# United States Court of Appeals For the First Circuit

Nos. 10-2384; 10-2450

JOHN ANDERSON, JESSICA CHOATE, MICHAEL CYR, ELIZABETH DOWD, STEVE EARLEY, CYNDI FEAR, THOMAS FEAR, MARK FOLLANSBEE, CARLTON GREELY, ROBERT HANSON, BRUCE HATCH, PAULINE HATCH, JOHN HUTCHINGS, NANCY HUTCHINGS, ROBERT JENKINS, PAMELA LAMOTTE, PAMELA MERRILL, JEANNE SMITH, EILEEN TURCOTTE, LORI VALBURN AND PAMELA WILLIAMS, Plaintiffs, Appellants/Cross-Appellees,

v. HANNAFORD BROTHERS CO., Defendant, Appellee/Cross-Appellant, DELHAIZE AMERICA INC., and KASH N' KARRY FOOD STORES INC., Defendants, Appellees.

APPEAL FROM THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF MAINE [Hon. D. Brock Hornby, U.S. District Judge]

Before Lynch, Chief Judge, Torruella and Thompson, Circuit Judges.

Peter L. Mu r ray , with whom Thomas C. Newman, Nicole L. Bradick, Murray, Plumb & Murray, Lewis Saul, and Lewis Saul Associates were on brief, for appellants/cross-appellees.

Clifford H. Ruprecht, with whom William J. Kayatta, Jr., Catherine R. Connors, Joshua D. Dunlap, and Pierce Atwood LLP were on brief, for appellees/cross-appellant.October 20, 2011LYNCH, Chief Judge . Plaintiffs appeal from the dismissal

of their Maine state law claims arising out of the unauthorized use of their credit and debit card data after hackers breached the electronic payment processing system of defendant Hannaford Brothers Co., where plaintiffs had shopped for groceries and used those cards.

The district court determined that plaintiffs failed to state a claim under Maine law for breach of fiduciary duty, breach of impl i e d warranty, strict liability, and failure to notify customers of the data breach. Al though the district court concluded that the plaintiffs adequately alleged breach of implied contract, negligence, and violation of the unfair practices portion of the Maine Unfair Trade Practices Act (UTPA), the district court di smissed those claims because it determined the plaintif f s ' alleged injuries were too unforeseeable and speculative to be cognizable under Maine law. In re Hannaford Bros. Co. Customer Data Sec. Breach Litig., 613 F. Supp. 2d 108 (D. Me. 2009).

We a f f i rm i n part and reverse in part. We affirm the district court's dismissal of all claims other than the plaintiffs' negligence and implied contract claims. We rever s e the district court's dismissal of the plai nt iffs' negligence and implied contract claims as to certain categories of alleged damages because plaintiffs' reasonably foreseeable mitigation costs constitute a cognizable harm under Maine law.

-2-I. The facts as alleged by plaintiffs in their consolidated putative class action complaint are as follows.

Hannaford is a national grocery chain whose electronic payment processing system was breached by hackers as early as December 7, 2007. The hackers stole up to 4.2 million credit and 1 debit card numbers, expiration dates, and security codes, but did not steal customer names. On February 27, 2008, Visa Inc. notified Hannaford that Hannaford's system had been breached. Hannaford discovered the means of access on March 8, 2008, and contained the breach on March 10, 2008. Hannaford gave notice to certain financial institutions on March 10, 2008. On March 17, 2008, "Hannaford publicly announced for the first time that between December 7, 2007 and March 10, 2008, the security of its information technology systems had been breached, leadi ng to the theft of as many as 4.2 million debit card and credit card numbers belonging to individuals who had made purchases at more than 270 of its stores." It also announced "that it had already received

Defendants Hannaford and Kash N' Karry Food Stores, Inc. 1 (Kash N' Karry) are wholly-owned subsidiaries of defendant Delhaize America, Inc. At the time of the breach, Hannaford provided electronic payment processing services to Kash N' Karry and to several independently owned stores. As provider of these services, Hannaford has agreed to assume the liability of Kash N' Karry, Delhaize, and any such independently owned stores. We refer to all of these entities as Hannaford.

The putative class period is from December 7, 2007 to March 10, 2008. -3-repo rt s of approximately 1,800 cases of fraud resulting from the

theft of those numbers. " The unauthorized charges originated in locations across the globe, including New York, Spain, and France.

