# Galaria v. Nationwide Mutual Insurance Co. > Court of Appeals for the Sixth Circuit · September 12, 2016 · 663 F. App'x 384 URL: https://www.frixlaw.com/law-library/cases/8680430 ## Case - **Full name:** Mohammad S. GALARIA (15-3386) Anthony Hancox (15-3387), individually and on behalf of all others similarly situated v. NATIONWIDE MUTUAL INSURANCE COMPANY - **Court:** Court of Appeals for the Sixth Circuit - **Decided:** September 12, 2016 - **Citations:** 663 F. App'x 384 - **Precedential status:** Published - **Opinion:** Dissent by Batchelder - **Judges:** Batchelder, Lipman, White - **Cited by:** 93 later opinions in the Frix Law Library ## Citator (automated) - No negative treatment found by the automated citator. That is not the same as a confirmation that the case is good law; read the citing cases. - Full citator and citing cases: https://www.frixlaw.com/law-library/cases/8680430 ## How later opinions describe it (automated extraction) - holding that plaintiffs' expenditure of "time and money to monitor their credit, check their bank statements, and modify their financial statements" was a concrete injury suffered to mitigate an imminent harm, and satisf[ied] the injury requirement of Article III standing" - concluding that a data breach in violation of FCRA causes a concrete injury—at least when there is proof of a substantial risk of harm - finding Article III standing because “[w]here a data breach targets personal information, a reasonable inference can be drawn that the hackers will use the victims’ data for the fraudulent purposes alleged in Plaintiffs’ complaints” - holding that a plaintiff had standing to sue after an intentional data breach of a database including “names, dates of birth, marital statuses, genders, occupations, employers, Social Security numbers, and driver’s license numbers” - finding plaintiffs did have Article III standing where they alleged that the theft of their .personal data put them at an increased and continuing risk of fraud and that they had expended costs to mitigate that risk ## Opinion text ALICE M. BATCHELDER,.Circuit Judge, dissenting. -1 disagree with the majority’s conclusion that the complaints have adequately pled a causal connection between Nationwide’s alleged inaction and the plaintiffs’ alleged injury, which is necessary to establish Article III standing. As the plaintiffs have not satisfied this fundamental requirement of federal court jurisdiction, I would affirm the district court’s dismissal of their consolidated suit. We need not take sides in the existing circuit split regarding whether an increased risk of identity theft is an Article III injury because, even assuming that it is, the plaintiffs have failed to demonstrate the second prong of Article III standing— causation. The causation element requires “a causal connection between the injury and the [defendant’s] conduct”—in other words, the injury must “be ‘fairly traceable to the challenged action of the defendant, and not the result of the independent action of some third party not before the court.’ ” Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 , 112 S.Ct. 2130 , 119 L.Ed.2d 351 (1992) (alterations omitted) (quoting Simon v. E. Ky. Welfare Rights Org., 426 U.S. 26, 41-42 , 96 S.Ct. 1917 , 48 L.Ed.2d 450 (1976)). Intervening third party action generally defeats a plaintiffs standing. See, e.g., Binno v. Am. Bar Ass’n, 826 F.3d 338, 344-45 (6th Cir. 2016) (rejecting a law school applicant’s constitutional standing to sue the ABA when his injury was actually caused by law school admissions offices and the administrators of the LSAT); Ammex, Inc. v. United States, 367 F.3d 530, 534 (6th Cir. 2004) (holding that a plaintiff could not sue the federal government to recover fuel taxes the government assessed on the plaintiffs suppliers, because the suppliers had discretion to pass on the cost of the tax and “any alleged injury ... was not occasioned by the Government”). If Galaria and Han-cox suffered injury, it was at the hands of criminal third-party actors, and their complaints do not make the factual allegations necessary to fairly trace that injury to Nationwide. At the motion-to-dismiss stage, the plaintiffs bear the same burden to plead the elements of Article III standing as they do to plead the elements of their cause of action. See Lujan, 504 U.S. at 561 , 112 S.Ct. 2130 . Although “detailed factual allegations” are not required, the complaints must contain more than “ ‘naked assertions’ devoid of ‘further factual enhancement.’ ” Ashcroft v. Iqbal, 556 U.S. 662, 678 , 129 S.Ct. 1937 , 173 L.Ed.2d 868 (2009) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555, 557 , 127 S.Ct. 1955 , 167 L.Ed.2d 929 (2007)); see also White v. United States, 601 F.3d 545, 552-53 (6th Cir. 2010) (applying Iqbal pleading requirements to allegations supporting Article III standing). The allegations must “nudge[ ]” the plaintiffs’ basis for standing “across the line from conceivable to plausible.” Twombly, 550 U.S. at 570 , 127 S.Ct. 1955 . Here, the complaints lack any factual link between Nationwide and the plaintiffs’ alleged injury. The complaints simply allege that hackers were in fact able to access the plaintiffs’ personal information. From that fact, the complaints conclude that Nationwide failed to protect that information. But plaintiffs make no factual allegations regarding how the hackers were able to breach Nationwide’s system, nor do they indicate what Nationwide might have done to prevent that breach but failed to do. 1 In short, there is no *393 allegation of fact in either complaint that makes plausible the notion that Nationwide is at all responsible for the criminal acts that increased the plaintiffs’ risk of identity theft. This case is distinguishable from those cases in which we have found Article III standing notwithstanding the intervening action of a third party. Nationwide’s alleged but unspecified negligence did not “motivate” the hacker’s criminal activity, see Parsons v. U.S. Dep’t of Justice, 801 F.3d 701, 714 (6th Cir. 2015), nor have the plaintiffs alleged any direct link between the hacker’s successful crime and an action of Nationwide, Lambert v. Hartman, 517 F.3d 433, 437-38 (6th Cir. 2008). Although a plaintiff need not prove that one particular actor out of many caused his harm, here the plaintiffs do not even allege wrongdoing by Nationwide that might have caused their harm. See Am. Canoe Ass’n, Inc. v. City of Louisa Water & Sewer Comm’n, 389 F.3d 536, 543 (6th Cir. 2004) (holding that a plaintiff could meet standing requirements at the pleading stage by alleging that the defendant was polluting and that the plaintiff was harmed by the pollution, even if other third-party actors were also polluting). Lambert is particularly notable. A county clerk of court published Cynthia Lambert’s personal information on the internet by making public a traffic citation Lambert had received. 517 F.3d at 435 . A criminal used this information to obtain a false driver’s license and make multiple purchases in Lambert’s name. Id. at 435 . Lambert sued the clerk and the county for the violation of her privacy rights, but the defendants attacked her standing “on the basis that her injuries [were] not fairly traceable to the Clerk’s website.” Id. at 437 . The court rejected this argument; although the defendants were not “the direct cause of Lambert’s injuries,” the plaintiff specifically linked the act of identity theft to the Clerk’s website through two factual allegations: (1) the driver’s license number on the traffic citation was incorrect by one digit, the same incorrect number on false driver’s license used to steal -Lambert’s identity; and (2) the identity thief—-who was caught—admitted obtaining the information from the website. Id. at 437-38 . Galaria and Hancox’s alleged injury is an increased risk of identity theft, not the theft itself as in Lambert . But they still need to allege facts establishing a causal link between that increased risk and something Nationwide did or did not do. Accusing Nationwide of “failing to establish and/or implement appropriate ... safeguards ... to protect” customers’ personal information, without more, is insufficient to “allow[ ] the court to draw the reasonable inference” that the breach is fairly traceable to Nationwide. Iqbal, 556 U.S. at 678 , 129 S.Ct. 1937 . It is just another way of saying that