# Liebhold

> District Court, E.D. North Carolina · August 12, 2026

URL: https://www.frixlaw.com/law-library/cases/11418277

## Case

- **Full name:** Naomi Liebhold and Michael Papetti, individually, and on behalf of all others similar situated v. Intelerad Medical Systems, Incorporated
- **Court:** District Court, E.D. North Carolina
- **Decided:** August 12, 2026
- **Opinion:** 100trialcourt
- **Cited by:** 0 later opinions in the Frix Law Library

## Citator (automated)

- No negative treatment found by the automated citator. That is not the same as a confirmation that the case is good law; read the citing cases.
- Full citator and citing cases: https://www.frixlaw.com/law-library/cases/11418277

## Opinion text

IN THE UNITED STATES DISTRICT COURT
FOR THE EASTERN DISTRICT OF NORTH CAROLINA
WESTERN DIVISION
No. 5:25-cv-00432-BO-RN
NAOMI LIEBHOLD and MICHAEL )
PEPETTI, individually, and on behalf of all )
others similar situated, )
Plaintiffs,
V. ORDER
INTELERAD MEDICAL SYSTEMS,
INCORPORATED. )
Defendant.

This cause comes before the Court on two motions to dismiss plaintiffs’ complaint pursuant
to Fed R. Civ. P. 12(b)(1) and 12(b)(6) and defendant’s motion to strike pursuant to Fed. R. Civ. P.
12(f). Plaintiffs have responded, defendant has replied, and a hearing on the motions was held
before undersigned on June 25, 2026, in Raleigh, North Carolina. In this posture. the motions are
ripe for ruling.
BACKGROUND
Plaintiff Naomi Liebhold commenced this action by filing a putative class action complaint
on July 18, 2025, against DICOM Grid. Inc. d/b/a Ambra Health and Intelerad, Inc. d/b/a Intelerad
Medical Systems, bringing claims arising from an alleged data breach which compromised highly
sensitive protected health and personally identifiable information. [DE 1]. On August 29, 2025,
Liebhold filed an amended complaint. [DE 7]. On February 19, 2026, the Court denied without
prejudice Liebhold’s motion to consolidate this action with a second action pending in this district,
Michael Papetti v. DICOM Grid, Inc., et al., No. 5:25-cv-634-BO-RN (E.D.N.C.). [DE 26].

]

Defendants Ambra Health and Intelerad Medical Systems moved to dismiss the amended
complaint for lack of subject matter jurisdiction and failure to state a claim. [DE 28].
On April 10. 2026. without first seeking leave of court or the consent of defendants,
Liebhold and Michael Papetti filed a second amended complaint in this case, alleging claims on
behalf of themselves and others similarly situated against Intelerad Medical Systems, Inc.
(“Intelerad”) arising from the same alleged data breach.' Liebhold and Papetti assert claims of
negligence, negligence per se, invasion of privacy, breach of implied contract. unjust enrichment,
breach of fiduciary duty, breach of third-party beneficiary contract, bailment, violation of the
Washington Consumer Protection Act, RCW 19.86.010, e¢ seg., and violation of Washington Data
Breach Disclosure Law, RC W 19.255.005, et seq. Jd. Defendant Intelerad moved to strike Liebhold
and Papetti’s second amended complaint [DE 35] and then to dismiss the second amended
complaint. [DE 37].
In their second amended complaint, plaintiffs allege that Intelerad runs a cloud-based
medical image management platform (the “Platform”) called InteleShare, which provides
“physicians, patients, and researchers a superior cloud solution for reading, storing, and sharing
diagnostic imaging.” [DE 34] 4 2. Intelerad’s Platform is used by healthcare providers nationally
to access, transmit, and store patients’ sensitive information, including medical images and related
data. Jd. § 3. In operating the Platform, Intelerad relied on third-party software. SimpleHelp
Remote Monitoring and Management (“SimpleHelp”), which permits Platform users to remotely
access sensitive information stored on the Platform. /d. § 4. Plaintiffs allege that Intelerad failed
to securely implement, configure, and monitor SimpleHelp and that this failure introduced a
vulnerability across the Platform’s network, allowing unauthorized threat actors to access and

