3d at 307). The Third Circuit has set forth “three key aspects of class certification

procedure.” In re Hydrogen Peroxide, 552 F.3d at 307. First, the court’s decision to certify a class

requires factual determinations in support of each Rule 23 requirement by a preponderance of the

evidence, “not merely a ‘threshold showing’ by a party.” Id. “Second, the court must resolve all

factual or legal disputes relevant to class certification, even if they overlap with the merits—

including disputes touching on elements of the cause of action.” Id. Lastly, “the court’s obligation

to consider all relevant evidence and arguments extends to expert testimony, whether offered by a

party seeking class certification or by a party opposing it.” Id. “An overlap between a class

certification requirement and the merits of a claim is no reason to decline to resolve relevant

disputes when necessary to determine whether a class certification requirement is met.” Id. at 316.

To determine whether the Rule 23 class certification requirements are satisfied, the Third

Circuit has stated district courts may “delve beyond the pleadings” where appropriate, and their

certification analysis may include a “preliminary inquiry into the merits.” Sullivan v. DB Invs.,

Inc., 667 F.3d 273, 306 (3d Cir. 2011) (quoting Newton v. Merrill Lynch, Pierce, Fenner & Smith,

Inc., 259 F.3d 154, 167 (3d Cir. 2001), as amended (Oct. 16, 2001)). However, “plaintiffs need

not actually establish the validity of claims at the [class] certification stage.” Sullivan, 667 F.3d at

306. “[T]rial courts ‘must engage in a rigorous analysis and find each of Rule 23[]’s requirements

met by a preponderance of the evidence before granting certification[,]” even if this “involves

judging credibility, weighing evidence, or deciding issues that overlap with the merits of a

plaintiff’s claims.” In re Niaspan, 67 F.4th at 130 (quoting Harnish v. Widener Univ. Sch. of Law,

304 (3d Cir. 2016)).

“[A] clerk’s entry of default does not change the analysis that a district court must

undertake in deciding whether to certify a class because any other conclusion might give

defendants an incentive to default in situations where class certification seems likely.” Lehman,

2019 WL 8405591, at *1 (citing Leider v. Ralfe, Civ. A. No. 01-3137, 2003 WL 24571746, at *8–

13 (S.D.N.Y. Mar. 4, 2003) R & R adopted in part, 2003 WL 22339305 (S.D.N.Y. Oct. 10, 2003)

(conducting class certification analysis following defendant’s default and denying certification for

failure to meet requirements of Rule 23)). Certification under Rule 23, however, “remains a

procedural requirement for a class to recover damages.” Lehman, 2019 WL 8405591, at *1.

Therefore, a court may only certify a class action, after a rigorous analysis, if the court is satisfied

the prerequisites of Rule 23 have been met. Gilchrist v. Bolger, 733 F.2d 1551, 1555 (11th Cir.

1984)).

B. Decision

Plaintiff proposes a class consisting of “[a]ll individuals whose Private Information was

accessed and/or acquired by an unauthorized party in the Data Breach [(the “Proposed Class”)].”4

(ECF No. 1 ¶ 152.) Therefore, the Court must first determine whether Plaintiff has satisfied the

4 “Specifically excluded from the [Proposed Class] are [Avantic], its officers, directors, agents,

trustees, parents, children, corporations, trusts, representatives, principals, servants, partners, joint

venturers, or entities controlled by [Avantic], and its heirs, successors, assigns, or other persons or

entities related to or affiliated with [Avantic] and/or its officers and/or directors, the judge assigned

to this action, and any member of the judge’s immediate family.” (ECF No. 1 ¶ 153.)

prerequisites for maintaining a class action as set forth in Rule 23(a)—numerosity, commonality,

typicality, and adequate representation—and then determines whether she has satisfied the

requirements of Rule 23(b)(3).

1. Numerosity

With respect to numerosity, a party need not precisely enumerate the class members to

proceed as a class action. In re Lucent Tech. Inc., Sec. Litig., 307 F. Supp. 2d 633, 640 (D.N.J.

2004). “No minimum number of plaintiffs is required to maintain a suit as a class action, but

generally if the named plaintiff demonstrates that the potential number of plaintiffs exceeds [forty],

the first prong of Rule 23(a) has been met.” Stewart v. Abraham, 275 F.3d 220, 226–27 (3d Cir.

2001).

Here, the Proposed Class includes “thousands” of members, which is so numerous the

joinder of all potential class members would be impracticable. (ECF No. 1 ¶ 156.) Plaintiff alleges

the class consists of “[a]ll individuals whose Private Information was accessed and/or acquired by

an unauthorized party in the Data Breach.” (Id. ¶ 152.) Plaintiff estimates the Proposed Class

includes approximately 1,400 members.5 (ECF No. 14-1 at 5.) This is greater than the forty class

members, which generally meets the numerosity requirement, and “[n]o minimum number of

plaintiffs is required” to meet this prong. Stewart v. Abraham, 275 F.3d 220, 226–27 (3d Cir.

