In re SuperValu, Inc.

Full title: IN RE: SuperValu, Inc., Customer Data Security Breach Litigation This…

Court: UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MINNESOTA

Date published: Mar 7, 2018

Court File No. 14-MD-2586 ADM/TNL (D. Minn. Mar. 7, 2018)

Opinion

Court File No. 14-MD-2586 ADM/TNL

03-07-2018

IN RE: SuperValu, Inc., Customer Data Security Breach Litigation This Document Relates to: All Actions

Ben Barnow, Esq., Barnow and Associates, P.C., Chicago, IL; Kate M. Baxter-Kauf, Esq., Lockridge Grindal Nauen P.L.L.P., Minneapolis, MN, on behalf of Plaintiffs. Harvey J. Wolkoff, Esq., and David T. Cohen, Esq., Ropes & Gray LLP, New York, NY and Boston, MA; Katherine S. Barrett Wiik, Esq., and Stephen P. Safranski, Esq., Robins Kaplan LLP, Minneapolis, MN, on behalf of Defendant SuperValu, Inc. John L. Landolfi, Esq., Vorys, Sater, Seymour and Pease LLP, Columbus, OH; and Marc A. Al, Esq., Stoel Rives LLP, Minneapolis, MN, on behalf of Defendants AB Acquisition, LLC and New Albertson's Inc.

ANN D. MONTGOMERY U.S. DISTRICT JUDGE

MEMORANDUM OPINION AND ORDER

Ben Barnow, Esq., Barnow and Associates, P.C., Chicago, IL; Kate M. Baxter-Kauf, Esq., Lockridge Grindal Nauen P.L.L.P., Minneapolis, MN, on behalf of Plaintiffs. Harvey J. Wolkoff, Esq., and David T. Cohen, Esq., Ropes & Gray LLP, New York, NY and Boston, MA; Katherine S. Barrett Wiik, Esq., and Stephen P. Safranski, Esq., Robins Kaplan LLP, Minneapolis, MN, on behalf of Defendant SuperValu, Inc. John L. Landolfi, Esq., Vorys, Sater, Seymour and Pease LLP, Columbus, OH; and Marc A. Al, Esq., Stoel Rives LLP, Minneapolis, MN, on behalf of Defendants AB Acquisition, LLC and New Albertson's Inc.

I. INTRODUCTION

On December 14, 2017, the undersigned United States District Judge heard oral argument on Defendant SuperValu, Inc.'s ("SuperValu") Renewed Motion to Dismiss Plaintiffs' Consolidated Amended Class Action Complaint [Docket No. 78], Defendants AB Acquisition, LLC and New Albertson's, Inc.'s (together, "Albertson's") Renewed Motion to Dismiss Plaintiffs' Consolidated Amended Class Action Complaint [Docket No. 85], and Class Plaintiffs' Motion for Leave to Amend Their Amended Complaint Pursuant to Fed. R. Civ. P. 15(a)(2) [Docket No. 91]. For the reasons set forth below, SuperValu and Albertson's Motions are granted and Plaintiffs' Motion is denied.

II. BACKGROUND ¹

1 The factual background of this case is further detailed in this Court's January 7, 2016 Memorandum Opinion and Order [Docket No. 52] and the Eighth Circuit's August 30, 2017 Opinion [Docket No. 73], which are incorporated by reference. See In re: SuperValu, Inc., Customer Data Security Breach Litig., No. 14-2586, 2016 WL 81792 (D. Minn. Jan. 7, 2016) ("Dismissal Order"); In re: SuperValu, Inc., Customer Data Security Breach Litig., 870 F.3d 763 (8th Cir. 2017) ("Eighth Cir. Op.").

A. Data Breach

In this multi-district litigation case, sixteen named plaintiffs ("Plaintiffs") alleged they were harmed after computer hackers breached the payment-processing network owned by SuperValu. See Consolidated Am. Class Action Compl. ("Amended Complaint") [Docket No. 28] ¶¶ 16-45. Both SuperValu and Albertson's (collectively, "Defendants") used the network to process payment card transactions at more than 1,000 of Defendants' retail grocery stores. Id. ¶¶ 3-5. The hackers gained access to and installed malicious software on the payment-processing network in June 2014 and again in late July or early September 2014. Id. ¶¶ 4-6. The malicious software released and disclosed the Personal Identifying Information ("PII") of Plaintiffs and Class Members who used their payment cards at the affected stores. Id. ¶ 36. The PII included cardholder names, account numbers, expiration dates, card verification value ("CVV") codes, and personal identification numbers ("PINs"). Id. ¶¶ 1, 40, 42. Plaintiffs alleged the malware allowed hackers to harvest customers' PII from cash registers and other payment processing terminals at the time customers swiped their cards. Id. ¶¶ 36, 40. Hackers were also able to access customers' PII that had been improperly stored on Defendants' network after customers made purchases at Defendants' stores. Id. ¶ 41.

Of the sixteen named Plaintiffs whose data was allegedly stolen in the breach, only one Plaintiff, David Holmes ("Holmes"), alleged that his PII was misused. See id. ¶¶ 16-31. Holmes alleged that he:

shopped at the Shop 'n Save location [owned and operated by SuperValu] in Belleville, Illinois, and swiped his card through Defendants' POS [point of sale] terminals. On information and belief Holmes' PII was compromised as a result of Defendants' security failures. When the Data Breach was announced, Plaintiff Holmes spent time determining if his card had been compromised, including but not limited to, reviewing information released about the Data Breach and impacted locations. Shortly thereafter, Holmes noticed a fraudulent charge on his credit card, which took two weeks to replace. As a result of such compromise, Holmes suffered losses and damages in an amount yet to be completely determined, as such losses and damages are ongoing and include, but are not limited to, time spent monitoring his account information to guard against potential fraud.

Id. ¶ 31. Holmes' factual allegations do not state the date he shopped at the store, the date the charge was made to his credit card, the amount of the charge, or whether he was required to pay the charge. See id.

The other fifteen named Plaintiffs did not allege that their PII was misused. Rather, they alleged that the theft of their PII subjects them to an imminent risk that they will suffer identity theft in the future. Id. ¶ 60.

B. Procedural History

Following the breach, four putative class actions were filed in federal courts in Illinois, Minnesota, and Idaho. See, McPeak v. SuperValu, Inc., 14-cv-00899 (S.D. Ill., filed Aug. 18, 2014); Hanff v. SuperValu Inc., 14-cv-3252 (D. Minn., filed Aug. 25, 2014); Mertz v. SuperValu, Inc., 14-cv-04660 (D. Minn., filed Nov. 4, 2014); and Rocke v. SuperValu, Inc., 14-cv-00511 (D. Idaho, filed Nov. 26, 2014). In December 2014, the Judicial Panel on Multidistrict Litigation centralized the four complaints to this Court for coordinated pre-trial proceedings. See Transfer Order [Docket No. 1]. On June 26, 2015, pursuant to this Court's first Pretrial Order [Docket No. 14], Plaintiffs filed the Amended Complaint with sixteen named plaintiffs bringing claims on behalf of a putative class of persons affected by the data breach.

1. Defendants' Initial Motion to Dismiss

On August 10, 2015, Defendants moved to dismiss the Complaint under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). See Defs.' Mot. Dism. [Docket No. 33]. On January 7, 2016, this Court granted the motion pursuant to Rule 12(b)(1), finding that none of the Plaintiffs had alleged facts sufficient to establish Article III standing. See generally Dismissal Order. The Court held that Plaintiffs had not plausibly alleged a cognizable injury because (1) they failed to allege misuse of their PII or other harm that was traceable to the data breach, and (2) they had not alleged facts that plausibly suggested a substantial risk of future harm. Id. at *4-7.

In reaching this conclusion, the Court reasoned that because the Amended Complaint alleged only a single incident in which any Plaintiff's PII had been misused in the year and a half since the data breach affecting more than 1,000 stores had occurred, any future harm was speculative. Id. at *5. Future harm depended upon whether the hackers who accessed Defendants' network actually succeeded in capturing the information, whether the hackers would attempt to use the information, and whether their attempts would be successful. Id.

