Liebhold

IN THE UNITED STATES DISTRICT COURT

FOR THE EASTERN DISTRICT OF NORTH CAROLINA

WESTERN DIVISION

No. 5:25-cv-00432-BO-RN

NAOMI LIEBHOLD and MICHAEL )

PEPETTI, individually, and on behalf of all )

others similar situated, )

Plaintiffs,

V. ORDER

INTELERAD MEDICAL SYSTEMS,

INCORPORATED. )

Defendant.

This cause comes before the Court on two motions to dismiss plaintiffs’ complaint pursuant

to Fed R. Civ. P. 12(b)(1) and 12(b)(6) and defendant’s motion to strike pursuant to Fed. R. Civ. P.

12(f). Plaintiffs have responded, defendant has replied, and a hearing on the motions was held

before undersigned on June 25, 2026, in Raleigh, North Carolina. In this posture. the motions are

ripe for ruling.

BACKGROUND

Plaintiff Naomi Liebhold commenced this action by filing a putative class action complaint

on July 18, 2025, against DICOM Grid. Inc. d/b/a Ambra Health and Intelerad, Inc. d/b/a Intelerad

Medical Systems, bringing claims arising from an alleged data breach which compromised highly

sensitive protected health and personally identifiable information. [DE 1]. On August 29, 2025,

Liebhold filed an amended complaint. [DE 7]. On February 19, 2026, the Court denied without

prejudice Liebhold’s motion to consolidate this action with a second action pending in this district,

Michael Papetti v. DICOM Grid, Inc., et al., No. 5:25-cv-634-BO-RN (E.D.N.C.). [DE 26].

]

Defendants Ambra Health and Intelerad Medical Systems moved to dismiss the amended

complaint for lack of subject matter jurisdiction and failure to state a claim. [DE 28].

On April 10. 2026. without first seeking leave of court or the consent of defendants,

Liebhold and Michael Papetti filed a second amended complaint in this case, alleging claims on

behalf of themselves and others similarly situated against Intelerad Medical Systems, Inc.

(“Intelerad”) arising from the same alleged data breach.' Liebhold and Papetti assert claims of

negligence, negligence per se, invasion of privacy, breach of implied contract. unjust enrichment,

breach of fiduciary duty, breach of third-party beneficiary contract, bailment, violation of the

Washington Consumer Protection Act, RCW 19.86.010, e¢ seg., and violation of Washington Data

Breach Disclosure Law, RC W 19.255.005, et seq. Jd. Defendant Intelerad moved to strike Liebhold

and Papetti’s second amended complaint [DE 35] and then to dismiss the second amended

complaint. [DE 37].

In their second amended complaint, plaintiffs allege that Intelerad runs a cloud-based

medical image management platform (the “Platform”) called InteleShare, which provides

“physicians, patients, and researchers a superior cloud solution for reading, storing, and sharing

diagnostic imaging.” [DE 34] 4 2. Intelerad’s Platform is used by healthcare providers nationally

to access, transmit, and store patients’ sensitive information, including medical images and related

data. Jd. § 3. In operating the Platform, Intelerad relied on third-party software. SimpleHelp

Remote Monitoring and Management (“SimpleHelp”), which permits Platform users to remotely

access sensitive information stored on the Platform. /d. § 4. Plaintiffs allege that Intelerad failed

to securely implement, configure, and monitor SimpleHelp and that this failure introduced a

vulnerability across the Platform’s network, allowing unauthorized threat actors to access and

' Papetti voluntarily dismissed his complaint in No. 5:25-cv-634 on April 10, 2026.

extract sensitive, personal information of the user’s clients, such as social security numbers, dates

of birth, treatment or diagnosis information, and health insurance information. /d. 45.

Plaintiffs allege that one or more bad actors were able to exploit SimpleHelp’s

vulnerabilities and gain access to files containing sensitive patient information, such as patient

names, dates of birth, and medical images. /d. 4 33-34. Plaintiffs allege that, following the breach,

Intelerad failed to promptly notify individuals whose sensitive information had been accessed or

disclose the nature and extent of the data breach. /d. {| 6. Plaintiffs further allege that any notice

regarding the data breach Intelerad did disseminate to impacted individuals was inadequate. Jd.

Plaintiffs allege that Intelerad’s failure to securely implement SimpleHelp allowed unauthorized

bad actors to access plaintiffs’ and putative class members” sensitive information. leaving them

vulnerable to identity theft, financial crimes, and medical fraud, and that the risks plaintiffs face

are ongoing. Jd. ¥ 8.