2001). The Court finds litigating this dispute would be impracticable absent class certification.

“Impracticability does not mean impossibility, but rather that the difficulty or inconvenience of

joining all members of the class calls for class certification.” Weikel v. Tower Semiconductor, Ltd.,

5 Plaintiff’s Complaint alleges there are “thousands” of potential Class Members, (ECF No. 1

¶ 156), while Plaintiff’s brief in support of this Motion contains the specific figure of “1,400” (ECF

No. 14-1 at 5). Because the allegation of the Complaint is sufficient for the analysis for class

certification, the Court will use the more specific figure presented in the brief going forward

without requiring Plaintiff to amend.

183 F.R.D. 377, 388 (D.N.J. 1998) (internal quotation marks omitted). “There are no specific

standards regarding class size and it is not necessary for a plaintiff to allege the exact number of

class members to satisfy the numerosity requirement.” In re Centocor, Inc. Sec. Litig. III, Civ. A.

No. 98-260, 1999 WL 54530, at *1 (E.D. Pa. Jan. 27, 1999); Zinberg v. Wash. Bancorp, Inc., 138

F.R.D. 397, 405 (D.N.J. 1990).

Therefore, the Court finds the threshold for a presumption of numerosity is met.

2. Commonality

Commonality requires “there are questions of law or fact common to the class.” Fed. R.

Civ. P. 23(a)(2). The threshold for establishing commonality is straightforward: “[t]he

commonality requirement will be satisfied if the named plaintiffs share at least one question of

fact or law with the grievances of the prospective class.” In re Schering Plough Corp. ERISA Litig.,

589 F.3d 585, 596–97 (3d Cir. 2009) (quoting Baby Neal v. Casey, 43 F.3d 48, 56 (3d Cir. 1994)).

Indeed, as the Third Circuit pointed out, “[i]t is well established that only one question of law or

fact in common is necessary to satisfy the commonality requirement, despite the use of the plural

‘questions’ in the language of Rule 23(a)(2).” In re Schering Plough, 589 F.3d at 97 n.10.

Therefore, there is a low threshold for satisfying this requirement. Newton, 259 F.3d 154 at 183;

In re Sch. Asbestos Litig., 789 F.2d 996, 1010 (3d Cir. 1986) (highlighting the threshold of

commonality is not high).

This requirement does not mandate all putative class members share identical claims, see

Hassine v. Jeffes, 846 F.2d 169, 176–77 (3d Cir. 1988), and “factual differences among the claims

of the putative class members do not defeat certification,” Baby Neal, 43 F.3d at 56. In this regard,

class members can assert a single common complaint even if they have not all suffered actual

injury; demonstrating all class members are subject to the same harm will suffice. Hassine, 846

F.2d at 177–78. “Even where individual facts and circumstances do become important to the

resolution, class treatment is not precluded.” Baby Neal, 43 F.3d at 57.

This case presents numerous questions of law and fact common to all Proposed Class

Members, as each member suffered the same potential harm of the leak of their PI, including

“name, address, telephone number, Social Security number, medical record number, referring

doctor, [and] health insurance, medical, and financial information” from the Data Breach. (ECF

No. 1 ¶ 6.) Insofar as Plaintiff alleges Avantic was negligent, unjustly enriched, or breached

implied contracts with its customers, those violations and related remedies would apply to all

Proposed Class Members.

Therefore, the Court finds the threshold for a presumption of commonality is met.

3. Typicality

Rule 23(a)(3) requires the representative’s claim be typical of those of the members of the

class. “The concepts of commonality and typicality are broadly defined and tend to merge, because

they focus on similar aspects of the alleged claims.” Newton, 259 F.3d at 182. “Both criteria seek

to assure that the action can be practically and efficiently maintained and that the interests of the

absentees will be fairly and adequately represented.” Baby Neal, 43 F.3d at 56; see General Tel.

Co. of Southwest v. Falcon, 457 U.S. 147, 157 n.13 (1982). Despite their similarity,

commonality—like numerosity—evaluates the sufficiency of the class itself, and typicality—like

adequacy of representation—evaluates the sufficiency of the named plaintiff. See Hassine, 846

F.2d at 177 n.4; Weiss v. York Hosp., 745 F.2d 786, 810 (3d Cir. 1984).