The Court also rejected Plaintiffs' additional theories of standing that were based upon: opportunity and mitigation costs, diminished value of Plaintiffs' payment card PII, delayed or inadequate notification of the data breach, invasion of Plaintiffs' privacy and breach of their PII confidentiality, and Plaintiffs' lost expectation of a bargained-for benefit. Id. at *7-8.

Finding that Plaintiffs lacked standing under Article III, the Court concluded that it was without subject matter jurisdiction to address Defendants' Rule 12(b)(6) argument that the Amended Complaint failed to state a claim for which relief can be granted. The Amended Complaint was dismissed without prejudice and final judgment was entered. Id. at *8; Judgment [Docket No. 53].

2. Plaintiffs' Rule 59(e) Motion

On February 4, 2016, Plaintiffs filed a post-judgment motion under Rule 59(e), seeking to vacate the judgment and dismissal of the Amended Complaint. See Pls.' Mot. Alter Amend J. [Docket No. 54]. Alternatively, Plaintiffs requested leave to amend the Amended Complaint but did not submit a proposed Second Amended Complaint. Id.

In support of their motion, Plaintiffs offered, for the first time, declarations of three credit union officers who averred that some payment cards issued by their respective institutions incurred fraudulent charges following the data breach. Id. Ex. 3 ("Anderson Decl."); Pls.' Index [Docket No. 61] Ex. 1 ("Malinowski Decl."), Ex. 2 ("Williams Decl."). Significantly, the declarations did not state that any of the compromised cards belonged to a named Plaintiff or that any cardholder incurred unreimbursed fraudulent charges or other bank charges. Id. Indeed, one declaration stated that the fraudulent charges on cards issued by that credit union were all "absorbed" by the institution. Anderson Decl. ¶ 6.

The Court denied the Rule 59(e) motion, finding: (1) Plaintiffs had not shown that they exercised diligence in obtaining the newly discovered evidence prior to judgment; and (2) none of the tardily filed declarations established that any named Plaintiff or potential class member suffered actual harm or faced a substantial risk of imminent future harm from the potential misuse of their PII. Mem. Op. Order, Apr. 20, 2016 [Docket No. 66] ("Rule 59(e) Order") at 5-7.

The Court also denied Plaintiffs' request for leave to amend the Amended Complaint because Plaintiffs had not satisfied the more stringent standards governing post-judgment leave to amend, and because Plaintiffs failed to comply with the requirement under Local Rule 15.1(b) that a motion to amend a pleading must include "a copy of the proposed amended pleading" and "a version of the proposed amended pleading that shows . . . how the proposed amended pleading differs from the operative pleading." Id. at 8 (quoting L.R. 15.1(b)) .

3. Appeal

Plaintiffs then appealed the Court's Dismissal Order to the Eighth Circuit, but did not appeal the denial of the Rule 59(e) motion. See Eighth Cir. Op. at 767 n.2 (declining to consider arguments raised in Plaintiffs' Rule 59(e) motion or declarations attached to the motion because Plaintiffs did not appeal the denial of the Rule 59(e) motion).

On appeal, Plaintiffs argued that the following three rulings in the Dismissal Order were erroneous: (1) that Plaintiffs had not adequately alleged the theft of their personal information, and that theft alone was not insufficient to confer Article III standing; (2) that Plaintiff Holmes did not have standing because the misuse of his PII was not fairly traceable to the Data Breach; and (3) that the breach of Plaintiffs' alleged implied contractual right to have their PII securely handled and reasonably protected was not sufficient to confer standing. See Appellant's Opening Br. (filed July 13, 2016 in Eighth Circuit Appeal No. 16-2378) at 2-3, 9. Defendants cross-appealed, arguing that the Amended Complaint was alternatively subject to dismissal under Rule 12(b)(6) for failure to state a claim upon which relief could be granted. Eighth Cir. Op. at 774 n.7.

On August 30, 2017, the Eighth Circuit "reverse[d] the district court's dismissal of plaintiff Holmes for lack of Article III standing, affirm[ed] the dismissal as to the remaining plaintiffs, and remand[ed] for further proceedings consistent with this order." Id. at 774.

In upholding the dismissal of the fifteen Plaintiffs who did not allege that their PII had been misused, the Eighth Circuit found that the Amended Complaint alleged only a "mere possibility," rather than a substantial risk, that Plaintiffs would suffer future identity theft or account fraud. Id. at 771.

The Eighth Circuit explained that the only factual support for the otherwise bare assertion that data breaches facilitate identity theft was a 2007 report by the United States Government Accountability Office ("GAO Report"), and this report did not support Plaintiffs' contention that they face a substantial risk of future harm as a result of the data breach. Id. at 770-71. The GAO Report stated that credit card information alone is generally not enough for identity thieves to open unauthorized new accounts. The Eighth Circuit noted that the PII alleged to have been stolen here was limited to credit card information and did not include personally identifying information such as social security numbers, birth dates, or drivers' license numbers. Additionally, the GAO Report concluded that "most breaches have not resulted in detected incidents of identity theft." Id. at 771 (quoting GAO Report at 21). The Eighth Circuit thus concluded that the GAO Report supported only a "mere possibility" of future injury. Id. Because the Amended Complaint did not plausibly demonstrate that the risk of future identity theft is substantial, Plaintiffs' allegations of future injury were not sufficient to confer standing. Id.

The Eighth Circuit also rejected Plaintiffs' attempt to establish injury based on other theories, including the costs Plaintiffs incurred to mitigate against the risk of identity theft, and Defendants' alleged breach of an implied contract to take reasonable measures to protect Plaintiffs' PII. Regarding mitigation costs, the Eighth Circuit held that "[b]ecause plaintiffs have not alleged a substantial risk of future identity theft, the time they spent protecting themselves against this speculative threat cannot create an injury." Id. As to the alleged breach of an implied contract, the Eighth Circuit held that "the complaint does not sufficiently allege that plaintiffs were party to such a contract. Therefore, the breach of implied contract claim does not supply plaintiffs with Article III standing." Id. at 771 n.6.

The Eighth Circuit declined to address other "independent forms of injury discussed by the district court, including the argument that the invasion of privacy suffered by the plaintiffs constitutes an injury in fact, because the plaintiffs did not press them on appeal." Id. at 771 n.5.

The Eighth Circuit held that Holmes, the Plaintiff who alleged that his stolen PII was misused in a single fraudulent charge, met the "relatively modest" burden of alleging a present injury that was fairly traceable to the data breaches. Id. at 772. Thus, Holmes was the only Plaintiff who satisfied the "threshold inquiry" of Article III standing. Id. at 773. However, the Eighth Circuit forecast that Defendants' attacks on the sufficiency of Holmes' allegations, including that he "failed to allege the date he shopped at the affected Illinois store, the amount of the charge, or that the charge was unreimbursed . . . could be fatal to the complaint under the 'higher hurdles' of Rules 8(a) and 12(b)(6)." Because the issue of whether Holmes' allegations were sufficient to state a claim under Rule 12(b)(6) raises a different question than Article III standing, the Eighth Circuit concluded that the challenges to the sufficiency of Holmes' allegations were "more properly directed at whether the complaint states a claim, not whether Holmes has alleged standing." Id.

The Eighth Circuit thus concluded that since one named Plaintiff, Holmes, has standing to bring suit, the case should not have been dismissed for lack of subject matter jurisdiction. Id. at 774. The Court of Appeals expressly declined to consider Defendants' Rule 12(b)(6) arguments on appeal and remanded them to this Court. Id. at 774 n.7.

C. Present Motions

Following the Eighth Circuit's remand for consideration of Defendants' Rule 12(b)(6) motion, SuperValu filed a renewed motion to dismiss under Rule 12(b)(6) for failure to state a claim. SuperValu argues that the claims by Holmes suffer from fatal defects, including the failure to allege that he shopped at SuperValu's stores during the relevant time period or that he suffered economic injury as a result of the data breach.

