NANETTE K. LAUGHREY, United States District Judge

Daniel Eric Blegen, Benjamin D. Mooneyham, GM Law PC, Michael W. Seitz, Spencer Fane LLP, Kansas City, MO, for Plaintiffs.

Robert A. Horn, Andrea S. McMurtry, Horn, Aylward & Bandy, LLC, Kansas City, MO, for Defendant.

ORDER

NANETTE K. LAUGHREY, United States District Judge

Defendant Warden Grier, LLP moves pursuant to Federal Rule of Civil Procedure 12(b)(6) to dismiss Counts I, II, and III of the complaint by plaintiffs Hiscox Insurance Company Inc. and Hiscox Syndicates Limited (together, "Hiscox"). Doc. 11. For the reasons discussed below, the motion to dismiss is denied.

I. Alleged Facts

Hiscox is an insurance provider that insures risks throughout the United States. As early as 2002, Hiscox, on its own behalf and on behalf of its insureds, entered into a working relationship for legal services with the law firm of Warden Grier. The relationship between Hiscox and Warden Grier was memorialized and governed, in part, by two separate contracts: (i) "Lawyers Terms of Engagement Non-Marine First Party Business, Effective 1st April 2011"; and (ii) "Lawyers Terms of Engagement Non-Marine Casualty Business, Effective 1 May 2011," both of which were signed by Hiscox and Warden Grier in 2011 (collectively, "Terms of Engagement"). The attorney-client relationship remains in effect.

In the course of the attorney-client relationship, Warden Grier requested, received, created, and/or otherwise obtained highly sensitive, confidential, and proprietary information, including protected health and personally identifiable information (collectively, "PI") belonging to Hiscox and/or Hiscox's insureds, all of whom were the clients of Warden Grier. Hiscox alleges that Warden Grier's "contractual, legal, ethical, and fiduciary duties" required it "to take adequate measures to protect sensitive PI belonging to Hiscox and Hiscox's insureds and to notify Hiscox of any failure to maintain the confidentiality of PI belonging to Hiscox and its insureds.

On or around December 2016, an international hacker organization gained unauthorized access to all of the sensitive information, including PI, stored on Warden Grier's servers (the "2016 Data Breach"). At some point, Warden Grier learned that the hackers stole PI during or as a result of the 2016 Data Breach. Warden Grier contacted outside attorneys and the FBI to investigate the 2016 Data Breach, but to Hiscox's knowledge, Warden Grier did not hire a forensic IT firm to investigate.

Warden Grier paid the hackers a ransom or other demand to protect its and its clients' personal information from dissemination. However, Warden Grier did not notify Hiscox or Hiscox's insureds of the 2016 Data Breach or of the payment of any ransom or other demand resulting from the 2016 Data Breach.

On March 28, 2018, an employee at Hiscox learned through social media that some of Hiscox's PI had been leaked on the "dark web." After a preliminary investigation, Hiscox learned that the PI made its way to the "dark web" as a result of the 2016 Data Breach.

On March 31, 2018, Hiscox requested a call with Warden Grier about the situation. During that call, Hiscox learned for the first time the details of the 2016 Data Breach. Hiscox promptly commenced its own investigation to evaluate whether it may have any notification obligations given the sensitive nature of the information in Warden Grier's possession and Warden Grier's purported failure to protect that information, to properly investigate the 2016 Data Breach, and to notify Hiscox and its insureds of the 2016 Data Breach. Hiscox decided to notify its insureds of the 2016 Data Breach and to engage in efforts to protect against further exposure or dissemination of PI, incurring in that process damages purportedly exceeding $1.5 million.

Hiscox asserts four claims against Warden Grier: breach of contract, breach of implied contract, breach of fiduciary duty, and negligence.

II. Standard

Federal Rule of Civil Procedure 12(b)(6) requires the dismissal of a complaint that fails to plead facts sufficient to state a plausible claim upon which relief may be granted. Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). In determining whether a complaint alleges sufficient facts to state a plausible claim to relief, the Court accepts all factual allegations as true. Great Plains Trust Co. v. Union Pac. R.R. Co. , 492 F.3d 986, 995 (8th Cir. 2007). If the facts alleged in the complaint are sufficient for the court to draw a reasonable inference that the defendant is liable for the alleged misconduct, the claim has facial plausibility and will not be dismissed. Iqbal , 556 U.S. at 678, 129 S.Ct. 1937.

III. Discussion

Warden Grier raises two arguments in support of its motion to dismiss Counts I through III of the complaint. First, Hiscox argues that Counts I through III allege a breach that "depends upon an attorney's negligent performance of professional services to a client," and therefore the claims must be treated as claims for attorney malpractice and dismissed as duplicative of Count IV. Finally, Warden Grier also argues that the claim for breach of implied contract cannot stand because there was an express contract between the parties and Hiscox has not adequately alleged a tacit understanding outside of that express contract. The Court considers these arguments in turn.