Specifically, Rule 23(a)(3) requires the claims of the representative parties be “typical of

the claims of the class.” Typicality acts as a bar to class certification only when “the legal theories

of the named plaintiffs potentially conflict with those of the absentees.” Georgine v. Amchem

Prods., 83 F.3d 610, 631 (3d Cir. 1996); Newton, 259 F.3d at 183. “If the claims of the named

plaintiffs and putative class members involve the same conduct by the defendant, typicality is

established regardless of factual differences.” Id. at 183–84. In other words, the typicality

requirement is satisfied as long as representatives and the class claims arise from the same event,

practice, or course of conduct and are based on the same legal theory. See Brosious v. Children’s

Place Retail Stores, 189 F.R.D. 138, 146 (D.N.J. 1999).

Here, typicality is clearly satisfied since Plaintiff’s claims arise from the same course of

conduct which gave rise to the claims of all other Proposed Class Members, namely the Data

Breach, and are based on the same legal theories. Thus, the typicality requirement of Rule 23(a)(3)

is met.

4. Adequacy

A class may not be certified unless the representative class members “will fairly and

adequately protect the interests of the class.” Fed. R. Civ. P. 23(a)(4). “Rule 23(a)’s adequacy of

representation requirement ‘serves to uncover conflicts of interest between named parties and the

class they seek to represent.’” In re Pet Food Prod. Liab. Litig., 629 F.3d 333, 343 (3d Cir. 2010)

(quoting Amchem, 521 U.S. at 625). Class representatives “must be part of the class and possess

the same interest and suffer the same injury as the class members.” Id. This requirement has

traditionally entailed a two-pronged inquiry: first, the named plaintiff’s interests must be

sufficiently aligned with the interests of the absentees; and second, the plaintiff’s counsel must be

qualified to represent the class. In re Gen. Motors Corp. Pick-Up Truck Fuel Tank Prods. Liab.

Litig., 55 F.3d 768, 800 (3d Cir. 1995). A named plaintiff is “adequate” if his interests do not

conflict with those of the class. See In re Prudential Ins. Co., 148 F.3d at 312. Pursuant to Rule

23(g), adequacy of class counsel is considered separately from the determination of the adequacy

of the class representatives.

Both prongs of the adequacy requirement are satisfied here. Plaintiff has no interests

antagonistic to those of the Proposed Class Members. (ECF No. 14-1 at 7.) Plaintiff is alleged to

have suffered injury in the same manner as other class members as a result of Avantic’s alleged

negligence. (Id.) Plaintiff is therefore an adequate representative of the class.

Likewise, the interests of Plaintiff’s counsel, Milberg, PLLC and Kopelowitz, Ostrow,

Ferguson, Weiselberg Gilbert are not antagonistic. To assess the adequacy of the proposed class

counsel, the court must consider the following: (1) the work counsel has done in identifying or

investigating potential claims in the action; (2) counsel’s experience in handling class actions,

other complex litigation, and claims of the type asserted in the action; (3) counsel’s knowledge of

the applicable law; and (4) the resources counsel will commit to representing the class. See Nafar

v. Hollywood Tanning Sys., Inc., Civ. A. No. 06-3826, 2008 WL 3821776, at *7 (D.N.J. Aug. 12,

2008). Plaintiff alleges she “has retained competent counsel who are experienced in consumer and

commercial class action litigation and who will prosecute this action vigorously” (ECF No. 1

¶ 158), and counsel has timely filed this motion for class certification and default judgment (see

ECF No. 14-1). Milberg, PLLC and Kopelowitz, Ostrow, Ferguson, Weiselberg Gilbert are

therefore qualified to represent the class.

5. Rule 23(b)(3) Factors: Common Questions Predominate and the Class

Is Superior to Other Methods of Adjudication

After meeting the threshold requirements of Rule 23(a), a plaintiff must establish the

proposed class meets the requirements of Rule 23(b)(3). To certify a class under Rule 23(b)(3),

the Court must find “the questions of law or fact common to class members predominate over any

questions affecting only individual members, and that a class action is superior to other available

methods for fairly and efficiently adjudicating of the controversy.” Fed. R. Civ. P. 23(b)(3). In this

case, both considerations weigh in favor of class certification.

a. Predominance

First, Plaintiff satisfies the predominance criteria. In determining whether common

questions predominate, courts have focused on the claims of liability against defendants. See Smith

v. Suprema Specialties, Inc., Civ. A. No. 02-168, 2007 WL1217980, at * 9 (D.N.J. Apr. 23, 2007)

(collecting cases) (“The focus of the predominance inquiry is on liability, not damages.”). “When

common questions are a significant aspect of a case and they can be resolved in a single action,

class certification is appropriate.” In re Novo Nordisk Sec. Litig., Civ. A. No. 17-209, 2020 WL

502176, at *8 (D.N.J. Jan. 31, 2020).