Albertson's also filed a renewed motion to dismiss, arguing that Holmes' claims against Albertson's should be dismissed under 12(b)(1) for failure to allege Article III standing. Albertson's contends that Holmes has not alleged that he shopped at an Albertson's store, and thus has not alleged an injury that is causally related to Albertson's or that can be redressed by a ruling against Albertson's. Albertson's also incorporates and adopts the arguments in SuperValu's renewed motion to dismiss under Rule 12(b)(6).

Approximately one week after Defendants filed their renewed motions to dismiss, Plaintiffs moved for leave to amend the Amended Complaint. Plaintiffs argue that the Proposed Second Amended Class Action Complaint ("Proposed Second Amended Complaint") [Docket No. 91, Ex. 1] includes additional factual allegations that support Article III standing for the dismissed Plaintiffs by showing that those Plaintiffs face a substantial risk of future injury. Plaintiffs contend that they are entitled to amend the Amended Complaint as a matter of course and that they should be permitted to amend before Defendants' renewed motions to dismiss are decided.

III. DISCUSSION

A. Plaintiffs' Motion for Leave to Amend the Amended Complaint

Plaintiffs argue that leave to amend the Amended Complaint is warranted under the liberal standard of Federal Rule of Civil Procedure 15(a). Plaintiffs contend that the Proposed Second Amended Complaint "adds allegations related to the increased risk of harm for plaintiffs previously dismissed for lack of standing, in addition to including additional allegations related to liability for Defendants." Mem. Supp. Class Pls.' Mot. Am. Compl. [Docket No. 93] at 4.

1. Legal Standard

The proper standard for granting leave to amend a complaint depends upon whether leave is sought before or after judgment has been entered. Pre-judgment leave to amend is governed by Federal Rule of Civil Procedure 15(a), which provides in relevant part:

(a) Amendments Before Trial.

(1) Amending as a Matter of Course. A party may amend its pleading once as a matter of course within:

(A) 21 days after serving it, or

(B) if the pleading is one to which a responsive pleading is required, 21 days after service of a responsive pleading or 21 days after service of a motion under Rule 12(b), (e), or (f), whichever is earlier.

(2) Other Amendments. In all other cases, a party may amend its pleading only with the opposing party's written consent or the court's leave. The court should freely give leave when

justice so requires.

Fed. R. Civ. P. 15(a).

"Although a pretrial motion for leave to amend one's complaint is to be liberally granted, different considerations apply to motions filed after dismissal." Humphreys v. Roche Biomedical Labs., Inc., 990 F.2d 1078, 1082 (8th Cir. 1993). "[I]nterests of finality dictate that leave to amend should be less freely available after a final order has been entered." United States ex rel. Roop v. Hypoguard USA, Inc., 559 F.3d 818, 823 (8th Cir. 2009). It is "well-settled that district courts in this circuit have considerable discretion to deny a [timely] post judgment motion for leave to amend because such motions are disfavored, but may not ignore the Rule 15(a)(2) considerations that favor affording parties an opportunity to test their claims on the merits." United States v. Mask of Ka-Nefer-Nefer, 752 F.3d 737, 742-43 (8th Cir. 2014) (internal quotations omitted) (alteration in original). Leave to amend after a judgment of dismissal "will be granted if it is consistent with the stringent standards governing the grant of Rule 59(e) and Rule 60(b) relief." Id. at 743 (citing Dorn v. State Bank of Stella, 767 F.2d 442, 443-44 (8th Cir. 1985)).

Whether leave to amend is sought pre judgment or post judgment, it is appropriately denied "where there are compelling reasons such as undue delay, bad faith, or dilatory motive, repeated failure to cure deficiencies by amendments previously allowed, undue prejudice to the non-moving party, or futility of the amendment." Moses.com Sec., Inc. v. Comprehensive Software Sys., Inc., 406 F.3d 1052, 1065 (8th Cir. 2005) (internal quotations omitted).

2. Analysis

a. Rule 15(a)(1) Does Not Apply

Plaintiffs contend that they are entitled to amend the Amended Complaint as a matter of course under Rule 15(a)(1), and that they filed their motion for leave to amend under Rule 15(a)(2) out of an abundance of caution. Plaintiffs argue that Rule 15(a)(1) applies because Plaintiffs sought leave to amend within 21 days of Defendants' renewed motions to dismiss under Rule 12(b). However, Defendants served an initial motion to dismiss under Rule 12(b) in August 2015, and Plaintiffs did not amend as a matter of course within 21 days after service of the initial Rule 12(b) motion. Therefore, Rule 15(a)(1) does not apply. See Rule 15(a)(1)(B) (permitting a party to amend its pleading "21 days after service of a motion under Rule 12(b)").

b. Compelling Reasons Exist to Deny Leave to Amend

Plaintiffs alternatively argue that leave to amend is proper under Rule 15(a)(2). Defendants concede that Rule 15(a)(2) applies to the surviving Plaintiff Holmes, but argue that the dismissed Plaintiffs must satisfy the more stringent standard of Rule 60(b) because judgment has been entered against them. Defendants also argue that regardless of whether Rule 15(a)(2) or Rule 60(b) applies, leave to amend should be denied based on undue delay and the futility of the proposed amendment.

The Court need not resolve the question of whether Rule 15(a)(2) or Rule 60(b) applies, because under either standard leave to amend is appropriately denied. The compelling reasons of undue delay and futility of the amendment both weigh strongly against granting leave to amend.

i. Futility

"[A] party is not entitled to amend a complaint without making a showing that such an amendment would be able to save an otherwise meritless claim. A district court thus may deny a motion to amend a complaint when such an amendment would be futile." Plymouth Cty., Iowa v. Merscorp, Inc., 774 F.3d 1155, 1160 (8th Cir. 2014) (internal citation omitted); see also Moses.com, 406 F.3d at 1065 (listing futility of amendment as basis for denial of leave to amend); Humphreys, 990 F.2d at 1082 ("It is settled law that district courts may properly deny leave to amend if the proposed changes would not save the complaint.").

A. New Allegations Fail to Cure Standing Deficiencies

Plaintiffs argue that the new allegations in the Proposed Second Amended Complaint provide the factual support that the Eighth Circuit required to support their allegation of a substantial risk of future injury. Defendants disagree and argue that the new allegations are insufficient to support Article III standing for the dismissed Plaintiffs.

None of the new allegations in the Proposed Second Amended Complaint are addressed specifically to a named Plaintiff. See generally Proposed Second Am. Compl. Rather, the new factual allegations contend that three credit union officers have reported that some payment cards issued by their institutions were compromised in the data breach, and that some accounts incurred fraudulent charges. Id. ¶¶ 76-78. The payment cards referenced, however, are not alleged to have belonged to any of the named Plaintiffs. See id. The proposed allegations also include information from three research reports regarding the frequency of credit card fraud and the sensitivity of credit card names and numbers. See id. ¶¶ 73, 81-82. Additionally, Plaintiffs seek to allege that "[t]he FBI estimated that, during 2014, more than 1,000 retailers were under assault with the same (or tweaked versions) of the malware that compromised Target and Home Depot." Id. ¶ 58.

