#### Matthew KUHNS, Individually and on behalf of all others similarly situated Plaintiff-Appellant/Cross-Appellee v. SCOTTRADE, INC., a Missouri Corporation Defendant-Appellee/Cross-Appellant

No. 16-3426, No. 16-3542

United States Court of Appeals, Eighth Circuit.

Submitted: April 5, 2017

Filed: August 21, 2017

*713Counsel who appeared on the brief and presented argument on behalf of the appellant/cross-appellee was Timothy. G. Blood, of San Diego, CA. Christopher Martin Hohn, of Saint Louis, MO. The following attomey(s) appeared on the appellant brief; Joseph J. Siprut, of Chicago, IL., Richard L. Miller, II, of ■ Chicago, IjL., Richard S. Wilson, of Chicago, IL., John G. Simon and Anthony G. Simon, both of St. Louis, Mo.

Counsel who appeared on the brief and presented argument on behalf of the ap-pellee/cross-appellant was Christopher Martin Hohn, of St. Louis, Mo. The following attorney(s) appeared on the appellee brief; Thomas Edward Douglass, of Saint Louis, MO., David Michael Mangian, of Saint Louis, MO., Brandi L. Burke, of Saint Louis, MO.

Before WOLLMAN and LOKEN, Circuit Judges, and ROSSITER,* District Judge.

*

 The Honorable Robert F. Rossiter, Jr., United States District Judge for the District of Nebraska, sitting by designation.

LOKEN, Circuit Judge.

In 2013, hackers, accessed the internal database of Scottrade, a securities brokerage firm based in St. Louis, Missouri. The hackers acquired personal identifying in*714formation (“PH”) of over 4.6 million Scot-trade customers, including plaintiff Matthew Kuhns, and exploited the information to operate a stock price manipulation scheme, illegal gambling websites, and a Bitcoin exchange. Kuhns and three others affected by the data breach brought putative class actions against Scottrade. After the actions were consolidated in the United States District Court for the Eastern District of Missouri, plaintiffs filed a Consolidated Class Action Complaint under the Class Action Fairness Act, 28 U.S.C. § 1332(d), asserting, as relevant here, claims of breach of contract, breach of implied contract, unjust enrichment, declaratory judgment, and violation of the Missouri Merchandising Practices Act (“MMPA”), Mo. Rev. Stat. § 407.025. The district court1 concluded plaintiffs lacked Article III standing because they had not suffered injury in fact and dismissed the Consolidated Complaint for lack of subject matter jurisdiction. The court’s judgment dismissed the Consolidated Complaint with prejudice. Kuhns appealed, and Scottrade filed a cross-appeal arguing that, even if plaintiffs have standing, Kuhns failed to state a claim upon which relief can be granted. We conclude that plaintiffs have Article III standing, at least for their contract-related claims. We affirm the dismissal with prejudice because the Consolidated Complaint did not state claims upon which relief can be granted.

I. Background,

When Kuhns opened a Scottrade account in 2005, he signed a Brokerage Agreement and provided Scottrade with his name, address, social security number, tax identification number, telephone number, employer information, and work history. The Brokerage Agreement provided that Kuhns agreed to pay Scottrade brokerage fees and commissions for purchases and sales of securities “on a per order basis.” Addendum 2 of the Brokerage Agreement was Scottrade’s “Privacy Policy and Security Statement” describing “how we protect your personal and financial information that we collect in the course of providing our financial services.”

The Statement explained that Scottrade collects customers’ PII but will “maintain physical, electronic and procedural safeguards that comply with federal regulations to guard your nonpublic personal information,” and “offers a secure server and password-protected environment ... protected by Secure Socket Layer (SSL) encryption.” In addition, the Consolidated Complaint alleges that an Online Privacy Statement represented: “We comply with applicable laws and regulations regarding the protection of personal information.... We use industry leading security technologies, including layered security and access controls over personal information.”2 A document available on Scottrade’s website represented: ‘We keep all customer information confidential and maintain strict physical, electronic and procedural safeguards to protect against unauthorized access to your information.”