DISCUSSION

I. Legal Standards.

Intelerad has moved to dismiss the second amended complaint for lack of subject matter

jurisdiction and failure to state a claim upon which relief can be granted. Federal Rule of Civil

Procedure 12(b)(1) authorizes dismissal of a claim for lack of subject matter jurisdiction. Fed. R.

Civ. P. R. 12(b)(1). “Subject-matter jurisdiction cannot be forfeited or waived and should be

considered when fairly in doubt.” Ashcroft v. Iqbal, 556 U.S. 662, 671 (2009) (citation omitted). A

plaintiff facing a subject matter jurisdiction challenge bears the burden of proving jurisdiction to

survive the motion. Evans v. B.F. Perkins Co., 166 F.3d 642, 647-50 (4th Cir. 1999). When a facial

challenge to subject matter jurisdiction is raised, the facts alleged by the plaintiff in the complaint

are taken as true, “and the motion must be denied if the complaint alleges sufficient facts to invoke

subject matter jurisdiction.” Kerns v. United States. 585 F.3d 187, 192 (4th Cir. 2009). The Court

can consider evidence outside the pleadings without converting the motion into one for summary

judgment. See, e.g., Evans, 166 F.3d at 647.

Rule 8 of the Federal Rules of Civil Procedure “requires only a short and plain statement

of the claim showing that the pleader is entitled to relief” which provides “the defendant fair notice

of what the claim is and the grounds upon which it rests.” Erickson v. Pardus, 551 U.S. 89, 93

(2007) (cleaned up). A Rule 12(b)(6) motion tests the legal sufficiency of the complaint. Papasan

v. Allain, 478 U.S. 265, 283 (1986). When acting on a motion to dismiss under Rule 12(b)(6), “the

Court should accept as true all well-pleaded allegations and should view the complaint in a light

most favorable to the plaintiff.” Mylan Labs., Inc. v. Matkari, 7 F.3d 1130, 1134 (4th Cir. 1993). A

complaint must allege enough facts to state a claim for relief that is facially plausible. Be/l Atlantic

Corp. v. Twombly, 550 U.S. 544, 570 (2007). In other words, the facts alleged must allow the Court,

drawing on judicial experience and common sense, to infer more than the mere possibility of

misconduct. Nemet Chevrolet, Ltd. v. Consumeraffairs.com, Inc., 591 F.3d 250, 256 (4th Cir.

2009). The Court “need not accept the plaintiffs legal conclusions drawn from the facts, nor need

it accept as true unwarranted inferences, unreasonable conclusions, or arguments.” Philips v. Pitt

County Mem. Hosp., 572 F.3d 176, 180 (4th Cir. 2009) (cleaned up).

Intelerad has also moved to strike the second amended complaint. Federal Rule of Civil

Procedure |2(f) allows a court, swa sponte or on a motion by the parties, to “strike from a pleading

an insufficient defense or any redundant, immaterial, impertinent, or scandalous matter.” Fed. R.

Civ. P. 12(f). Finally, Rule 15 states that leave to amerid should be freely grven when justice

requires. Fed. R. Civ. P. 15(a). “It is this Circuit's policy to liberally allow amendment[.]~

Galustian v. Peter, 591 F.3d 724, 729 (4th Cir. 2010). “[L]eave to amend a pleading should be

denied only when the amendment would be prejudicial to the opposing party. there has been bad

faith on the part of the moving party, or the amendment would have been futile.” Laber v. Harvey,

438 F.3d 404. 426 (4th Cir. 2006) (en banc) (internal quotation and citation omitted). Ultimately.

the decision to grant leave to amend rests in this Court's discretion. Foman v. Davis, 371 U.S. 178,

182 (1962).

I]. Analysis

A. Defendant's motion to strike

The Court considers first Intelerad’s motion to strike plaintiffs’ second amended complaint.

Plaintiffs concede that the filing of their second amended complaint was procedurally improper.

but contend that there was no ill intent. that Intelerad will not be prejudiced by plaintiffs” failure

to formally request leave to amend, and further that the second amended complaint was filed in an

effort to update and streamline the pleadings of both Liebhold and Papetti. See [DE 39] at 2-3.

The Court declines to strike plaintiffs’ second amended complaint. Under the liberal

amendment standards in Rule 15, this Court would have granted plaintiffs leave to amend the

complaint had the motion been filed. Given that Intelerad has identified and responded to the

alterations made in the second amended complaint. the Court finds no basis for requiring plaintiffs

to formally seek leave to amend under these circumstances, and the motion to strike is denied. The

Court will consider the second amended complaint as the operative complaint in this case.

Additionally, it is well settled that a timely filed amended pleading supersedes the original

pleading. See Fawzy v. Wauquiez Boats SNC, 873 F.3d 451, 455 (4th Cir. 2017). As the Court has

deemed the second amended complaint as the operative pleading, the first motion to dismiss the

amended complaint is denied as moot.