Defendant’s alleged liability arises from a cyberattack by Everest on Avantic resulting in

the Data Breach, wherein Everest leaked the PI of Avantic’s patients via the internet. (See

generally ECF No. 1.) Therefore, the question of whether Avantic’s conduct in protecting this

information was negligent is the central issue in this case and predominates over any individual

issue that theoretically might arise. Here, the existence of common questions and their

predominance over individual issues are exemplified by the fact that if every class member were

to bring an individual action, each plaintiff would be required to demonstrate the theft and

disclosure of their individual information and the damages each plaintiff individually suffered as

a result of said leak. The Court finds, therefore, the predominance criteria of Rule 23(b)(3) are

met.

b. Superiority

Next, the superiority requirement “asks the court to balance, in terms of fairness and

efficiency, the merits of a class action against those of alternative available methods of

adjudication.” In re Prudential Ins. Co., 148 F.3d at 316 (internal quotation marks omitted); accord

In re Warfarin Sodium Antitrust Litig., 391 F.3d 516, 533–34 (3d Cir. 2004). Given the alternative

available method is 1,400 individual lawsuits litigating almost identical claims, which would be

highly inefficient, the Court finds the superiority requirement is met.

Finally, there will be no difficulties in managing this class. This Court balances the fairness

and efficiency of certifying a class against other possible methods of adjudication. Absent a class

action, the Court would have to try numerous lawsuits for approximately 1,400 plaintiffs, each of

whose damages are alleged to exceed $5 million. (ECF No. 1 ¶ 22.) See Good v. Nationwide Credit,

Inc., Civ. A. No. 14-4295, 2016 WL 929368, at *8 (E.D. Pa. Mar. 14, 2016); see also Smilow v.

Sw. Bell Mobile Sys., Inc., 323 F.3d 32, 41 (1st Cir. 2003) (“The core purpose of Rule 23(b)(3) is

to vindicate the claims of . . . groups of people whose individual claims would be too small to

warrant litigation.”). Therefore, a class action is the superior method of adjudication and satisfies

Rule 23(b)(3).

Having weighed all the factors and considered all the requirements of class certification,

the Court finds it is appropriate to certify the class.

III. DEFAULT JUDGMENT

A. Legal Standard

Rule 55(a) allows for the entry of default against a party who “has failed to plead or

otherwise defend,” and when said “failure is shown by affidavit or otherwise, the clerk must enter

the party’s default.” Fed. R. Civ. P. 55(a). Once the Clerk enters an entry of default, “[Rule]

55(b)(2) authorizes courts to enter a default judgment against a properly served defendant who

fails to file a timely responsive pleading.” La. Counseling & Family Servs., Inc. v. Makrygialos,

LLC, 543 F. Supp. 2d 359, 364 (D.N.J. 2008) (citing Fed. R. Civ. P. 55(b)(2)). The court, rather

than the Clerk, must enter the judgment where the amount is not sum certain or cannot be made

certain by computation. Fed. R. Civ. P. 55(b).

The Third Circuit generally disfavors default judgments. Budget Blinds, Inc. v. White, 536

F.3d 244, 258 (3d Cir. 2008). While entry of a default judgment is within the district court’s

discretion, cases should “be disposed of on the merits whenever practicable.” Hritz v. Woma Corp.,

732 F.2d 1178, 1181 (3d Cir. 1984)); see also Chamberlain v. Giampapa, 210 F.3d 154, 164 (3d

Cir. 2000); La. Counseling & Family Servs., 543 F. Supp. 2d at 364. A party is not entitled to the

entry of a judgment of default as of right, because the entry of such a judgment is left primarily to

the discretion of the district court. See Hritz, 732 F.2d at 1180.

Generally, courts treat all pleadings and allegations of a plaintiff as true on a motion for

default judgment. See Comdyne I, 908 F.2d at 1149. However, the Court is not required to accept

a plaintiff’s conclusions of law and, therefore, “it remains for the [C]ourt to consider whether the

unchallenged facts constitute a legitimate cause of action” against the defendants. Directv, Inc. v.

Asher, Civ. A. No. 03-1969, 2006 WL 680533, at *1 (D.N.J. Mar. 14, 2006) (quoting Charles A.

Wright, Arthur R. Miller & Mary Kay Kane, 10A Fed. Prac. & Proc. § 2688, at 58–59, 63 (3d ed.