The new allegations in the Proposed Second Amended Complaint do not cure the Article III deficiencies identified by the Eighth Circuit. The credit union allegations were considered by this Court in January 2016 when ruling on Plaintiffs' Rule 59(e) motion. In support of that motion, Plaintiffs submitted declarations by the same three credit union officers attesting to the same information that is now included in the Proposed Second Amended Complaint. Compare Proposed Second Am. Compl. ¶¶ 75-78 with Anderson Decl.; Malinowski Decl.; Williams Decl. In denying Plaintiffs' Rule 59(e) motion, which included a request for leave to amend the Amended Complaint, this Court concluded that the declarations would not alter the finding that Plaintiffs lacked Article III standing because the declarations "do not establish that any named Plaintiff . . . suffered actual harm or faces a substantial risk of imminent future harm from the potential misuse of their PII." Rule 59(e) Order at 7. Plaintiffs did not appeal that ruling, and the Court will not revisit its prior ruling. See Macheca Transp. Co. v. Philadelphia Indem. Ins. Co., 737 F.3d 1188, 1195-96 (8th Cir. 2013) ("A party who successfully obtains a remand following an initial appeal has already gotten a second bite at the apple. We should not permit such parties to hold in reserve an argument regarding a particular issue . . . just so they can attempt to receive yet [another] bite at the same apple . . . . To conclude otherwise would be unfair to opposing parties, encourage piecemeal appeals, and undermine our procedural efficiency."). Thus, it is futile for Plaintiffs to amend their complaint to allege Article III standing based on facts that this Court has already ruled are not sufficient to confer standing.

The new allegations drawn from the three research reports are similarly futile because the reports do not plausibly demonstrate a substantial risk that Plaintiffs will suffer from future identity theft or credit card fraud. One of the reports, the February 2014 Javelin Identity Theft Report (the "Javelin Report") states that "[n]early 40% of those whose card numbers were compromised in 2013 became fraud victims (46% if this card was a debit card)." Id. ¶ 73 (quoting Javelin Report). Thus, this report establishes that the majority of consumers whose payment cards are compromised in a breach will not become fraud victims as a result of the breach.

The other two research reports were published in 2010 and 2012 and discuss the technological ability to "link" information about an individual with other logically associated information about that individual. Id. ¶¶ 81-82. Plaintiffs argue that these allegations overcome the Eighth Circuit's observations that "compromised credit or debit card information, like the Card Information here, generally cannot be used alone to open unauthorized accounts," and that there was "little to no risk" that the Plaintiffs' stolen PII could be used to commit identity theft by opening unauthorized accounts. Eighth Cir. Op. at 770. However, the technology discussed in the 2010 and 2012 reports was in existence in 2013, the time period covered in the Javelin Report finding that fewer than half of consumers whose credit cards were compromised became victims of identity theft or credit card fraud. Thus, the allegations about the technological ability to link information are insufficient to tip the balance from a mere possibility to a substantial risk that Plaintiffs will suffer identity theft or credit card fraud in the future.

Similarly, the allegation that the FBI estimated that more than 1,000 retailers were attacked with the same or similar malware that compromised Target and Home Depot's computer networks does not cure the deficiencies to Article III standing identified by the Eighth Circuit. In determining that Plaintiffs failed to allege a substantial risk of future injury, the Eighth Circuit took as true the allegations that SuperValu's payment processing network had been attacked by malware. That numerous other retailers were also attacked has no bearing on whether the Plaintiffs here face a substantial risk of future injury.

Because Plaintiffs' proposed new allegations do not cure the Article III standing deficiencies identified by the Eighth Circuit, the Proposed Second Amended Complaint is futile.

B. Proposed Second Amended Complaint Fails Under 12(b)(6)

The Proposed Second Amended Complaint is futile for the additional reason that it cannot withstand Defendants' renewed motions under Rule 12(b)(6). For the reasons discussed in Section III.B.1. below, the Amended Complaint fails to state a claim upon which relief can be granted, and the new allegations in the Proposed Second Amended Complaint do not alter this result. Therefore, the Proposed Second Amended Complaint is futile and Plaintiffs' motion for leave to amend the Amended Complaint is denied on this basis.

ii. Undue Delay

Additionally, Plaintiffs' attempt to now include the credit union information in the Proposed Second Amended Complaint constitutes undue and prejudicial delay. Plaintiffs chose not to appeal this Court's previous ruling that the credit union information does not establish a substantial risk of future harm.

Although delay alone is not a sufficient reason to deny leave to amend a complaint, denial of leave to amend is proper where the delay results in prejudice to the opposing party. Buder v. Merrill Lynch, Pierce, Fenner & Smith, Inc., 644 F.2d 690, 694 (8th Cir. 1981). A court must balance the prejudice that would result to the opposing party if the motion for leave to amend were granted against the hardship to the moving party if the motion were denied. Id.

Here, Defendants spent considerable time and money on appeal litigating the issue of whether the Amended Complaint sufficiently alleged a substantial risk of future harm. The Eighth Circuit's extensive analysis of this issue did not include the credit union information because Plaintiffs did not appeal this Court's Rule 59(e) ruling. Eighth Cir. Op. at 767 n.2. Only after the Eighth Circuit has decided against Plaintiffs on the issue of whether they have sufficiently alleged a substantial risk of future harm do Plaintiffs resurrect the credit union arguments already rejected by this Court and not appealed to the Eighth Circuit. Allowing this eleventh hour attempt to resuscitate its complaint with previously rejected factual contentions is inexcusable delay which unfairly prejudices Defendants.

In resisting this conclusion, Plaintiffs argue that Defendants will not be prejudiced by the proposed amendment because this Court's dismissal of Plaintiffs' case was without prejudice to Plaintiffs' filing another action. However, Defendants would be prejudiced by having to defend a revived action that is based on previously rejected and unappealed arguments.

Plaintiffs also argue that they will be prejudiced if they are not allowed to amend because Defendants have purportedly failed to comply with Plaintiffs' discovery requests² regarding the circumstances of the data breach, and because Defendants stated in their press releases announcing the data breach that they had not determined whether cardholder data had in fact been stolen or misused. Plaintiffs contend that denial of leave to amend will prevent them from responding to Defendants' defenses after full discovery and from trying their claims on the merits.

2 This Court issued a Pretrial Order on April 28, 2015 permitting Plaintiffs to serve discovery requests "on the following topics: (1) Defendants' corporate structure, corporate relationships, and respective responsibilities with respect to payment-card data security; and (2) when the data breach occurred, the number of cards affected by the breach and whether data was taken or used." Pretrial Order No. 2 [Docket No. 15] ¶ A.3.

This argument misses the mark because the vehicle for redressing deficient discovery responses is a motion to compel discovery, not a motion for leave to amend the complaint. Perhaps recognizing the flaws in their argument, Plaintiffs filed a motion to compel discovery responses on January 31, 2018, more than two months after the present Motions were fully briefed, and more than six weeks after oral argument on the present Motions. See Pls.' Mot. Compel [Docket No. 109]; Min. Entry [Docket No. 108] (stating that a hearing was held on December 14, 2017 on Defendants' renewed motions to dismiss and Plaintiffs' motion for leave to amend Amended Complaint, and that the motions were taken under advisement). Rather than demonstrating hardship to Plaintiffs, the discovery motion serves as another example of Plaintiffs' dilatory conduct. If Plaintiffs' ability to allege Article III standing rests so critically upon the discovery responses, as Plaintiffs appear to contend, they should not have waited to move to compel those responses until after the case had been dismissed, appealed, remanded and undergone full briefing and argument on a second round of dispositive motions.³ Thus, Defendants' prejudice outweighs any purported hardship to Plaintiffs.

3 Plaintiffs' Motion to Compel was orally denied without prejudice by Magistrate Judge Tony N. Leung on February 27, 2018. See Min. Entry [Docket No. 124].

Accordingly, the motion for leave to amend the Amended Complaint is denied on grounds of both futility and undue delay.

B. Renewed Motions to Dismiss

1. SuperValu's Renewed Motion to Dismiss

SuperValu argues that the Amended Complaint must be dismissed under Rule 12(b)(6) because the only remaining Plaintiff, Holmes, fails to state a claim for relief under any of the Amended Complaint's six causes of action.

a. Rule 12(b)(6) Standard

Rule 12 of the Federal Rules of Civil Procedure states that a party may move to dismiss a complaint for failure to state a claim upon which relief can be granted. Fed. R. Civ. P. 12(b)(6). The court construes the pleadings in the light most favorable to the nonmoving party, and the facts alleged in the complaint must be taken as true. Hamm v. Groose, 15 F.3d 110, 112 (8th Cir. 1994).