' Papetti voluntarily dismissed his complaint in No. 5:25-cv-634 on April 10, 2026.

extract sensitive, personal information of the user’s clients, such as social security numbers, dates
of birth, treatment or diagnosis information, and health insurance information. /d. 45.
Plaintiffs allege that one or more bad actors were able to exploit SimpleHelp’s
vulnerabilities and gain access to files containing sensitive patient information, such as patient
names, dates of birth, and medical images. /d. 4 33-34. Plaintiffs allege that, following the breach,
Intelerad failed to promptly notify individuals whose sensitive information had been accessed or
disclose the nature and extent of the data breach. /d. {| 6. Plaintiffs further allege that any notice
regarding the data breach Intelerad did disseminate to impacted individuals was inadequate. Jd.
Plaintiffs allege that Intelerad’s failure to securely implement SimpleHelp allowed unauthorized
bad actors to access plaintiffs’ and putative class members” sensitive information. leaving them
vulnerable to identity theft, financial crimes, and medical fraud, and that the risks plaintiffs face
are ongoing. Jd. ¥ 8.
DISCUSSION
I. Legal Standards.
Intelerad has moved to dismiss the second amended complaint for lack of subject matter
jurisdiction and failure to state a claim upon which relief can be granted. Federal Rule of Civil
Procedure 12(b)(1) authorizes dismissal of a claim for lack of subject matter jurisdiction. Fed. R.
Civ. P. R. 12(b)(1). “Subject-matter jurisdiction cannot be forfeited or waived and should be
considered when fairly in doubt.” Ashcroft v. Iqbal, 556 U.S. 662, 671 (2009) (citation omitted). A
plaintiff facing a subject matter jurisdiction challenge bears the burden of proving jurisdiction to
survive the motion. Evans v. B.F. Perkins Co., 166 F.3d 642, 647-50 (4th Cir. 1999). When a facial
challenge to subject matter jurisdiction is raised, the facts alleged by the plaintiff in the complaint
are taken as true, “and the motion must be denied if the complaint alleges sufficient facts to invoke

subject matter jurisdiction.” Kerns v. United States. 585 F.3d 187, 192 (4th Cir. 2009). The Court
can consider evidence outside the pleadings without converting the motion into one for summary
judgment. See, e.g., Evans, 166 F.3d at 647.
Rule 8 of the Federal Rules of Civil Procedure “requires only a short and plain statement
of the claim showing that the pleader is entitled to relief” which provides “the defendant fair notice
of what the claim is and the grounds upon which it rests.” Erickson v. Pardus, 551 U.S. 89, 93
(2007) (cleaned up). A Rule 12(b)(6) motion tests the legal sufficiency of the complaint. Papasan
v. Allain, 478 U.S. 265, 283 (1986). When acting on a motion to dismiss under Rule 12(b)(6), “the
Court should accept as true all well-pleaded allegations and should view the complaint in a light
most favorable to the plaintiff.” Mylan Labs., Inc. v. Matkari, 7 F.3d 1130, 1134 (4th Cir. 1993). A
complaint must allege enough facts to state a claim for relief that is facially plausible. Be/l Atlantic
Corp. v. Twombly, 550 U.S. 544, 570 (2007). In other words, the facts alleged must allow the Court,
drawing on judicial experience and common sense, to infer more than the mere possibility of
misconduct. Nemet Chevrolet, Ltd. v. Consumeraffairs.com, Inc., 591 F.3d 250, 256 (4th Cir.
2009). The Court “need not accept the plaintiffs legal conclusions drawn from the facts, nor need
it accept as true unwarranted inferences, unreasonable conclusions, or arguments.” Philips v. Pitt
County Mem. Hosp., 572 F.3d 176, 180 (4th Cir. 2009) (cleaned up).
Intelerad has also moved to strike the second amended complaint. Federal Rule of Civil
Procedure |2(f) allows a court, swa sponte or on a motion by the parties, to “strike from a pleading
an insufficient defense or any redundant, immaterial, impertinent, or scandalous matter.” Fed. R.
Civ. P. 12(f). Finally, Rule 15 states that leave to amerid should be freely grven when justice
requires. Fed. R. Civ. P. 15(a). “It is this Circuit's policy to liberally allow amendment[.]~
Galustian v. Peter, 591 F.3d 724, 729 (4th Cir. 2010). “[L]eave to amend a pleading should be