A. Whether Counts I, II, or III Are Properly Characterized as Legal Malpractice Claims Duplicative of Count IV and Therefore Subject to Dismissal

Warden Grier argues that the contract, implied contract, and fiduciary duty claims in Counts I through III turn on an alleged breach that "depends upon an attorney's ‘negligent performance of professional services’ to a client," and therefore each claim must be treated as one for professional negligence. Doc. 12, p. 4 (citing Rosemann v. Sigillito , 785 F.3d 1175, 1181 (8th Cir. 2015) ; Beare v. Yarbrough , 941 S.W.2d 552, 557 (Mo. Ct. App. 1997) ).

The Eighth Circuit has held that Missouri law bars a party from "cloth[ing] an attorney-malpractice claim as a claim of breach of contract or breach of a fiduciary duty." Rosemann , 785 F.3d at 1181. However, it is well established that "[c]lients may sue their attorneys for torts other than legal malpractice." Klemme v. Best , 941 S.W.2d 493, 496 (Mo. Banc 1997). The question for the Court is whether Counts I through III are improper attempts to re-package claims for attorney malpractice.

Warden Grier argues that Count IV is a legal malpractice claim because it "clearly alleges that Warden Grier owed a duty of reasonable care in light of the attorney-client relationship"—an element of a legal malpractice claim. Doc. 12, p. 4. Warden Grier argues that the first three Counts also are attorney malpractice claims in other guises because they each allege that "Warden Grier owed certain duties to Hiscox in the attorney-client relationship and Warden Grier breached these duties when it failed to promptly notify Hiscox of the 2016 Data Breach." Doc. 12, p. 3. With a particular focus on Counts III and IV, Warden Grier argues that "Hiscox clearly characterizes the same facts as both a breach of the standard of care and a breach of a fiduciary obligation and offers no allegations of duty independent of legal malpractice." Doc. 12, p. 7. Therefore, Warden Grier in effect argues, Count IV is duplicative of, and precludes, Counts I through III.

Hiscox, on the other hand, argues that, "although Defendant is a law firm, Plaintiffs' claims do not actually arise out of Defendant's provision of legal services, and instead arise from the more mundane area of Defendant's data security practices and Defendant's willful decision to not notify its clients, including Plaintiffs, when their data was compromised." Doc. 16, pp. 2-3.

In Count I, Hiscox alleges breach of the Terms of Engagement, which established an attorney-client relationship between Hiscox and Warden Grier, established "a contractual duty to protect Hiscox's PI," required Warden Grier to "retain either the originals or copies of all file documents relating to the claim" and to "have in place an appropriate disaster recovery plan with appropriate back-up to ensure the continuity of services in the event of a disaster," and implicitly imposed ethical obligations on Warden Grier "per the MISSOURI RULES OF PROFESSIONAL CONDUCT and the AMERICAN BAR ASSOCIATION MODEL RULES ... to keep secure client PI." Doc. 1 (Complaint) ¶¶ 25-29. Hiscox alleges that, by failing to protect the PI, failing to have appropriate measures in place to respond to the 2016 Data Breach, and failing to notify Hiscox and its insureds of the 2016 Data Breach, Warden Grier breached these duties, causing damages to Hiscox. Id. ¶¶ 30-32.

In Count II, Hiscox alleges, in the alternative, that the "attorney-client relationship ... between Hiscox and Warden Grier ... was governed by the Terms of Engagement and by implied contract." Id. ¶¶ 34-35. Hiscox paid Warden Grier for services rendered on its behalf and on behalf of Hiscox insureds. Id. ¶ 35. Hiscox alleges that, by failing to protect Hiscox's PI, failing to have appropriate measures in place to respond to the 2016 Data Breach, and failing to notify Hiscox and its insureds of the 2016 Data Breach, "Warden Grier materially breached the Terms of Engagement and all implied contracts," causing Hiscox damages. Id. ¶¶ 36-38.

In Count III, Hiscox alleges that, as "Hiscox's legal representation, Warden Grier was a fiduciary of Hiscox and, as such, Warden Grier owed fiduciary duties to preserve and protect Hiscox's and its insureds' interests." Id. ¶ 41. Warden Grier's failure to protect the PI, to adequately investigate the 2016 Data Breach, and to advise Hiscox that its PI had been compromised, purportedly constituted a breach of the firm's fiduciary duties and resulted in damages to Hiscox. Id. ¶¶ 42-43.

In each of these Counts, the "breach" at issue is of an alleged duty to protect clients' personal or otherwise sensitive information. Such a breach is not inherently dependent on an attorney's negligent performance of professional services, as evidenced by the plethora of cases alleging data breach by various service providers brought in courts across the country. See, e.g., Resnick v. AvMed, Inc. , 693 F.3d 1317, 1327–28, 1330 (11th Cir. 2012) (finding that Plaintiffs had alleged facts sufficient to state claims for negligence, breach of fiduciary duty, breach of contract, and breach of implied contract); Svenson v. Google Inc. , No. 13-CV-04080-BLF, 2015 WL 1503429, at *5 (N.D. Cal. Apr. 1, 2015) (denying motion to dismiss, inter alia , contract claim for data breach); cf. Rosemann , 785 F.3d at 1181 (holding that claims that allege "negligent performance of professional services" must be treated as claims for professional negligence) (emphasis added). Had the PI that Warden Grier stored for Hiscox and Hiscox's clients been maintained by a third-party vendor (like an e-discovery service provider), and had the alleged breach been caused by the third-party vendor rather than by Warden Grier itself, the claims against that vendor would not be said to be for legal malpractice, even if the PI was stored with the vendor because of the attorney-client relationship between Hiscox and Warden Grier. The allegation that Warden Grier maintained (or failed to maintain) the data itself does not necessarily transform the claim into one for legal malpractice.