Working in combination with Rule 8, Rule 12 requires the plaintiff's factual allegations to "raise a right to relief above the speculative level," and push claims "across the line from conceivable to plausible." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 570 (2007). In other words, the complaint must establish more than a "sheer possibility that a defendant has acted unlawfully." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A pleading must relate "enough facts to state a claim to relief that is plausible on its face." Twombly, 550 U.S. at 570. "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw a reasonable inference that the defendant is liable for the misconduct alleged." Iqbal, 556 U.S. at 678. Determining whether a complaint states a plausible claim for relief is "a context-specific task that requires the reviewing court to draw on its judicial experience and common sense." Id. "But where the well-pleaded facts do not permit the court to infer more than the mere possibility of misconduct, the complaint has alleged—but not 'shown'—'that the pleader is entitled to relief.'" Id. (quoting Fed. R. Civ. P. 8(a)(2)).

In contrast to Article III standing, which "presents only a 'threshold inquiry," Federal Rules of Civil Procedure 8(a) and 12(b)(6) present "higher hurdles," which require a plaintiff to "plead facts sufficient to 'raise a right to relief above the speculative level.'" Brown v. Medtronic, Inc., 628 F.3d 451, 459 (8th Cir. 2010) (quoting Twombly, 550 U.S. at 555); accord Eighth Cir. Op. at 773.

b. Choice of Law

As an initial matter, the Court must determine which state's law applies to the state law issues raised by sole Plaintiff Holmes' claims. A district court sitting in diversity typically applies the choice-of-law rules of the forum state in which it sits. Prudential Ins. Co. v. Kamrath of Am., 475 F.3d 920, 924 (8th Cir. 2007); In re Guidant Corp. Implantable Defibrillators Prods. Liab. Litig., 489 F. Supp. 2d 932, 934-35 (D. Minn. 2007). In multi-district litigation, however, the forum state is normally the state where the action was filed before it was transferred to the court presiding over the multi-district pretrial proceedings. Guidant, 489 F. Supp. 2d at 935. Holmes filed his original complaint in Illinois. Thus, the Court will apply Illinois choice-of-law rules.

For common law claims, Illinois courts typically apply the law of the state that bears the most "significant relationship" to the occurrence and the parties in the action. Gregory v. Beazer E., 892 N.E.2d 563, 581 (Ill. App. Ct. 2008) (tort); Champagnie v. W.E. O'Neil Constr. Co., 395 N.E.2d 990, 996 (Ill. App. Ct. 1979) (contract). SuperValu argues that Illinois has the most significant relationship to this case because it is where Holmes is domiciled and where he completed the transaction alleged in his claims. SuperValu thus contends that Illinois law governs Holmes' common law claims. Holmes does not argue otherwise and states that he "assumes Illinois law applies." Pls.' Mem. Opp'n SuperValu's Renewed Mot. Dism. [Docket No. 99] at 7. Therefore, the Court will apply Illinois law to Holmes' common law claims.

Similarly, Holmes' statutory claims are governed by Illinois' consumer protection statutes, because as an Illinois resident Holmes lacks sufficient contacts with other states to assert their consumer protection laws. See Ferrari v. Best Buy Co., No. 14-2956, 2015 WL 2242128, at *9 (D. Minn. May 12, 2015) ("[N]amed plaintiffs lack standing to assert claims under the laws of the states in which they do not reside or in which they suffered no injury.") (quoting Insulate SB, Inc. v. Advanced Finishing Sys., Inc., No. 13-2664, 2014 WL 943224, at *11 (D. Minn. Mar. 11, 2014)) (quoting in turn In re Ductile Iron Pipe Fittings (DIPF) Indirect Purchaser Antitrust Litig., No. 12-169, 2013 WL 5503308, at *11 (D.N.J. Oct. 2, 2013)).

c. Analysis of Claims

i. Negligence (Count III)

To state a valid cause of action for negligence under Illinois law, a plaintiff must plead "the existence of a duty owed by the defendant, a breach of that duty, and injury proximately resulting from that breach." Bogenberger v. Pi Kappa Alpha Corp., Inc., —N.E.3d—, 2018 WL 476648, at *4 (Ill. Jan. 19, 2018); Fox v. Cohen, 406 N.E.2d 178, 179 (Ill. App. Ct. 1980).

SuperValu argues that Holmes has not stated a valid claim for negligence because: (1) he has not plausibly alleged a cognizable injury proximately resulting from the data breach; (2) the economic loss doctrine bars his negligence claim; and (3) he has not alleged that SuperValu breached a duty to safeguard consumers' information.

A. Cognizable Injury

Based on earlier rulings in this case, Holmes' only remaining allegation of injury is that he experienced a fraudulent charge on his credit card.⁴ SuperValu argues this allegation fails to adequately allege a cognizable injury because Illinois law requires a plaintiff to plead out-of-pocket damage, and Holmes does not allege that he paid the fraudulent charge or that the loss was not reimbursed.

4 In the Dismissal Order, this Court rejected other theories of injury that were based upon mitigation costs, diminished value of payment card PII, delayed or inadequate notification of the data breach, invasion of privacy and breach of PII confidentiality, and lost expectation of a bargained-for benefit. See Dismissal Order at *7-*8. Plaintiffs chose not to appeal these rulings.

Under Illinois law, "(f)ailure to state sufficient facts to constitute a legally cognizable present injury or damage mandates dismissal" of a negligence claim. Yu v. Int'l Bus. Machs. Corp., 732 N.E.2d 1173, 1177 (Ill. App. Ct. 2000). Data breach cases in Illinois and elsewhere have repeatedly held that a cardholder's mere allegation of an unauthorized charge, unaccompanied by an out-of-pocket loss, is not sufficient to state an actionable injury. See, e.g., In re Barnes & Noble Pin Pad Litig., No. 12-08617, 2016 WL 5720370, at *1, *5-6 (N.D. Ill. Oct. 3, 2016) (dismissing under Rule 12(b)(6) due to plaintiff's failure to plead that unauthorized charges on her credit card resulted in economic or out-of-pocket damages); In re Hannaford Bros. Co. Customer Data Sec. Breach Litig., 613 F. Supp. 2d 108, 133-34 (D. Me. 2009) (holding that reimbursed charges cannot sustain an injury in tort or contract), rev'd on other grounds sub nom. Anderson v. Hannaford Bros. Co., 659 F.3d 151 (1st Cir. 2011); In re Sony Gaming Networks & Customer Data Sec. Breach Litig., 903 F. Supp. 2d 942, 963 (S.D. Cal. 2012) (stating that reimbursed charges were insufficient to adequately plead a cognizable injury); cf. Kuhns v. Scottrade, Inc., 868 F.3d 711, 718 (8th Cir. 2017) (holding plaintiff failed to allege actual damage where, although plaintiff alleged misuse of his data, he did not allege that he suffered "fraud or identity theft that resulted in financial loss from the use of [his] stolen PII").

Here, Holmes does not allege that he suffered an out-of-pocket loss from the unauthorized charge on his credit card. Rather, he merely states that he "noticed a fraudulent charge on his credit card statement and immediately cancelled his credit card." Am. Compl. ¶ 31. Although this allegation is sufficient to allege an injury in fact for purposes of Article III standing, it does not provide a basis for the Court to draw a reasonable inference that Holmes suffered monetary loss and thus a cognizable injury as the result of the charge. See Barnes & Noble, 2016 WL 57230370, at *4-6 (holding that plaintiffs had sufficiently alleged an injury in fact for Article III standing but nevertheless dismissing claim under Rule 12(b)(6) for failure to allege actual injury because plaintiffs did not allege that they lost money due to unauthorized charges); In re Michaels Stores Pin Pad Litig., 830 F. Supp. 2d 518, 527 (N.D. Ill. 2011) ("Michaels is correct that Plaintiffs suffered no actual injury . . . if Plaintiffs were reimbursed for all unauthorized withdrawals and bank fees and, thus, suffered no out-of-pocket losses. . . . However, because Plaintiffs allege they lost money, the Court can reasonably infer that Plaintiffs were not reimbursed for all fees and charges.") (emphasis added). Whether Holmes suffered monetary loss as a result of the fraudulent charge is entirely within his knowledge and requires no discovery from Defendants, yet Holmes has failed to allege this fact in the Amended Complaint and does not attempt to include it in the Proposed Second Amended Complaint. In the absence of this allegation, he fails to plead a cognizable injury.