B. Defendant’s motion to dismiss under Rule }2(b)(1)

Intelerad seeks to dismiss the second amended complaint for lack of standing. Subject-

matter jurisdiction includes Article III standing, Ctr for Biological Diversity v. United States

Forest Serv.. 764 F. Supp. 3d 349, 355 (S.D.W. Va. 2025). and “[{t]he party attempting to invoke

federal jurisdiction bears the burden of establishing standing.” Miller v. Brown, 462 F.3d 312, 316

(4th Cir. 2006). Standing is the determination of whether a particular individual is the proper party

to assert a claim in federal court: it “is founded in concern about the proper—and properly

limited—trole of the courts in a democratic society.” Warth y. Seldin, 422 U.S. 490, 498 (1975)

(emphasis added). The standing doctrine curtails the types of disputes that an Article I!] court can

resolve by requiring courts to hew to their express constitutional mandate of resolving “cases” and

“controversies.” See id.: U.S. Const. art. III, § 2. cl. 1. The standing question asks “whether the

litigant is entitled to have the court decide the merits of the dispute or of particular issues.” Warth,

422 U.S. at 498. An affirmative answer to this question requires plaintiffs to demonstrate at least

three “irreducible constitutional minimum” requirements:

First, the plaintiff must have suffered an “injury in fact”’—an invasion of a legally

protected interest which is (a) concrete and particularized and (b) “actual or

imminent, not “conjectural” or “hypothetical. Second. there must be a causal

connection between the injury and the conduct complained of—the injury has to be

“fairly traceable to the challenged action of the defendant, and not the result of the

independent action of some third party not before the court.” Third, it must be

“likely.” as opposed to merely “speculative,” that the injury will be “redressed by a

favorable decision.”

Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61 (1992) (cleaned up, internal citations omitted).

Intelerad argues that plaintiffs* second amended complaint must be dismissed because

plaintiffs have failed to allege an actual or imminent injury, that they fail to trace any alleged injury

to Intelerad, and finally that plaintiffs lack standing to seek injunctive relief because they have not

alleged any future harm that is imminent and not speculative.

Courts in the Fourth Circuit have found that actual misuse ofa plaintiff's information, such

as “fraudulent and unauthorized” credit card charges, is sufficient injury-in-fact to satisfy Article

III standing. See Farley v. Eye Care Leaders Holdings, LLC, 2023 WL 1353558, at *4 (M.D.N.C.

Jan. 31, 2023). Both plaintiffs allege that their sensitive personal information has been found on

the dark web. [DE 34] §§ 49, 150, 168. Liebhold alleges that the same debit card provided to her

medical provider and client of Intelerad was utilized in an unauthorized and fraudulent charge of

$1,282.93. [DE 34] § 149. Plaintiff Papetti alleges similar unauthorized activity associated with

his financial information, resulting in plaintiff Papetti’s having to cancel and obtain reissued bank

cards. /d. § 167. The Court finds these allegations of actual misuse, rather than “*mere compromise

of personal information,’ . . . bring the actual and threatened harm [alleged by plaintiffs] out of the

realm of speculation and into the realm of sufficiently imminent and particularized harm to satisfy

the injury-in-fact requirement” for standing.” McCreary vy. Filters Fast LLC, 2021 WL 3044228, at

*4 (W.D.N.C. July 19, 2021) (citations omitted).

Intelerad argues next that plaintiffs” second amended complaint must be dismissed because

it fails to trace any alleged injury to Intelerad. However. plaintiffs’ burden to establish traceability

is “relatively modest at this stage of litigation[.]” Bennest v. Spear, 520 U.S. 154. 171 (1997).

Plaintiffs are not required to “show to a scientific certainty that defendant . . . caused the precise

harm suffered.” Friends of the Earth, Inc. v. Gaston Copper Recycling Corp., 204 F.3d 149, 161

(4th Cir. 2000) (en banc).

The Fourth Circuit has held that complaints which allege fraudulent use of personal

information that was collected and stored by a defendant “contain ‘sufficient factu‘a matter” to

render the Plaintiffs’ allegations plausible on their face with respect to traceability.” Hutton v. Nat'l

Bd. of Exam'rs Optometry, Inc., 892 F.3d 613, 6224 (4th Cir. 2018) (citation omitted) (holding that

fraudulent credit cards which were opened using the same data being collected and stored by the

defendant is sufficient factual allegation to fulfill the traceability requirement). Plaintiffs”

allegations of debit and credit card misuse after their data stored on the Platform appeared on the

dark web allow the Court to fairly trace their injuries to Intelerad’s failure to properly secure their

sensitive information stored on the Platform. Intelerad argues that plaintiffs have failed to provide

any reason to believe that their alleged injuries were caused by a data incident impacting the

Platform because their injuries may have been caused by some other, unrelated data incident

affecting some other company. But, at this stage, the Court must accept as true that it was a data

breach involving the Platform that allowed bad actors to access the plaintiffs’ names, Social

Security numbers, addresses, dates of birth. and other personally identifying information in order

to cause, for example, fraudulent credit charges. See Hutton, 892 F.3d at 623.