Between September 2013 and February 2014, hackers successfully accessed Scot-*715trade’s customer databases, extracting the PII of more than 4.6 million Scottrade customers, including Kuhns. The hackers used the acquired PII to operate a stock price manipulation scheme and “operated a dozen illegal Internet gambling websites, and a Bitcoin exchange.” The FBI informed Scottrade of the data breach in August 2015. Scottrade sent affected customers a notice of the data breach 'on October 2, one week after the FBI advised Scottrade that it could inform its customers. The notice explained that customer PII may have been' compromised and encouraged customers to be “vigilant for the next 12 to 24 months and report any suspected incidents of fraud.” Scottrade arranged to have customers pre-qualified for one year of identity repair and protection services “with no enrollment required,” and offered customers free enrollment in one year of credit monitoring and identity theft insurance.

Plaintiffs’ Consolidated Class Action Complaint asserted that Scottrade provided deficient cybersecurity in violation of its “contractual and other obligations,” resulting in a data breach “by people willing to use the information for any number of improper purposes and scams, including making the information available for sale on the black-market.” Kuhns alleged that a portion of the fees paid in connection with his Scottrade account “were used for data management and security,” but “one or more data thieves ... transferred, sold, opened, read, mined and otherwise used Mr. Kuhns’ PII, without his authorization, to their financial benefit and his financial and other detriment.” The Complaint alleged that plaintiffs faced an immediate and continuing increased risk of identity theft and identity fraud; incurred financial costs of monitoring their credit and financial accounts to mitigate against that risk; received Brokerage Agreement services diminished in value and therefore overpaid Scottrade for those services; suffered economic damage from the decline in value of their PII; and suffered invasion of privacy and breach of confidentiality.

Scottrade filed a Motion to Dismiss for lack of subject matter jurisdiction and for failure to state a claim. The district court granted the Rule 12(b)(1) Motion to Dismiss for lack of subject matter jurisdiction because plaintiffs did not have standing to bring their claims. Kuhns (but not the other plaintiffs) appeals that ruling. The district court did not address Scottrade’s fully briefed Rule 12(b)(6) Motion to Dismiss for failure to state a claim. Scottrade urges us to affirm the Rule 12(b)(1) dismissal and in a cross appeal urges us to dismiss for failure to state a claim. With the appeal fully briefed and awaiting oral argument before this court, Kuhns filed a motion to voluntarily dismiss his appeal and to dismiss Scottrade’s cross-appeal. Kuhns argued that the litigation should proceed in a California action filed by Kuhns’s attorneys on behalf of a non-appealing co-plaintiff following the district court’s dismissal, which had been remanded to state court based on the district court’s ruling that there was no federal subject matter jurisdiction.

II. Standing.

We review a district court’s dismissal for lack of subject matter jurisdiction *de novo.*Diversified Ingredients, Inc. v. Testa, 846 F.3d 994, 995 (8th Cir.), cert. denied, — U.S. —, 137 S.Ct. 2247, 198 L.Ed.2d 679 (2017). Like the district court, we consider Scottrade’s facial attack on jurisdiction based on the face of the Consolidated Complaint and on other materials necessarily embraced by the pleadings, such as relevant contract documents. See Zean v. Fairview Health Servs., 858 F.3d 520, 526-27 (8th Cir. 2017). We accept all fact allegations as true, and make all rea*716sonable inferences in favor of Kuhns. Carlsen v. GameStop, Inc., 833 F.3d 903, 908 (8th Cir. 2016).