1998)); accord La. Counseling & Family Servs., 543 F. Supp. 2d at 364; Comcast Cable Commc’ns

v. Bowers, Civ. A. No. 06-1664, 2007 WL 1557510, at *2 (D.N.J. May 25, 2007). “[A] litigant’s

failure to state a claim upon which relief may be granted, e.g., an assertion of a claim over which

the court lacks jurisdiction, prevents the presiding court from entering a default judgment.” Animal

Sci. Prods., Inc. v. China Nat. Metals & Mins. Imp. & Exp. Corp., 596 F. Supp. 2d 842, 848 (D.N.J.

2008); see Mineo v. McEachern, Civ. A. No. 12-1950, 2014 WL 2197032, at *2 (D.N.J. May 27,

2014) (“A court will deny a default judgment if the complaint fails to state a claim under [Rule]

12(b)(6).)

B. Decision

Plaintiff’s entire argument on the merits in favor of entering default judgment as to liability

is “Plaintiff is entitled to a default judgment on liability. . . [because] Defendant failed to timely

answer the Complaint, and the allegations in the complaint are thereby admitted.” (ECF No. 14-1

at 3.) Plaintiff did not address the merits of their causes of action. (See id.) This does not suffice,

as the Court only accepts the facts alleged, not the conclusions of law. Therefore, the Court must

now assess whether Plaintiff and the Proposed Class Members (hereinafter, the “Class Members”)

are entitled to default judgment for each of the four claims Plaintiff asserts based upon the facts

alleged.

1. Negligence Per Se

“Under New Jersey law, a claim of negligence per se is supported by the violation of a

statute or regulation, but only when that statute or regulation serves to impose direct tort liability

on the person who offends it.” In re Allergan Biocell Textured Breast Implant Prods. Liab. Litig.,

537 F. Supp. 3d 679, 726 (D.N.J. 2021) (citing Green v. 712 Broadway, LLC, Civ. A. No. 17-991,

2018 WL 2754075, at *6 (D.N.J. June 8, 2018)); accord Sang Geoul Lee v. Won Il Park, 720 F.

App’x 663, 666 (3d Cir. 2017)). See also Boria v. Heritage at Alexander Hamilton, Civ. A. No.

23-22914, 2024 WL 3585579, at *2 (D.N.J. July 30, 2024) (“Negligence per se applies where a

statute ‘specifically incorporate[s] the non-statutory or common-law standard of negligence.’”

(quoting Senisch v. Tractor Supply Co., Civ. A. No. 16-047, 2018 WL 324717, at *11 (D.N.J. Jan.

8, 2018))). However, “because statutes ‘rarely define a standard of conduct in the language of

common-law negligence,’ the application of negligence per se is ‘the exceptional situation.’”

Boria, 2024 WL 3585579, at *2 (quoting Labega v. Joshi, 270 A.3d 378, 389 (N.J. Super. Ct. App.

Div. 2022)). See also Alexander v. Sandoval, 532 U.S. 275, 290–92 (2001) (finding no private

right of action implied under federal statutes absent express creation by Congress).

Plaintiff’s negligence per se claim is premised on Avantic’s alleged violation of Section 5

of the FTC Act, 15 U.S.C. § 45, which prohibits unfair methods of competition and unfair or

deceptive acts or practices, and HIPAA, 42 U.S.C. § 1302(d) et seq., which requires reasonable

safeguards on PHI. (ECF No. 1 ¶¶ 188–201.) Plaintiff does not bring a direct cause of action under

the FTC Act or HIPAA; rather, she asserts a negligence per se claim based on violations of the

FTC Act and HIPAA. (See id.).

Here, Plaintiff’s claim fails under New Jersey Law because neither the FTC Act nor

HIPAA “specifically incorporate the non-statutory or common law standard of negligence.” Boria,

2024 WL 3585579, at *2. The FTC Act does not require finding a party failed to exercise

reasonable care, which, by its terms, would “constitute[] a finding of negligence.” See id. (quoting

Senisch v. Tractor Supply Co., Civ. A. No. 16-047 2018 WL 324717, at *11 (D.N.J. Jan. 8, 2018));

see also L.S. v. Mount Olive Bd. of Educ., 765 F. Supp. 2d 648, 666 (D.N.J. 2011) (dismissing a

negligence per se claim premised upon HIPAA violations). In fact, both statutes explicitly lack a

private right of action. Mod. Orthopaedics of New Jersey v. Horizon Healthcare Servs., Inc., Civ.

A. No. 21-20174, 2022 WL 3211417, at *4 (D.N.J. Aug. 8, 2022) (holding it is “well-established”

in the Third Circuit HIPAA does not provide a private right of action, neither expressly nor by

implication); Ponce v. Wilmington Sav. Fund Soc’y, FSB, Civ. A. No. 22-4834, 2023 WL 4197179,

at *8 (D.N.J. June 26, 2023) (“[T]here is no private right of action to enforce the FTC Act.”).