In arguing that the mere allegation of a fraudulent charge is sufficient to plausibly allege a cognizable injury, Holmes cites four Illinois data breach cases in which the plaintiffs' allegations survived a motion to dismiss. See Pls.' Mem. Opp'n SuperValu's Renewed Mot. Dism. at 7-8. However, these cases are distinguishable. In each of those cases, plaintiffs alleged that they had experienced actual withdrawals of fraudulent charges from their bank accounts or sustained monetary losses such as bank fees caused by the charges. See Lewert v. P.F. Chang's China Bistro, Inc., No. 14-04787 (N.D. Ill. June 25, 2014) Compl. [Docket No. 1] ¶ 33 (alleging "monetary losses arising from unauthorized bank account withdrawals") (emphasis added); Remijas v. Neiman Marcus Grp., LLC, No. 14-01735 (N.D. Ill. June 2, 2014) Am. Compl. [Docket No. 27] ¶ 4 (alleging fraudulent charges on debit card); Allen v. Schnuck Mkts., Inc., No. 15-0061, 2015 WL 5076966, at *3 (S.D. Ill. Aug. 27, 2015) (alleging actual "financial losses caused by fraudulent charges to their compromised cards and bank fees associated with the data breach") (emphasis added); Michaels, 830 F. Supp. at 527 (alleging "monetary losses from unauthorized bank account withdrawals and/or bank fees charged to [plaintiffs'] accounts") (emphasis added). Unlike those cases, no factual allegations of bank account withdrawals, bank fees, or other monetary loss from fraudulent charges are included in the Amended Complaint or the Proposed Second Amended Complaint.

Holmes also argues that the Eighth Circuit held that he has already met the requirements for establishing his standing by pleading that he experienced a fraudulent charge on his account. However, as the Eighth Circuit explicitly recognized, Holmes' failure to allege the date he shopped at the affected store, the amount of the charge, or that the charge was not reimbursed "could be fatal to the complaint under the 'higher hurdles' of Rules 8 and 12(b)(6)." Eighth Cir. Op. at 773. This is because "standing under Article III presents only a 'threshold inquiry' requiring 'general allegations' of injury, causation and redressability." Id. (internal citations omitted).

Holmes also invokes the collateral source rule to argue that even if his loss was covered by a collateral source such as his financial institution, he is entitled to recover damages from Defendants. The collateral source rule applies where a plaintiff becomes liable to one party, and then that liability is discharged by a third party's payment. See Arthur v. Catour, 833 N.E.2d 847, 853 (Ill. 2005) (finding that insurance company was a collateral source where plaintiff "became liable" for medical bills and insurance company paid the medical provider). Here, Holmes has not alleged that he had an obligation to pay the charge. Moreover, as noted above, data breach cases decided under Illinois law repeatedly recognize that a cardholder's mere allegation of an unauthorized charge, unaccompanied by an out-of-pocket loss, is insufficient to state an actionable injury. See Barnes & Noble, 2016 WL 57230370, at *6; Michaels, 830 F. Supp. 2d at 527.

Holmes also argues that his allegations of time spent monitoring his account information to guard against potential fraud is a cognizable injury. However, time spent disputing an unauthorized charge and having a new card issued does not constitute actual injury or monetary loss. See Barnes & Noble, 2016 WL 5720370, at *5 (holding that plaintiff's allegations of spending time to dispute an unauthorized charge and have a new card issued were insufficient to plead that plaintiff "suffered any actual injury or monetary loss due to the fraudulent charge."). Holmes relies on the Seventh Circuit's decision in Remijas v. Neiman Marcus Group., LLC to argue that "identifiable costs associated with the process of sorting things out" constitute a cognizable injury for data breach victims. 794 F.3d 688, 691-97 (7th Cir. 2015). But Holmes alleges only time, not "costs" to monitor his account. Additionally, in Remijas, the Seventh Circuit was addressing whether the plaintiffs had sufficiently alleged a cognizable injury for purposes of Article III standing, not whether the plaintiffs had satisfied the higher hurdle of Rule 12(b)(6).

Even if the Amended Complaint sufficed to allege a cognizable injury, which it does not, the requisite element of causation has not been adequately alleged because the Amended Complaint does not state when Holmes shopped at the affected store or when the fraudulent charge was incurred. Indeed, Holmes does not even allege that the charge was incurred after the data breach. Rather, he merely alleges that he "noticed" the fraudulent charge shortly after the data breach. Amended Complaint ¶ 31. In the absence of such basic time and sequence allegations, the Amended Complaint does not plausibly show that the unauthorized charge proximately resulted from the data breach.⁵

5 Notably, in all four Illinois data breach cases on which Holmes relies to argue that the allegation of a fraudulent charge suffices to state an actionable injury under Rule 12(b)(6), the plaintiffs alleged the dates or date ranges during which they used their payment cards at the affected stores. See In re Michaels Stores Pin Pad Litig., No. 11-3350 (E.D. Ill. ) Am. Compl. [Docket No. 25] ¶¶ 16-19; Lewert Compl. ¶ 10; Remijas Am. Compl. ¶ 4; Allen, 2015 WL 5076966, at *1.

To resist this conclusion, Holmes argues that the allegations are sufficient to show causation because the Eighth Circuit has already accepted as true the allegations that Plaintiffs' PII was stolen in the data breach. Again, the Article III standing threshold is lower than that for a motion to dismiss under Rule 12(b)(6). Holmes also argues that it is premature to assume that the preliminary dates set forth in SuperValu's data breach notification letter are accurate, because that letter stated it was possible that additional time frames for the data breach would be identified after further investigation. However, without any allegation whatsoever as to when Holmes shopped at the store and when the fraudulent charge was incurred, the Court cannot draw a reasonable inference that the fraudulent charge proximately resulted from the data breach. Rather, the allegations establish only the sheer possibility that the charge was attributable to the data breach. Thus, the Amended Complaint does not show that Holmes is entitled to relief. See Iqbal, 556 U.S. at 679. ("[W]here the well-pleaded facts do not permit the court to infer more than the mere possibility of misconduct, the complaint has alleged—but not 'shown'—'that the pleader is entitled to relief.") (quoting Fed. R. Civ. P. 8(a)(2)).

Because Holmes has failed to allege a cognizable injury resulting from the data breach, his negligence claim fails to state a claim upon which relief can be granted.

B. Economic Loss

SuperValu argues that even if Holmes had alleged a cognizable injury resulting from the data breach, his negligence claim is barred by the economic loss doctrine, which prohibits recovery for purely economic claims sounding in negligence. The Court agrees.

Under Illinois law, the economic loss doctrine provides that a plaintiff may not recover for "purely economic losses under a tort theory of negligence." Michaels, 830 F. Supp. 2d at 528. The rationale underlying the doctrine is that "tort law affords the proper remedy for loss arising from personal injury or damages to one's property, whereas contract law and the Uniform Commercial Code provide the appropriate remedy for economic loss stemming from diminished commercial expectations without related injury to person or property." Id. Here, Holmes does not allege injury to his person or property as a result of the breach. Thus, his alleged losses are purely economic, and the economic loss doctrine is a further bar to his negligence claim.