Constitutional standing (as opposed to statutory standing) is a threshold question that determines whether a federal court has jurisdiction over a plaintiffs claims. Article III extends judicial power only to “cases” and “controversies.” This limitation imposes as an “irreducible constitutional minimum” the burden on plaintiff Kuhns to establish that he personally “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable'judicial decision.” Spokeo, Inc. v. Robins, — U.S. —, 136 S.Ct. 1640, 1647, 194 L.Ed.2d 635 (2016) (quotation omitted). In this case, the issue is whether Kuhns suffered an injury in fact, that is, “an invasion of a legally protected interest that is concrete and particularized and actual or imminent, not conjectural or hypothetical.” Id. at 1548 (quotations omitted); see Clapper v. Amnesty Int’l, USA, 568 U.S. 398, 133 S.Ct. 1138, 1147, 185 L.Ed.2d 264 (2013).

Though Kuhns asserted, and the parties briefed, additional alleged types of injury in fact, we conclude he has standing regarding his breach of contract and contract-related claims based on allegations that he did not receive the full benefit of his bargain with Scottrade. Kuhns alleges that a portion of the fees paid in connection with his Scottrade account were used to meet Scottrade’s contractual obligations to provide data management and security to protect his PII. "Vj/hen Scottrade breached those obligations, Kuhns received brokerage services of lesser value. He asserts that the difference between the amount he paid and the value of the services received is an actual economic injury that establishes injury in fact for his contract-related claims.

We have previously explained that “a party to a breached contract has a judicially cognizable interest for standing purposes, regardless- of the merits of the breach alleged.” Gamestop, 833 F.3d at 909 (quotation omitted). In Gamestop, a customer of an online .video-game publisher sued the publisher for breach of contract, alleging the publisher breached its contractual privacy policy, by sharing the customer’s PII with Facebook, and the customer suffered damages in the form of a devaluation of his subscription. The district court .dismissed for lack of subject matter jurisdiction, concluding the alleged overpayment was not injury in fact. Though we affirmed the dismissal because plaintiffs complaint failed to state a claim, we reversed the district court’s conclusion that plaintiff lacked standing. Noting-that “it is crucial ,.. not to conflate Article. Ill’s requirement of injury in fact with a plaintiffs potential causes of actipp,” we concluded plaintiff alleged a concrete and particularized breach of contract and “actual” injury. Id. (alterations omitted); cf. Spok-eo, 136 S.Ct. at 1551 (Thomas, J., concurring).

Gamestop is controlling here. Kuhns alleged that he bargained for and expected protection of his PII, that Scottrade breached the contract when it failed to provide promised reasonable safeguards, and that Kuhns suffered actual injury, the diminished value, of his bargain. Whatever the merits of Kuhns’s contract claim, and his related claims for breach of implied contract and unjust enrichment,, he has Article III standing to assert them. See ABF Freight Sys., Inc. v. Int’l Bhd. of Teamsters, 645 F.3d 954, 960-61 (8th Cir. 2011). We decline to consider the other standing issues.

III. Failure to State a Claim.

“When a district court erroneously dismisses under Rule 12(b)(1) a claim that *717is clearly meritle'ss, an appellate court may affirm under Rule 12(b)(6).” GameStop, 833 F.3d at 910 (quotations omitted); see Morrison v. Nat’l Australia Bank Ltd., 561 U.S. 247, 130 S.Ct. 2869, 2877, 177 L.Ed.2d 535 (2010). Because Scottrade filed a cross appeal, we may take up the Rule 12(b)(6) issue even if it would afford additional relief. See Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 697 (7th Cir. 2015), We consider whether Kuhns failed to state a claim because the parties fully briefed the issue on appeal.

“To survive [a] motion to dismiss for failure to state a claim,” a Complaint must “alleg[e] sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” OmegaGenesis Corp. v. Mayo Found. for Med. Educ. & Research, 851 F.3d 800, 804 (8th Cir. 2017) (quotation omitted). A claim is plausibly pleaded when its “factual context ... allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. (quotation omitted),

1. The Consolidated Complaint alleges that Scottrade breached an express contract, because Kuhns paid for data security services that Scottrade did not provide. Both parties agree that the Brokerage Agreement governed the relationship and incorporated the Privacy Statement. The Privacy Statement represented that, “[t]o. protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings.” The contract also represented that Scottrade provides Secure Socket Layer encryption.