Therefore, under federal law, there is no private right of action by which a private plaintiff may

file suit. See Sandoval, 532 U.S. at 290–92. Under New Jersey law, because the statutes do not

impose tort liability, they cannot serve as the basis of a negligence per se claim. In re Allergan,

537 F. Supp. 3d at 726.

Accordingly, Plaintiff’s Motion for Default Judgment as to Count II of the Complaint —

negligence per se—is denied.

2. Negligence

To establish a claim of negligence under New Jersey law, a plaintiff must demonstrate four

elements: (1) a duty of care, (2) the duty has been breached, (3) proximate causation, and (4) actual

damages. Townsend v. Pierre, 110 A.3d 52, 61 (N.J. 2015) (citing Polzo v. Cnty. of Essex, 960

A.2d 375, 384 (N.J. 2008)). A “plaintiff bears the burden of establishing those elements ‘by some

competent proof.’” Id. (quoting Davis v. Brickman Landscaping, Ltd., 98 A.3d 1173, 1178 (2014)).

“Actual damages are those that are real and substantial as opposed to speculative.” Grunwald v.

Bronkesh, 621 A.2d 459, 465 (1993). “The damage or harm need not be immediate,” and “[a]

plaintiff may recover damages for the prospective consequence of a tortious injury if the

‘prospective consequence may, in reasonable probability, be expected to flow from the past

harm.’” Ayers v. Jackson Tp., 461 A.3d 184, 187 (N.J. Super. Ct. Law. Div. 1983) (quoting Coll

v. Sherry, 148 A.2d 481, 486 (N.J. 1959)).

“Violating a statute in New Jersey may support an alleged [negligence] claim in three ways:

(1) by the statute itself creating civil liability if violated, (2) by constituting negligence per se, or

(3) by constituting evidence of negligence.” In re BetMGM Data Breach Litig., Civ. A. No. 22-

7462, 2024 WL 5710661, at *3 (D.N.J. Nov. 20, 2024) (citing Boria, 2024 WL 3585579, at *2

(D.N.J. July 30, 2024)). Under New Jersey law, “[c]ivil liability may be ‘expressly provided’ by a

statute or conferred by a court as an ‘implied private right of action.’” Id. (quoting R.J. Gaydos

Ins. Agency, Inc. v. Nat’l Consumer Ins. Co., 773 A.3d 1132, 1144 (N.J. 2001)).

Blackman v. Northeastern Spine & Sports Medicine, LLC provides guidance. Civ. A. No.

24-7022, 2025 WL 77029, at *6 (D.N.J. Jan. 13, 2025). The court held the named plaintiff

sufficiently pled her negligence claim against a healthcare provider which had been the target of a

data breach. Id. The court held violations of the FTC Act and HIPAA could serve as evidence of

negligence, particularly as to the existence of a duty. Id. The court further held the injury of class

members monitoring their financial and personal records in the wake of the data breach satisfied

Article III standing and sufficiently pled the damages element of the negligence claim. Id.

Here, Plaintiff alleges Avantic owed a duty of care to safeguard her PI, including PII and

PHI, and failed to do so, resulting in a foreseeable data breach, which was the but-for and

proximate cause of her damages. (ECF No. 1 ¶¶ 165–67.) She alleges Avantic owed her a duty

both under the FTC Act and HIPAA6 and independently to “exercise reasonable care in obtaining,

retaining, securing, safeguarding, deleting, and protecting the [PI] in its possession from being

compromised, lost, stolen, accessed, and misused by unauthorized persons.” (Id. ¶¶ 86–91.)

Plaintiff further alleges Avantic “failed to implement industry-standard cybersecurity measures,”

such as “installing appropriate malware detection software; monitoring and limiting the network

ports; protecting web browsers and email management systems; setting up network systems such

as firewalls, switches and routers; monitoring and protection of physical security systems;

protection against any possible communication system; training staff regarding critical points.”

(Id. ¶¶ 83–84.) She alleges Avantic knew or should have known of the risk of a data breach due to

the frequent targeting of the healthcare industry by cyber attackers. (Id. ¶¶ 47–48.) Plaintiff then

alleges her data was breached and published online due to these failures, and she has been injured

6 Plaintiff’s allegations of violations of the FTC Act and HIPAA do not constitute negligence per

se, but are evidence of the duty owed to her and the other Class Members.

by the publication of her personal information in the form of the cost of monitoring for credit and

identity theft. (Id. ¶¶ 131–36.)

Accepting each of these factual allegations as true, Plaintiff and the Class Members satisfy

the factual basis for each element of a claim for negligence and are entitled to default judgment on

the negligence claim. Accordingly, Plaintiff’s Motion for Default Judgment as to Count I—

negligence—of the Complaint is granted7.