denied only when the amendment would be prejudicial to the opposing party. there has been bad
faith on the part of the moving party, or the amendment would have been futile.” Laber v. Harvey,
438 F.3d 404. 426 (4th Cir. 2006) (en banc) (internal quotation and citation omitted). Ultimately.
the decision to grant leave to amend rests in this Court's discretion. Foman v. Davis, 371 U.S. 178,
182 (1962).
I]. Analysis
A. Defendant's motion to strike
The Court considers first Intelerad’s motion to strike plaintiffs’ second amended complaint.
Plaintiffs concede that the filing of their second amended complaint was procedurally improper.
but contend that there was no ill intent. that Intelerad will not be prejudiced by plaintiffs” failure
to formally request leave to amend, and further that the second amended complaint was filed in an
effort to update and streamline the pleadings of both Liebhold and Papetti. See [DE 39] at 2-3.
The Court declines to strike plaintiffs’ second amended complaint. Under the liberal
amendment standards in Rule 15, this Court would have granted plaintiffs leave to amend the
complaint had the motion been filed. Given that Intelerad has identified and responded to the
alterations made in the second amended complaint. the Court finds no basis for requiring plaintiffs
to formally seek leave to amend under these circumstances, and the motion to strike is denied. The
Court will consider the second amended complaint as the operative complaint in this case.
Additionally, it is well settled that a timely filed amended pleading supersedes the original
pleading. See Fawzy v. Wauquiez Boats SNC, 873 F.3d 451, 455 (4th Cir. 2017). As the Court has
deemed the second amended complaint as the operative pleading, the first motion to dismiss the
amended complaint is denied as moot.

B. Defendant’s motion to dismiss under Rule }2(b)(1)
Intelerad seeks to dismiss the second amended complaint for lack of standing. Subject-
matter jurisdiction includes Article III standing, Ctr for Biological Diversity v. United States
Forest Serv.. 764 F. Supp. 3d 349, 355 (S.D.W. Va. 2025). and “[{t]he party attempting to invoke
federal jurisdiction bears the burden of establishing standing.” Miller v. Brown, 462 F.3d 312, 316
(4th Cir. 2006). Standing is the determination of whether a particular individual is the proper party
to assert a claim in federal court: it “is founded in concern about the proper—and properly
limited—trole of the courts in a democratic society.” Warth y. Seldin, 422 U.S. 490, 498 (1975)
(emphasis added). The standing doctrine curtails the types of disputes that an Article I!] court can
resolve by requiring courts to hew to their express constitutional mandate of resolving “cases” and
“controversies.” See id.: U.S. Const. art. III, § 2. cl. 1. The standing question asks “whether the
litigant is entitled to have the court decide the merits of the dispute or of particular issues.” Warth,
422 U.S. at 498. An affirmative answer to this question requires plaintiffs to demonstrate at least
three “irreducible constitutional minimum” requirements:
First, the plaintiff must have suffered an “injury in fact”’—an invasion of a legally
protected interest which is (a) concrete and particularized and (b) “actual or
imminent, not “conjectural” or “hypothetical. Second. there must be a causal
connection between the injury and the conduct complained of—the injury has to be
“fairly traceable to the challenged action of the defendant, and not the result of the
independent action of some third party not before the court.” Third, it must be
“likely.” as opposed to merely “speculative,” that the injury will be “redressed by a
favorable decision.”
Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61 (1992) (cleaned up, internal citations omitted).
Intelerad argues that plaintiffs* second amended complaint must be dismissed because
plaintiffs have failed to allege an actual or imminent injury, that they fail to trace any alleged injury
to Intelerad, and finally that plaintiffs lack standing to seek injunctive relief because they have not
alleged any future harm that is imminent and not speculative.