Following Hannaford's announcement, some financial institutions immediately cancelled customers' debit and credit cards and issued new cards, while others did not do so, telling the cardholder they wished to wait for evidence of unauthorized

a ctivity before taking action. Further, as alleged i n the complaint, "financial institutions who did not immediately cancel customers' cards monitored customer accounts for unusual activity

and cancelled cards immediately upon being aware of apparent fraudulent charges or attempts to ma ke apparently fraudulent charges, in many cases, without the knowledge of the customer." Additional "customers suffered unauthorized charges to their debit card and credit card accounts." Moreover, "customers who requested that their cards be cancelled were required to pay fees to issuing banks for replacement cards" and "customers purchased i dent ity theft insurance and credit monitoring services to protect themselves against possible consequences of the breach."

The Judicial Panel on Multidistrict Litigation consolidated twenty-six separate suits against Hannaford arising out of the breach into one lawsuit in the District of Maine. The consolidated complaint alleged that at least fourteen of the named plaintiffs actually had unauthorized charges charged against their

-4-accounts. Seventeen o f the named plaintiffs had their cards

cancelled by the bank, and two named plaintiffs requested that their issuers give them replacement cards.

The plaintiffs alleged seven causes of action: (1) breach of implied contract; (2) breach of implied warranty; (3) breach of duty of a confidential relation s hip; (4) failure to advise customers of the theft of their data; (5) strict liability; (6) negligence; and (7) violation of the Maine UTPA. Plaintiffs sought damages as well as injunctive relief in the form of credit monitoring and notification of prec i sely what information was stolen. Hannaford moved to dismiss all claims, and the parties agreed that Maine law would govern the dispute.

Plaintiffs allege that Hannaford customers, including the plaintiffs, experienced more than the 1 , 8 0 0 unauthorized charges to their accounts which were known to Hannaford when it made its announcement on March 17. Plaintiffs also plead that they experienced several categories of losses said to be compensable damages for those plaintiffs who incurred them, including the cost of replacement card fees when the issuing bank declined to issue a replacement card to them, fees for accounts overdrawn by fraudulent charges, fees for altering pre-authorized payment arrangements, loss of accumulated reward points, inability to earn reward points during the transition to a new card, emotional distress, and time and e f fort spent reversing unauthorized charges and protecting

-5-against further fraud. In addition, they claim damages for the

purchase of identity theft/card protection ins urance and credit monitoring services.

In a carefully reasoned opinion, the district courtgranted Hannaford's motion to dismiss as to twenty of the twentyone named plaintiffs. In re Hannaford, 613 F. Supp. 2d 108 (D. 2 Me. 2009). The district court dismissed four of the plaintiffs'

seven claims -- breach of warranty , b re ach of fiduciary duty, failure to notify, and strict liability -- after con c l uding that the plaintiffs had not alleged facts stating a basis for these claims under Maine law. The district court allowed the implied contract, negligence, and UTPA claims to proceed.

Fo r these three surviving claims, the district court concluded that dismissal depended on whethe r the plaintiffs' alleged injuries as pled were cognizable under Maine law. Id. at 131. To make this determination, the district court divided the plaintiffs into three categories. Id. at 131-35. The district court determined that the first category, composed of p l a i ntiffs

The district court held that plaintiff Pamela LaMotte 2 could proceed beyond the pleading stage because she was the only plaintiff to allege unreimbursed fraudulent charges to her account. In re Hannaford Bros. Co. Customer Data Sec. Breach Litig., 613 F. Supp. 2d 108, 133 (D. Me. 2 009). Shortly after the district court's opinion, however, LaMotte notified the court that her bank had reimbursed all unauthorized charges to her account . Because she no longer suffered any direct financial loss, the district court determined that her claim could no l onge r p ro ceed. In re Hannaford Bros. Co. Customer Data Sec. Breach Litig., 671 F. Supp. 2d 198, 199 (D. Me. 2009). -6-who did not have fraudulent charges posted to their accounts, could

not recover because their claims for emotional distress are not cognizab l e unde r Maine law. Id. at 131-33. The district court concluded that the second category, composed of the single plaintiff whose fraudulent charges had not been reimbursed, could recover for her actual financial losses. Id. at 133.