3. Breach of Implied Contract

The elements of a claim for breach of implied contract are the same as for express contracts

under New Jersey law. In re U.S. Vision Data Breach Litig., 732 F. Supp. 3d 369, 377 (D.N.J.

2024). “To prove the existence of an implied contract, [a] [p]laintiff[] must demonstrate ‘mutual

assent, consideration, legality of object, and capacity of the parties.’” Id. (quoting Duffy v. Charles

Schwab & Co., Inc., 123 F. Supp. 2d 802, 818 (D.N.J. 2000)). However, “[t]he difference . . .

between an implied and an express contract is that proof of an implied contract is inferred from

the conduct of the parties rather than any verbal or written expression.” Id. “Mutual assent is an

essential element of an implied contract claim.” In re Am. Med. Collection Agency, Inc. Customer

Data Sec. Breach Litig., Civ. A. No. 19-2904, 2021 WL 5937742, at *19 (D.N.J. Dec. 16, 2021).

“In the data breach context, ‘the fact that a defendant required plaintiffs to provide personal

information does not alone support the inference that the parties agreed for the defendant to secure

this information.’” In re. Am. Financial Resources, Inc. Data Breach Litig., Civ. A. No. 22-1757,

2023 WL 3963804, at *8 (D.N.J. Mar. 29, 2023) (quoting In re Am. Med. Collection Agency, 2021

WL 5937742, at *19). Plaintiff must also allege “some other conduct by the Defendant from which

7 The disposition refers only to the issue of liability, as that is the issue upon which Plaintiff moved

for Default Judgment. (ECF No. 14-1 at 3.)

mutual assent for [Defendant] safeguard[ing] Plaintiff’s PI[] arose.” Id. Courts in this district, and

others, allow breach of implied contract claims to proceed at a motion to dismiss stage8 if a plaintiff

can plead that a defendant, “through privacy policies, codes of conduct, company security

practices, and other conduct, implicitly promised to safeguard the plaintiffs’ personal

information.” Id. at *20 (internal quotation marks omitted).

In Blackman v. Northeastern Spine & Sports Medicine, LLC, the court found the named

plaintiff had failed to sufficiently plead breach of an implied contract because she had failed to

allege mutual assent from the defendant healthcare company for specifically safeguarding her

personal information beyond what was already required by statute. Blackman, 2025 WL 77029, at

*6. Mere allegations of “promises and representations that the private information collected from

them as a condition of obtaining medical services . . . would be kept safe [and] confidential” were

not enough to sustain a claim for breach of an implied contract. See id. (“It is apparent from the

Complaint that [the] [p]laintiff paid [the] [d]efendants to perform medical services and she

provided her PI[] as a pre-requisite to receiving Defendant’s services.”); see In re Am. Med.

Collection Agency, 2021 WL 5937742, at *19–20 (distinguishing cases where an implied contract

was found due to privacy policies, codes of conduct, or statements on a defendant’s website from

cases where the plaintiff could not allege the defendant made any specific promises beyond its

obligations under applicable law). See also In re BetMGM Data Breach Litig., 2024 WL 5710661,

at *5 (recommending dismissal of a breach of implied contract claim against a company which

had been the subject of a data breach for failure to allege mutual assent to safeguarding personal

8 The Court acknowledges the Motion requests default judgment and is not a motion to dismiss,

however, “a litigant’s failure to state a claim upon which relief may be granted . . . prevents the

presiding court from entering a default judgment.” Animal Sci. Prods., Inc., 596 F. Supp. at 848.

information beyond its legal obligations); In re U.S. Vision Data Breach Litig., 732 F. Supp. 3d at

378 (dismissing a breach of implied contract claim for failure to allege all elements).

Plaintiff does not allege Avantic “made any implicit promise to protect [PI] from third-

party hackers or provide notice of a data breach beyond its obligations under applicable law”

beyond a vague and insufficient reference to “promises and representations.” In re Am. Med.

Collection Agency, 2021 WL 5937742, at *20; (See also ECF No. 1 ¶ 27 (alleging “promises and

representations”)). This is the same bare allegation the court found to be insufficient in Blackman.

See Blackman, 2025 WL 77029, at *7. Further, a statement of “intent to follow federal law do[es]

not support an independent cause of action for breach of implied contract.” In re Am. Med.

Collection Agency, 2021 WL 5937742, at *20. In fact, like in Blackman and In re Am. Med.