Courts in the Fourth Circuit have found that actual misuse ofa plaintiff's information, such
as “fraudulent and unauthorized” credit card charges, is sufficient injury-in-fact to satisfy Article
III standing. See Farley v. Eye Care Leaders Holdings, LLC, 2023 WL 1353558, at *4 (M.D.N.C.
Jan. 31, 2023). Both plaintiffs allege that their sensitive personal information has been found on
the dark web. [DE 34] §§ 49, 150, 168. Liebhold alleges that the same debit card provided to her
medical provider and client of Intelerad was utilized in an unauthorized and fraudulent charge of
$1,282.93. [DE 34] § 149. Plaintiff Papetti alleges similar unauthorized activity associated with
his financial information, resulting in plaintiff Papetti’s having to cancel and obtain reissued bank
cards. /d. § 167. The Court finds these allegations of actual misuse, rather than “*mere compromise
of personal information,’ . . . bring the actual and threatened harm [alleged by plaintiffs] out of the
realm of speculation and into the realm of sufficiently imminent and particularized harm to satisfy
the injury-in-fact requirement” for standing.” McCreary vy. Filters Fast LLC, 2021 WL 3044228, at
*4 (W.D.N.C. July 19, 2021) (citations omitted).
Intelerad argues next that plaintiffs” second amended complaint must be dismissed because
it fails to trace any alleged injury to Intelerad. However. plaintiffs’ burden to establish traceability
is “relatively modest at this stage of litigation[.]” Bennest v. Spear, 520 U.S. 154. 171 (1997).
Plaintiffs are not required to “show to a scientific certainty that defendant . . . caused the precise
harm suffered.” Friends of the Earth, Inc. v. Gaston Copper Recycling Corp., 204 F.3d 149, 161
(4th Cir. 2000) (en banc).
The Fourth Circuit has held that complaints which allege fraudulent use of personal
information that was collected and stored by a defendant “contain ‘sufficient factu‘a matter” to
render the Plaintiffs’ allegations plausible on their face with respect to traceability.” Hutton v. Nat'l
Bd. of Exam'rs Optometry, Inc., 892 F.3d 613, 6224 (4th Cir. 2018) (citation omitted) (holding that

fraudulent credit cards which were opened using the same data being collected and stored by the
defendant is sufficient factual allegation to fulfill the traceability requirement). Plaintiffs”
allegations of debit and credit card misuse after their data stored on the Platform appeared on the
dark web allow the Court to fairly trace their injuries to Intelerad’s failure to properly secure their
sensitive information stored on the Platform. Intelerad argues that plaintiffs have failed to provide
any reason to believe that their alleged injuries were caused by a data incident impacting the
Platform because their injuries may have been caused by some other, unrelated data incident
affecting some other company. But, at this stage, the Court must accept as true that it was a data
breach involving the Platform that allowed bad actors to access the plaintiffs’ names, Social
Security numbers, addresses, dates of birth. and other personally identifying information in order
to cause, for example, fraudulent credit charges. See Hutton, 892 F.3d at 623.
In sum, at this stage, in which plaintiffs” burden is “relatively modest,” and the facts alleged
are taken as true. the Court finds that plaintiffs’ “general allegations embrace those specific facts
that are necessary to support” a connection between plaintiffs’ alleged injuries and Intelerad’s data
breach. A/leruzzo v. SuperValu, Inc. (In re SuperValu, Inc., Customer Data Sec. Breach Litig.), 870
F.3d 763, 772 (8th Cir. 2017) (citation omitted).
Intelerad finally argues that plaintiffs’ request for injunctive relief should be dismissed
because they fail to allege any future harm redressable by an injunction against Intelerad. [DE 38]
at 11-12. Here, the Court agrees in part.
Plaintiffs seek both retrospective damages and injunctive relief, and they must be able to
demonstrate that they have standing to pursue each form of relief they seek. TransUnion LLC v.
Ramirez, 594 U.S. 413. 436 (2021). “[A] person exposed to a risk of future harm may pursue
forward-looking, injunctive relief to prevent the harm from occurring, at least so long as the risk