The Consolidated Complaint alleges that Scottrade breached the Brokerage Agreement because it “did not comply with applicable laws and regulations as described herein or otherwise adequately safeguard or protect Plaintiffs’ ... personal data from being accessed and taken. Scottrade did not maintain sufficient security measures and procedures to prevent unauthorized access.” These assertions do not plausibly allege a breach of contract. First, representations of conditions Scottrade will maintain are in the nature of contract recitals. If Scottrade misrepresented those conditions, Kuhns might have a claim for fraud in the inducement of the contract. But no such claim was asserted. Indeed, there was no alleged misrepresentation, just bare assertions that Scoftrade’s efforts failed to protect customer PII.

Second, even if the security representations can be construed as promises of contract performance, the lengthy Consolidated Complaint fails to allege a specific breach of the express contract. Plaintiffs do not identify a single “applicable law and regulation” that Scottrade allegedly breached regarding its data security practices.3 Kuhns does not allege that Scot-trade affirmatively promised that its customer data would not be hacked, and such a promise may not be plausibly implied. The allegation that “Scottrade did not maintain sufficient security measures and procedures to prevent unauthorized access” does not assert more than the mere possibility of misconduct: it is possible that Scottrade breached the Brokerage Agreement, but we have nó idea how. The implied ‘ premise that because data was hacked Scottrade’s protections'must have been inadequate is a “naked assertion[] devoid of further factual enhancement” that cannot survive a motion to dismiss. *718Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quotations omitted).

Third, though we have concluded it alleged breach-of-cohtract injury in fact, the Consolidated Complaint failed to plausibly allege the actual damage that is an element of a breach of contract claim. As described, the hackers stole PII data and used that data in several illegal schemes. But Kuhns does not contest Scottrade’s assertion that no customer affected by the 2013 data breach suffered fraud or identity theft that resulted in financial loss from use of their stolen PII in the more than two years that passed between the data breach and the filing of the Consolidated Complaint. See In re Barnes & Noble Pin Pad Litig., No. 12-CV-08617, 2016 WL 5720370 at *1, *4-5 (N.D. Ill. Oct. 3, 2016). Massive class action litigation should be based on more than allegations of worry and inconvenience.

The Complaint alleged that Kuhns overpaid for Scottrade because a portion of its services were for data management and security. But the Brokerage Agreement expressly provided for the purchase and sale of brokerage services in executing securities transactions “on a per order basis.” Given the express terms of this contract, the allegation that the failure of Scottrade’s security measures was a breach of contract that diminished the benefit of Kuhns’s bargain is not plausible. See Gamestop, 833 F.3d at 911-12.

2. Kuhns’s claims for breach of implied contract and unjust enrichment must be dismissed for the same failure to allege plausible claims. Kuhns alleges that Scottrade led him to believe it would protect PII and asserts breach of this implied contract because Scottrade did not take reasonable measures to protect the data. But we are left to guess how Scottrade failed to take “industry leading” security measures. The unjust enrichment claim also fails because, under Missouri and Florida law (one of which governs Kuhns’ claims), a plaintiff cannot recover under an equitable theory such as unjust enrichment when an express agreement covers the same subject matter. See 32nd St. Surgery Ctr., LLC v. Right Choice Managed Care, 820 F.3d 950, 955-56 (8th Cir. 2016); White Constr. Co. v. Martin Marietta Materials, Inc., 633 F.Supp.2d 1302, 1334 (M.D. Fla. 2009). Kuhns concedes the Brokerage Agreement expressly covered the subject of customer data security. The claim also fails because the Consolidated Complaint “does not allege that any specific portion of [Kuhns’s brokerage services fees] went toward data protection.” Gamestop, 833 F.3d at 912.