Holmes argues that exceptions to the economic loss doctrine exist where a defendant breaches an extra-contractual duty owed to the plaintiff or where a special relationship exists between the parties. He contends that such exceptions apply here because: (1) SuperValu solicited customers' PII and thus had a duty to take reasonable measures to safeguard their data and notify them of an any data breach; and (2) a special relationship exists between Holmes, the putative class, and SuperValu arising from SuperValu's solicitation of customers' PII and representation that reasonable measures would be taken to safeguard the data. Similar arguments have been rejected by courts applying Illinois law in other data breach cases. See Id. at 528-31; In re Target Corp. Data Sec. Breach Litig., 66 F. Supp. 3d 1154, 1174 (D. Minn. 2014). Based on the persuasive reasoning in those cases, the Court concludes that Holmes' argued exceptions to the economic loss doctrine do not apply here.

C. Duty

SuperValu argues that Holmes' negligence claim fails for the additional reason that SuperValu did not have a common law duty to protect his personal information. "The existence of a duty under Illinois law is a question of law." USAA Fed'l Savings Bank v. PLS Fin'l Servs., Inc., 260 F. Supp. 3d 965, 969 (N.D. Ill. 2017) (citing Simpkins v. CSX Transp., Inc., 965 N.E.2d 1092, 1096 (Ill. 2012)). "Although the Illinois Supreme Court has not opined on the issue, the Illinois Appellate Court has refused to create 'a new legal duty beyond legislative requirements' to safeguard an individual's personal information or protect it from disclosure." Id. (quoting Cooney v. Chicago Pub. Schs., 943 N.E.2d 23, 28-29 (Ill. App. Ct. 2010)). Federal courts interpreting Illinois law have consistently declined to impose a common law duty to safeguard personal information in data security cases. See Landale Signs & Neon, Ltd. v. Runnion Equip. Co., No. 16-7619, 2016 WL 7409916, at *3 (N.D. Ill. Dec. 22, 2016) (listing cases). This Court similarly declines to recognize a common law duty to protect personal information where Illinois courts have not done so. Therefore, Holmes' negligence claim fails for the additional reason that it does not allege the existence of a duty owed by SuperValu. See Cooney, 943 N.E.2d at 29 ("Absent a duty, there is no negligence."). The negligence claim is dismissed for failure to state a claim upon which relief can be granted.

ii. Negligence Per Se (Count V)

Count V of the Amended Complaint alleges a claim for negligence per se. Holmes has conceded in prior briefing that his negligence per se claim fails under Illinois law, and he does not address the claim in his responsive brief to SuperValu's renewed motion to dismiss. See Pls.' Mem. Opp'n Defs.' Mot. Dism. [Docket No. 40] at 37 n.9; Pls.' Mem. Opp'n SuperValu's Renewed Mot. Dism. Therefore, Holmes' claim for negligence per se is dismissed for failure to state a claim upon which relief can be granted.

iii. Breach of Implied Contract (Count IV)

The Eighth Circuit, in addressing Article III standing, stated that "the complaint does not sufficiently allege that plaintiffs were party to such a contract." Eighth Cir. Op. at 771 n.6. Because Holmes' allegations fail to satisfy the threshold inquiry of standing to bring a breach of implied contract claim, the allegations obviously fall short of the higher hurdle of Rule 12(b)(6). The claim fails for the additional reason that Holmes has not sufficiently alleged an actual injury, which is a required element of his breach of implied contract claim. See Barnes & Noble, 2016 WL 5720370, at *4-6 (dismissing breach of implied contract claim for failure to allege damage as required under Illinois law). Thus, the claim for breach of implied contract is dismissed for failure to state a claim upon which relief can be granted.

iv. State Consumer Protection Statutes (Count I)

SuperValu argues that Holmes fails to state a plausible claim under the Illinois Consumer Fraud and Deceptive Business Practices Act, 815 Ill. Comp. Stat. 505/2 et seq. ("ICFA") and under the Illinois Uniform Deceptive Trade Practices Act, 815 Ill. Comp. Stat. 510/2 et. seq. ("UDTPA").

A. Illinois Consumer Fraud and Deceptive Practices Act

To state a claim under the ICFA, a plaintiff must allege that:

(1) the defendant engaged in a deceptive or unfair practice, (2) the defendant intended for the plaintiff to rely on the deception, (3) the deception occurred in the course of conduct involving trade or commerce, (4) plaintiff sustained actual damages, and (5) such damages were proximately caused by the defendant's deception.

Michaels, 830 F. Supp. 2d at 525 (citing Martis v. Pekin Mem'l Hosp. Inc., 917 N.E.2d 598, 603 (Ill. App. Ct. 2009).

SuperValu first argues that Holmes has failed to allege that he suffered actual damage. Section 10a of the ICFA provides that "[a]ny person who suffers actual damage as a result of a violation of this Act committed by any other person may bring an action against such person." 815 Ill. Comp. Stat. 505/10a(a) (emphasis added). Thus, "only a person who suffers actual damage may bring an action under the ICFA." Michaels, 830 F. Supp. 2d at 526. The actual damage element "requires that the plaintiff suffer actual pecuniary loss." Camasta v. Jos. A. Bank Clothiers, Inc., 761 F.3d 732, 739 (7th Cir. 2014).

As discussed above, Holmes has failed to allege that he suffered actual pecuniary loss. This omission is fatal to his claim under the ICFA. See Barnes & Noble, 2016 WL 5720370, at *6 (holding plaintiff failed to state a claim under ICFA where she had not alleged that she suffered out-of-pocket loss due to a fraudulent charge); accord Michaels, 830 F. Supp. 2d at 527 (stating that plaintiffs suffer no actual injury under the ICFA if they do not suffer out-of-pocket losses).

Holmes argues that damages under the ICFA are not limited to monetary damages and may include damages for lost time or aggravation. However, non-economic damages are recoverable under the ICFA "only when they are part of a total award that includes actual economic damages." Morris v. Harvey Cycle & Camper, Inc., 911 N.E.2d 1049, 1054 (Ill. App. Ct. 2009).

The absence of any actual damage also precludes Holmes' claim for injunctive relief under § 505/10a(c) of the ICFA. "It is well established under Illinois law that private rights of action for injunctive relief under the ICFA require damages." Schilke v. Wachovia Mortg., FSB, 820 F. Supp. 2d 825, 838 n.5 (N.D. Ill. 2011).

The claim under ICFA is dismissed for failure to state a claim upon which relief can be granted.

B. Illinois Uniform Deceptive Trade Practices Act

To maintain an action for injunctive relief under UDTPA, "a consumer must allege facts which would indicate that he is likely to be damaged in the future." Reid v. Unilever U.S., Inc., 964 F. Supp. 2d 893, 918 (N.D. Ill. 2013) (internal quotation marks omitted). Holmes argues that a likelihood of future injury exists because SuperValu experienced two data breaches in the past and still accepts payment cards. The Court disagrees. Even allowing Holmes the benefit of all reasonable inferences, the occurrence of two data breaches in a three month period and none in the three and a half years since suggests merely a possibility of a future data breach, not a likelihood of a future data breach. Because Holmes does not plausibly allege that he is likely to be damaged in the future, he cannot state a claim under the UDTPA.

The claim under UDTPA is dismissed for failure to state a claim upon which relief can be granted.

v. Illinois Data Breach Notification Statute (Count II)

In Count II of the Amended Complaint, Holmes asserts a claim under the Illinois Personal Information Protection Act ("PIPA"), 815 Ill. Comp. Stat. 530/10(a). The Amended Complaint refers to the PIPA as the Illinois data breach notification statute. See Am. Compl. ¶¶ 117-18. "The PIPA itself does not provide for a private cause of action to seek damages for violations." Best v. Malec, No. 09-7749, 2010 WL 2364412, at *7 (N.D. Ill. June 11, 2010). Rather, a violation of the PIPA "constitutes an unlawful practice under" the ICFA. 815 Ill. Comp. Stat. 530/20. Thus, "[t]he only provision for a private right of action under the PIPA is pursuant to the ICFA." Best, 2010 WL 2364412, at *7.