of harm is sufficiently imminent and substantial.” /d. at 435. Moreover, Article III*s standing
requirements “prohibit plaintiffs from receiving redress for speculative future injuries or for
injuries incurred only in response to those speculative injuries.” Holmes v. Elephant Ins. Co., 156
F.4th 413, 435 (4th Cir. 2025).
Plaintiffs allege that plaintiffs’ and putative class members’ sensitive information
compromised by the Platform’s data breach continues to be an attractive target for unauthorized
threat actors, see, e.g., [DE 34] § 127, and they seek to protect themselves from Intelerad’s alleged
ongoing failure to implement secure data practices, such as proper due diligence of third-party
software and adequate security safeguards and mitigating measures. Jd. § 35. Plaintiffs seek an
injunction which would require Intelerad to enhance its security and monitoring systems, be
subject to future audits of its security and monitoring systems, and to provide ongoing identity
theft and credit monitoring services to the plaintiffs and the putative class. Jd. 205, 226.
Plaintiffs have failed in part to sufficiently allege standing to pursue injunctive relief
against Intelerad, as their allegations regarding any future, ongoing risk of harm do not establish
that such harm sufficiently imminent. As recently noted by the court of appeals, “[a] future harm
is not imminent just because there is an ‘objectively reasonable likelihood’ that it will someday
come to pass.” Holmes, 156 F.4th at 429 (quoting Clapper v. Anmesty Int'l USA, 568 U.S. 398, 410
(2013)). The possibility that these plaintiffs would be victims of another data breach if Intelerad is
not forced to implement improved security measures is simply too speculative. See Holmes, 156
F.4th at 433. Plaintiffs lack standing to seek injunctive relief which would require Intelerad to
enhance its security systems and be subject to audits. However, the provision of credit and identity
theft monitoring could be construed as a remedy for the ongoing harm of plaintiffs’ alleged past

injuries. See Jonathan R. by Next Friend Dixon y. Morrisey, 178 F.4th 139, 163 (4th Cir. 2026).
Accordingly, the Court will not dismiss the requested injunctive relief in full.
C. Defendant’s motion to dismiss under Rule 12(b)(6)
Intelerad argues that plaintiffs’ claims fail because (1) their allegations of a data incident
affecting their data are entirely conclusory; (2) the only conduct plausibly alleged is Intelerad’s
ownership of Ambra Health; and (3) plaintiffs fail to allege one or more elements of each cause of
action.
The Court has considered plaintiffs’ claims under the applicable standards outlined above
and determines that plaintiffs have plausibly alleged their claims for relief at this early stage.
Intelerad’s motion to dismiss under Rule 12(b)(6) is denied.
CONCLUSION
For the reasons set forth above, the first motion to dismiss [DE 28] is DENIED AS MOOT,
defendant’s motion to strike plaintiffs’ second amended complaint [DE 35] is DENIED, and
defendant’s second motion to dismiss [DE 37] is GRANTED IN PART and DENIED IN PART.
Plaintiffs request for injunctive relief is DISMISSED IN PART without prejudice.

SO ORDERED. this [{_ day of August 2026.

UNITED STATES DISTRICT JUDGE

10

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/cases/11418277. Public record. Not legal advice.