Nationwide didn’t prevent the data breach. But no one prevented the data breach; this hardly means that the plaintiffs have standing to sue the FBI or the Ohio Attorney General for not thwarting the hackers’ criminal activities. To establish standing, the plaintiffs must make some factual allegation of a causal connection. This they have failed to do. The majority manufactures this causal connection on the plaintiffs’ behalf, stating that “but for Nationwide’s allegedly lax security, the hackers would not have been *394 able to steal Plaintiffs’ data.” Nowhere does either complaint allege but-for causation. And although the majority is correct that but-for causation is not required for Article III standing, the plaintiffs’ allegations here are nothing more than sheer speculation. See Parsons, 801 F.3d at 714 . Other circuits’ contrary decisions in similar cases completely ignore the independent third party criminal action breaking the chain of causation. For example, the Eleventh Circuit held that plaintiffs satisfied the fairly traceable requirement by alleging only that the defendant “failed to secure [the plaintiffs’] information on company laptops, and that those laptops were subsequently stolen.” 2 Resnick v. AvMed, Inc., 693 F.3d 1317, 1324 (11th Cir. 2012). And in Remijas v. Neiman Marcus Group, LLC, the Seventh Circuit overlooked the absence of any allegation that Neiman Marcus had specifically done anything that made the data breach easier or had failed to do anything that could have prevented it. 794 F.3d 688, 696 (7th Cir. 2015). The court did not explain how the risk of identity theft could be fairly traceable to Nei-man Marcus when that risk was in fact the result of third party criminal action. See also Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963, 969 (7th Cir. 2016) (ignoring the intervening third party action between the defendant hacked company and the plaintiffs’ injury). We should not make this same mistake. The majority sends the case back to the district court for analysis of Nationwide’s motion to dismiss for failure to state a claim. Even were I to conclude that we have jurisdiction over this case, I do not believe a remand is necessary. The plaintiffs have not stated a claim for relief under the FCRA, because the complaint does not allege facts establishing that'Nationwide is a “consumer reporting agency” or that Nationwide “furnished” a “consumer report” within the statutory definitions. See, e.g., Dolmage v. Combined Ins. Co. of Am., No. 14 C 3809, 2015 WL 292947 , at *3-4 (N.D. Ill. Jan. 21, 2015); Burton v. MAPCO Express, Inc., 47 F.Supp.3d 1279, 1286-87 (N.D. Ala. 2014); see also Washington v. CSC Credit Servs. Inc., 199 F.3d 263, 265 (5th Cir. 2000) (“[T]he FCRA governs ‘consumer reporting agencies’ like Equifax and CSC [Credit Services] which maintain credit information on consumers and provide it to third parties.”). And the plaintiffs have certainly not alleged the level of causation necessary to plead a claim of negligence. See Whiting v. Ohio Dep’t of Mental Health, 141 Ohio App.3d 198 , 750 N.E.2d 644, 647 (2001) (quoting Strother v. Hutchinson, 67 Ohio St.2d 282 , 423 N.E.2d 467, 470-71 (1981)) (“ ‘[Proximate cause’ is generally established ‘where [a negligent] act ... in a natural and continuous sequence, produces a result that would not have taker). place without the act.’ ”). I respectfully dissent. . The majority cites to paragraph 32 of the complaints, which alleges that Nationwide "flagrantly disregarded and/or violated [the plaintiffs'] privacy rights, and harmed them in *393 the process, by failing to establish and/or implement appropriate administrative, technical and/or physical safeguards to ensure the security and confidentiality of [the plaintiffs' personal information and] to protect against anticipated threats to the security or integrity of such information.” This is a conclusory statement, not a factual allegation entitled to a presumption of truth. See Iqbal, 556 U.S. at 680-81 , 129 S.Ct. 1937 . . Even this is more specific than what the plaintiffs have pled here. --- Source: Frix Law Library, https://www.frixlaw.com/law-library/cases/8680430. Public record. Not legal advice.