In sum, at this stage, in which plaintiffs” burden is “relatively modest,” and the facts alleged

are taken as true. the Court finds that plaintiffs’ “general allegations embrace those specific facts

that are necessary to support” a connection between plaintiffs’ alleged injuries and Intelerad’s data

breach. A/leruzzo v. SuperValu, Inc. (In re SuperValu, Inc., Customer Data Sec. Breach Litig.), 870

F.3d 763, 772 (8th Cir. 2017) (citation omitted).

Intelerad finally argues that plaintiffs’ request for injunctive relief should be dismissed

because they fail to allege any future harm redressable by an injunction against Intelerad. [DE 38]

at 11-12. Here, the Court agrees in part.

Plaintiffs seek both retrospective damages and injunctive relief, and they must be able to

demonstrate that they have standing to pursue each form of relief they seek. TransUnion LLC v.

Ramirez, 594 U.S. 413. 436 (2021). “[A] person exposed to a risk of future harm may pursue

forward-looking, injunctive relief to prevent the harm from occurring, at least so long as the risk

of harm is sufficiently imminent and substantial.” /d. at 435. Moreover, Article III*s standing

requirements “prohibit plaintiffs from receiving redress for speculative future injuries or for

injuries incurred only in response to those speculative injuries.” Holmes v. Elephant Ins. Co., 156

F.4th 413, 435 (4th Cir. 2025).

Plaintiffs allege that plaintiffs’ and putative class members’ sensitive information

compromised by the Platform’s data breach continues to be an attractive target for unauthorized

threat actors, see, e.g., [DE 34] § 127, and they seek to protect themselves from Intelerad’s alleged

ongoing failure to implement secure data practices, such as proper due diligence of third-party

software and adequate security safeguards and mitigating measures. Jd. § 35. Plaintiffs seek an

injunction which would require Intelerad to enhance its security and monitoring systems, be

subject to future audits of its security and monitoring systems, and to provide ongoing identity

theft and credit monitoring services to the plaintiffs and the putative class. Jd. 205, 226.

Plaintiffs have failed in part to sufficiently allege standing to pursue injunctive relief

against Intelerad, as their allegations regarding any future, ongoing risk of harm do not establish

that such harm sufficiently imminent. As recently noted by the court of appeals, “[a] future harm

is not imminent just because there is an ‘objectively reasonable likelihood’ that it will someday

come to pass.” Holmes, 156 F.4th at 429 (quoting Clapper v. Anmesty Int'l USA, 568 U.S. 398, 410

(2013)). The possibility that these plaintiffs would be victims of another data breach if Intelerad is

not forced to implement improved security measures is simply too speculative. See Holmes, 156

F.4th at 433. Plaintiffs lack standing to seek injunctive relief which would require Intelerad to

enhance its security systems and be subject to audits. However, the provision of credit and identity

theft monitoring could be construed as a remedy for the ongoing harm of plaintiffs’ alleged past

injuries. See Jonathan R. by Next Friend Dixon y. Morrisey, 178 F.4th 139, 163 (4th Cir. 2026).

Accordingly, the Court will not dismiss the requested injunctive relief in full.

C. Defendant’s motion to dismiss under Rule 12(b)(6)

Intelerad argues that plaintiffs’ claims fail because (1) their allegations of a data incident

affecting their data are entirely conclusory; (2) the only conduct plausibly alleged is Intelerad’s

ownership of Ambra Health; and (3) plaintiffs fail to allege one or more elements of each cause of

action.

The Court has considered plaintiffs’ claims under the applicable standards outlined above

and determines that plaintiffs have plausibly alleged their claims for relief at this early stage.

Intelerad’s motion to dismiss under Rule 12(b)(6) is denied.

CONCLUSION

For the reasons set forth above, the first motion to dismiss [DE 28] is DENIED AS MOOT,

defendant’s motion to strike plaintiffs’ second amended complaint [DE 35] is DENIED, and

defendant’s second motion to dismiss [DE 37] is GRANTED IN PART and DENIED IN PART.

Plaintiffs request for injunctive relief is DISMISSED IN PART without prejudice.

SO ORDERED. this [{_ day of August 2026.

UNITED STATES DISTRICT JUDGE

10