"While a violation of PIPA constitutes an unlawful practice under ICFA, there still must be actual damages to state a claim under ICFA." Barnes & Noble, 2016 WL 5720370, at *6 (internal citation and quotations omitted). As this Court held in the January 2016 Dismissal Order, Holmes has not alleged he suffered actual damage due to the allegedly delayed and inadequate notification of the data breach. Dismissal Order at *7. Again, this ruling was not challenged on appeal.

Holmes' claim for equitable relief under PIPA also fails. As stated above, Holmes is not entitled to injunctive relief under § 505/10a(c) of the ICFA because "private rights of action for injunctive relief under the ICFA require damages." Schilke, 820 F. Supp. 2d at 838 n.5.

Therefore, the claim for violation of the Illinois data breach notification statute is dismissed for failure to state a claim upon which relief can be granted.

vi. Unjust Enrichment (Count VI)

SuperValu argues that the Amended Complaint fails to state a claim for unjust enrichment. "To state a cause of action based on a theory of unjust enrichment, a plaintiff must allege that the defendant has unjustly retained a benefit to the plaintiff's detriment, and that defendant's retention of the benefit violates the fundamental principles of justice, equity, and good conscience." HPI Health Care Servs., Inc. v. Mt. Vernon Hosp., Inc., 545 N.E.2d 672, 679 (Ill. 1989).

Holmes' unjust enrichment claim is based on allegations that he conferred financial benefits to SuperValu by paying money for the purchase of goods, and had he known of the data breach he would not have shopped there. Holmes alleges that the financial benefits are a direct and proximate result of SuperValu's allegedly negligent practices and failure to inform him of the data breach, and that it would be inequitable for SuperValu to retain any of the financial benefits it would not have received but for its allegedly illegal conduct. Am. Compl. ¶¶ 151-157.

This claim lacks merit because Holmes admits that he obtained goods in exchange for the financial benefit he conferred upon SuperValu. Id. ¶ 151. Holmes does not allege that the goods he purchased were defective or that their value was somehow diminished by the data breach. Therefore, SuperValu did not obtain any unjust benefit. See Irwin v. Jimmy John's Franchise, LLC, 175 F. Supp. 3d 1064, 1072 (C.D. Ill. 2016) ("Irwin paid for food products. She did not pay for a side order of data security and protection; it was merely incident to her food purchase . . . ."). Additionally, the Seventh Circuit has repeatedly noted that arguments based on this theory have been adopted by courts only where the product itself was defective or dangerous. See Lewert v. P.F. Chang's China Bistro, Inc., 819 F.3d 963, 968 (7th Cir. 2016); Remijas, 749 F.3d at 694-95. The Seventh Circuit has consistently declined to take the additional step of extending this theory to data breach cases. See id. This Court similarly declines to extend the theory here.

Holmes also argues that SuperValu was unjustly enriched because it charged customers for the costs it incurs to maintain its electronic network security, but then diverted those funds elsewhere and left its network security vulnerable to intrusions. In the Dismissal Order, this Court considered and rejected this theory. See Dismissal Order at *8 (". . . Plaintiffs do not allege that the Data Breach diminished the value of the groceries or other goods they purchased from Defendants. Nor do Plaintiffs allege facts showing that the price they paid for goods included an amount that both parties understood would be allocated toward protecting customer data."). Plaintiffs did not appeal this ruling. The claim for unjust enrichment is dismissed for failure to state a claim upon which relief can be granted.

Because the Amended Complaint does not include sufficient factual allegations to state a plausible claim for relief on any of the counts asserted, SuperValu's motion to dismiss this action with prejudice⁶ is granted.

6 Dismissal with prejudice is appropriate because the Court concludes that any additional opportunity for amendment would be futile. Although the data breach occurred more than three years ago, Plaintiffs' proposed Second Amended Complaint included substantially the same allegations and theories of injury that had been rejected in this Court's prior ruling dismissing the case without prejudice. The absence of newly alleged injuries suggests that Plaintiffs do not have any other injuries that can sustain their claims for relief. See In re Barnes & Noble Pin Pad Litig., 2017 WL 2633398, at *4 (N.D. Ill. June 13, 2017) (dismissing a second amended complaint with prejudice because "[e]ven with the benefit of the Court's prior ruling, Plaintiffs primarily rested on the same theories of injury that had been rejected in the prior ruling," causing the Court to conclude that Plaintiffs do not have any other injuries that could ground their claims for relief.")

2. Albertson's Motion to Dismiss

Albertson's moves to dismiss under Rules 12(b)(1) and (6). Albertson's contends that the Amended Complaint must be dismissed under Rule 12(b)(1) because Plaintiff Holmes lacks Article III standing to assert claims against Albertson's, and standing is a prerequisite to subject matter jurisdiction. See Lujan v. Defenders of Wildlife, 504 U.S. 555, 559-60 (1992).

A plaintiff invoking federal jurisdiction must establish constitutional standing, which consists of three elements: (1) an injury in fact; (2) a causal connection between the injury and the challenged conduct of the defendant; and (3) a likelihood that a favorable ruling will redress the alleged injury. Young Am. Corp. v. Affiliated Computer Servs. (ACS), Inc., 424 F.3d 840, 843 (8th Cir. 2005) (citing Lujan, 504 U.S. at 560-61).

Albertson's argues that the second and third elements are lacking here because Holmes, the only remaining Plaintiff in this action, does not allege an injury that is causally connected to Albertson's or that could be redressed by a decision against Albertson's. Holmes' allegations are that he provided his PII in the course of shopping at Shop 'n Save, which is owned by SuperValu; that SuperValu announced that hackers had twice gained access to the portion of its computer network that processes payment card transactions; and that shortly after the intrusions were announced he noticed a fraudulent charge on his credit card statement. Am. Compl. ¶¶ 1-2, 4, 6, 31. The Amended Complaint acknowledges that the stores owned and operated by Albertson's are separate and distinct from those owned and operated by SuperValu. See id. ¶ 3 (alleging Albertson's operates grocery stores under the brand names "Albertson's, ACME Markets, Jewel-Osco, Shaw's, and Star Markets"), ¶ 2 (alleging SuperValu owns and operates grocery stores under brand names "Cub Foods, Farm Fresh, Hornbacher's, Shop 'n Save, and Shoppers Food & Pharmacy").

Holmes does not allege he had any interaction with an Albertson's store. Thus, he does not allege any injury that can be causally connected to Albertson's. Additionally, because Holmes does not name Albertson's in his underlying complaint in the Southern District of Illinois⁷ and does not assert a single allegation against Albertson's, there is no likelihood that a ruling against Albertson's will redress Holmes' alleged injury. Therefore, Albertson's is dismissed from this action pursuant to Rule 12(b)(1).

7 See McPeak v. SuperValu, Inc., 3:14-CV-00899 (S.D. Ill.) at Docket No. 8 ( First Amended Class Action Complaint).

Even if Holmes had standing to bring a claim against Albertson's, he has failed to state a plausible claim against Albertson's because his allegations and claims do not relate to Albertson's. Holmes' claims also fail for the reasons set forth in Section II.B.1., above. Thus, dismissal is also warranted under Rule 12(b)(6).

IV. CONCLUSION

Based upon the foregoing, and all the files, records, and proceedings herein, IT IS HEREBY ORDERED that:

1. Defendant SuperValu, Inc.'s Renewed Motion to Dismiss Plaintiffs' Consolidated Amended Class Action Complaint [Docket No. 78] is GRANTED;

2. Defendants AB Acquisition, LLC and New Albertson's, Inc.'s Renewed Motion to Dismiss Plaintiffs' Consolidated Amended Class Action Complaint [Docket No. 85] is GRANTED;

3. Class Plaintiffs' Motion for Leave to Amend Their Amended Complaint Pursuant to Fed. R. Civ. P. 15(a)(2) [Docket No. 91] is DENIED; and

4. The Consolidated Amended Class Action Complaint is dismissed with prejudice.

LET JUDGMENT BE ENTERED ACCORDINGLY.

BY THE COURT:

s/Ann D. Montgomery

ANN D. MONTGOMERY

U.S. DISTRICT JUDGE Dated: March 7, 2018.