Collection Agency, Plaintiff specifically alleges Avantic “accepted possession of Plaintiff and

Class Members’ Private Information for the purpose of providing medical services to Plaintiff and

Class Members.” (ECF No. 1 ¶ 205.) Plaintiff does not identify any policies, codes of conduct, or

statements by Avantic that would constitute promises beyond what Avantic was already required

to do under applicable law.9 (See generally ECF No. 1.)

Accordingly, Plaintiff’s Motion for Default Judgment as to Count III—breach of implied

contract—of the Complaint is denied.

4. Unjust Enrichment

To establish an unjust enrichment claim, a plaintiff must show the “defendant received a

benefit and that retention of that benefit without payment would be unjust.” VRG Corp. v. GKN

9 Plaintiff asserts “at all relevant times [Avantic] promulgated, adopted, and implemented written

privacy policies whereby it expressly promised Plaintiff and Class Members that it would only

disclose [PI] under certain circumstances, none of which relates to the Data Breach.” (ECF No. 1

¶ 210.) Without any allegations of the wording of the policies, the Court cannot find a factual basis

for the legal conclusion that any potential policy created a promise beyond applicable law.

Realty Corp., 641 A.2d 519, 526 (N.J. 1994). “Retention is unjust when the plaintiff expects

payment for the service or the defendant retains a benefit at the expense of the plaintiff.” Maersk

Line v. TJM Int’l Ltd. Liab. Co., 427 F. Supp. 3d 528, 535 (D.N.J. 2019); see also Red Hawk Fire

& Sec., LLC v. Siemens Indus. Inc., 449 F. Supp. 3d 449, 464 (D.N.J. 2020) (“The doctrine of

unjust enrichment rests on the equitable principle that a person shall not be allowed to enrich

himself at the expense of another.” (internal quotation marks omitted)). Moreover, “a claim for

unjust enrichment requires a direct relationship between the parties.” Hammer v. Vital Pharms.,

Inc., Civ. A. No. 11-4124, 2012 WL 1018842, at *10 (D.N.J. Mar. 26, 2012); see also Bedi v.

BMW of N. Am., LLC, Civ. A. No. 15-1898, 2016 WL 324950, at *5 (D.N.J. Jan. 27, 2016). Courts

have recognized personal information can constitute value in order to establish a claim for unjust

enrichment. See In re Am. Med. Collection Agency, 2021 WL 5937742, at *18; In re U.S. Vision.,

732 F. Supp. 3d 369 at 379–80. Courts in this district, however, have declined to allow such a

claim to proceed in a complaint premised on a data breach against a healthcare company when

there are no facts alleged asserting the defendant company received any additional value from the

PI it used to provide medical services or commoditized PI it obtained. Id.

Plaintiff attempts to construe the general payments by Plaintiff and Class Members to

Avantic with conferring additional benefit upon Avantic. (See ECF No. 1 ¶¶ 224–26.) Plaintiff

alleges the unjust enrichment is the portion of payment received indirectly from Plaintiff and Class

Members. (Id. ¶ 227.) Setting aside that an unjust enrichment claim requires a direct relationship10

between the parties, see Robinson, 2024 WL 1598416, at *3 (dismissing an unjust enrichment

10 It is unclear from the face of the Complaint exactly what relationship or relationships Plaintiff

intended to allege. Plaintiff alleges the premise of damages based upon both “those cybersecurity

costs [which] were passed on to Plaintiff and Class Members in the form of elevated prices charged

by Defendant for its services” (ECF No. 1 ¶ 224), and “the amounts of payment received

indirectly” (id. 1 ¶ 227).

claim in a data breach case when “no facts in the Complaint allege a direct relationship between

[the] [p]laintiff and [the] [d]efendants”), there are no facts alleged in the Complaint evidencing

payment for the safeguarding of personal information beyond Avantic’s independent statutory

obligations. (See generally ECF No. 1.) Like in In re American Medical Collection Agency, PI

furnished for the purpose of medical services does not automatically transform into a unjustly

conferred benefit because of a data breach. See In re Am. Med. Collection Agency, 2021 WL

5937742, at *18.

Accordingly, Plaintiff’s Motion for Default Judgment as to Count IV—unjust

enrichment—of the Complaint is denied.

IV. CONCLUSION

For the reasons set forth above, Plaintiff’s Motion for Class Certification (ECF No. 14) is

GRANTED, Plaintiff’s proposed class of approximately 1,400 Avantic patients whose files were

leaked in the Data Breach is CERTIFIED, and Plaintiff’s Motion for Default Judgment as to the

issue of liability is GRANTED IN PART as to Count I of the Complaint and DENIED IN PART

as to the other causes of action. An appropriate order follows.

/s/ Brian R. Martinotti

HON. BRIAN R. MARTINOTTI

UNITED STATES DISTRICT JUDGE

Dated: July 29, 2026