Because the claims do not necessarily turn on professional negligence, they are not subject to dismissal at this stage on the ground that they are claims for legal malpractice under another guise. See Beshears v. Wood , No. 17-05048-RK, 2017 WL 6397496, at *2 (W.D. Mo. Dec. 14, 2017) ("[A] plaintiff may bring separate claims for legal malpractice and constructive fraud where the alleged breach of fiduciary duty is independent of any legal malpractice.") (citations omitted); PPW Royalty Tr. v. Barton , No. 14-00513, 2015 WL 13263507, at *13 (W.D. Mo. Jan. 30, 2015) ("The Missouri Supreme Court has distinguished a legal malpractice claim from a fiduciary duty claim, noting that a legal malpractice claim is based on the ‘attorney's duty to exercise due care or to honor express contract commitments’ while the fiduciary duty claim arises from the attorney's duties of loyalty and confidentiality." (quoting Klemme , 941 S.W.2d at 496 )), aff'd sub nom. PPW Royalty Tr. by & through Petrie v. Barton , 841 F.3d 746 (8th Cir. 2016), as amended (Oct. 28, 2016).

B. Whether Hiscox Has Failed to State a Claim for Breach of Implied Contract

Warden Grier next argues that Hiscox fails to state a claim for breach of implied contract. While there are two forms of implied contract—those implied in law and those implied in fact—only the latter is at issue here. A contract may be implied in fact where the parties' conduct reflects a tacit understanding outside of an express contract. Warden Grier, however, argues that Hiscox's allegations of a contract implied in fact are merely conclusory.

As a preliminary matter, Hiscox's claim for implied contract expressly is asserted in the alternative to its claim for breach of contract. Rule 8(d) of the Federal Rules of Civil Procedure "favors allowing Plaintiff to proceed on alternative theories." Doug Volz v. Provider Plus, Inc., Jeff Serafin , No. 15-0256 TCM, 2015 WL 3621113, at *4 (E.D. Mo. Jun. 9, 2015) (denying motion to dismiss plaintiff's alternative claims for breach of contract and unjust enrichment). As such, Hiscox may sue under both of the seemingly contradictory theories of express and implied contract. See, e.g., Guarantee Elec. Const. Co. v. LVC Techs., Inc. , No. 05-0849 JCH, 2006 WL 950204, at *2 (E.D. Mo. Apr. 10, 2006) ("Because a party may set forth two or more claims alternatively when it does not know upon what precise theory the evidence may entitle recovery, it is settled law that joining a count based on an expressed contract with a count based on quantum meruit does not create an inconsistency.").

Nonetheless, Warden Grier argues that "no recovery is available under an [implied-contract] theory when the parties have ‘entered into an express contract for the very subject matter’ for which the plaintiff seeks to recover." Doc. 12, p. 5 (quoting Lowe v. Hill , 430 S.W.3d 346, 349 (Mo. App. W.D. 2014) ). However, the case that Warden Grier cites, Lowe , actually supports Hiscox's position. In Lowe , the plaintiff had alleged only an implied-contract claim, and not an express contract claim. Yet, the evidence before the trial court showed that the plaintiff and defendant "entered into an express oral loan agreement." Id. At 349. The express contract reflected in the evidence precluded plaintiff's implied-contract claim. Plaintiff nonetheless asked the appellate court to "affirm the circuit court's judgment on a breach of contract theory." Id. at 350. The appellate court concluded that "having chosen her route by way of implied contract theories, [Plaintiff] must recover on those theories and those alone if she recovers at all." Id. (quotation marks and citation omitted). Thus, Lowe counsels in favor of, not against, permitting pleadings for both express and implied contract claims at the outset of an action.

As for Warden Grier's argument that the implied-contract claim is based on conclusory allegations, the Court finds it unpersuasive. Hiscox has alleged that the parties' relationship was governed only "in part" by express contracts, Doc. 1 ¶ 8; that in the course of the relationship, "Warden Grier requested, received, created, and/or otherwise obtained highly sensitive, confidential, and proprietary information, including protected health and personally identifiable information belonging to Hiscox and/or Hiscox's insureds," id. ¶ 9; and that, "per its contractual, legal, ethical, and fiduciary duties, Warden Grier was obligated to take adequate measures to protect sensitive PI," id. ¶ 10. These alleged facts plausibly give rise to the inference that Warden Grier took on an obligation, outside of the plain terms of the express contracts, to safeguard the PI. As such, there is no basis upon which to find that Hiscox failed to state a claim for breach of implied contract.

IV. Conclusion

For the foregoing reasons, Warden Grier's motion (Doc. 11) to dismiss Counts I, II, and III of the complaint is DENIED.