3. Kuhns’s bare bones claim for declaratory relief is virtually unintelligible, asking the court to declare that Scottrade must “stop its illegal practices.” Kuhns’s appeal briefs explained that this claim seeks relief regarding Scottrade’s current practices and compliance with the Brokerage Agreement. But the Consolidated Complaint focuses on past conduct, the 2013 data breach, not on Scottrade’s current practices, Kuhns cites no precedent for the notion that the Declaratory Judgment Act provides federal courts with authority to order a party to “obey your contract.” In an action seeking declaratory judgment relief in a contract dispute, “Article III considerations include whether the contractual dispute ... can be immediately resolved by a judicial declaration of the parties’ contractual rights and duties.” Maytag Corp. v. International Union, UAW, 687 F.3d 1076, 1082 (8th Cir. 2012). At a minimum, this claim does not meet Iqbal’s pleading standard.

4. Finally, Kuhns asserted a claim under the MMPA, a state consumer pro*719tection statute. The MMPA provides a private right of action to any person who sustains ascertainable loss in connection with the purchase or lease of merchandise as a result of certain practices declared unlawful. Mo. Rev. Stat. § 407.025(1). The statute supplements the common law definition of fraud. See Amburgy v. Express Scripts, Inc., 671 F.Supp.2d 1046, 1057 (E.D. Mo. 2009). Section 407.020(1) declares unlawful the use of “any deception, fraud, false pretense, false promise, misrepresentation, unfair practice or the concealment, suppression, or omission of any material fact in connection with the sale or advertisement of any merchandise.”

Kuhns asserts that Scottrade engaged in “fraudulent and deceptive acts and omissions” from its “failure to properly implement adequate, commercially reasonable security measures ... in the face of Scottrade’s repeated representations and assurances to the contrary,” its failure to warn plaintiffs their information was at risk, and its failure to discover and immediately notify affected customers of the data breach. Kuhns alleges that he suffered “lost money and property as a result of Scottrade’s violations.” This claim must be dismissed for several reasons. First, the allegation that Scottrade engaged in “fraudulent and deceptive acts” is a claim that sounds in fraud that was not pleaded with the particularity required by Rule 9(b) of the Federal Rules of Civil Procedure. See OmegaGenesis, 851 F.3d at 804. Second, to be actionable under the MMPA, the alleged unlawful act must occur in relation to a sale of merchandise, and an ascertainable pecuniary loss must occur in relation to the plaintiffs purchase or lease of that merchandise. See Grawitch v. Charter Commc’n, Inc., 750 F.3d 956, 960 (8th Cir. 2014); Amburgy, 671 F.Supp.2d at 1057. While intangible services may qualify as merchandise, Scottrade did not sell data security services; it put data security measures in place to induce customers to voluntarily transfer their PII to Scottrade to obtain its brokerage services. Cf. Amburgy, 671 F.Supp.2d at 1057-58. The Consolidated Complaint also fails to plausibly allege how failing to discover and notify customers of the data breach qualifies as an unfair or deceptive trade practice under the statute.

For the foregoing reasons, the judgment of the district court dismissing the Consolidated Class Action Complaint is affirmed. We deny Kuhns’s untimely motion to dismiss the appeal and the cross appeal.

1

. The Honorable Shirley Padmore Mensah, United States Magistrate Judge for the Eastern District of Missouri, who was designated to exercise jurisdiction over the proceedings with the consent of the parties. See 28 U.S.C. § 636(c)(1).

2

. The Online Privacy Statement did not apply to Kuhns's account. It explicitly stated that “[i]f you are a United States resident ... how we collect, use, and share your account information is governed by the Scottrade Privacy Statement. To the extent that there is a discrepancy between the Online Privacy Policy and the Scottrade Privacy Statement, you should look to the Scottrade Privacy Statement.”

3

. Kuhns’s brief on appeal acknowledged that his breach of contract claim "does not specifically rely on Scottrade’s failure to comply with federal law.”