As to the third category, composed of plaintiffs whose fraudulent charges had been reimbursed, the district court determined that their alleged consequential losses we re " t oo remote, not reasonably foreseeable, and/or speculative (and under the UTPA, not a 'substantial injury')." Id. at 134. In particular, the district court explained, the claimed overdraft fees, loss of accumulated reward points, and loss of opportunities to earn reward points were not foreseeable at the time of sale. Id. at 134-35. Further, the district court determined that there

was no way to value or compensate the time and effort that

consumers spent to reverse or protect against losses, and that there was no allegation to justify the claim for identity theft insurance since no personally identifying information was alleged to have been stolen. Id. As a result, the district court determined that this third category of plaintiffs could not

recover.

-7-Finally, the district court denied the plaintiffs'

requested injunctive relief because the named plaintiff s had already cancelled their compromised cards. Id. at 135.

After the district court ruling, the plaintiffs moved to certify several questions to the Maine Supreme Judicial Court (the 3 "Law Court"). The district court certified two questions:

(1) In the absence of physical harm or economic loss or i dentity theft, do time and effort alone, spent in a reasonable effort to avoid or remediate reasonably foreseeable harm, constitute a cognizable injury for which damages may be recovered under Maine law of negligence and/or implied contract? (2) If the answer to que stion # 1 is yes under a ne gl i gence claim and no under an implied contract claim, can a plaintiff suing for negligence recover damages under Maine law for purely economic harm absent personal injury, physical harm to property, or misrepresentation? In re Hannaford Bros. Co. Customer Data Sec. Breach Litig., 671 F. Supp. 2d 198, 201 (D. Me. 2009). The Law Court accepted the certification and answered the first question in the ne gat ive,

The plaintiffs moved to certify four que stions: (1) 3 whether an implied contractual term can be limite d t o reasonable care; (2) whether the use of credit and debit cards i n me r chant transactions creates a fiduciary duty; and whether time and effort alone constitute (3) cognizable injury under the common law; or (4) a substantial injury under the Maine UTPA. In re Hannaford Bros. Co. Customer Data Sec. Breach Litig., 660 F. Supp. 2d 94, 98 (D. Me. 2009). Hannaford asked the district court to certify a fifth question regarding the scope of the economic loss doctrine. Id. at 99. The district court concluded that Maine law was clear as to the first, second, and fourth questions, but not as to the third or fifth questions. Id. -8-agreeing with the district court that time and effort alone do not

constitute a cognizable harm under Maine Law. In re Hannaford Bros. Co. Customer Data Sec. Breach Litig., 4 A . 3 d 492, 498 (Me. 2010). Observing that "[l]iability in negligence . . . ordinarily requires proof of personal injury or property damage," the Law Court declined to expand Maine negligence law by recognizing time and effort alone as a harm. Id. at 496. Similarly, the Law Court noted that "[n]ot every con s e quence of a breach of contract is a cognizable injury" and that contract damages are generally more restricted than compensatory damages for tort. Id. at 497. Accordingly, the Law Court concluded that time and effort alone do not represent a cognizable injury recoverable in implied contract. Id. Havi ng answered the first question in the negative, the Law Court found it unnecessary to address the second question. Id. at 498. In light of the Law Court's opinion, the district court ordered the parties to show cause why judgment should not be entered in favor of Hannaford on all claims. The parties offered

no response and the district court entered judgment in favor of Hannaford.

Plaintiffs have appealed the district court's decision regarding the fiduc i a ry duty, breach of implied contract, negligence, and Maine UTPA claims. Hannaford has cross-appealed from the district court's determinations that the plaintiff s had

-9-adequately pled a basis for an implied contract of reasonable care

apart from any tort duty, and that a private remedy under the Maine UTPA might lie even absent a loss resulting from the purchase of a consumer good or service. II.

We review de novo the grant of a motion to dismiss, "accepting as true all well-pleaded facts, analyzing those facts in the light most hospitable t o the plaintiff's theory, and drawing all reasonable inferences for the plaintiff." United States ex rel. Hutcheson v. Blackstone Med., Inc., 647 F.3d 377, 383 (1st Cir. 2011). To survive a motion to dismiss, a complaint must "set forth 'factual allegations, either direct or inferential, respe ct i ng each material element necessary to sustain recovery under some actionable legal theory.'" Gagliardi v. Sullivan, 513 F.3d 301, 305 (1st Cir. 2008) (quoting Centro Medico del Turabo, Inc. v. Feliciano de Melecio, 406 F.3d 1, 6 (1st Cir. 2005)). A. Failure to State a Claim as to Theory of Cause of Action

1. Fiduciary/Confidential Relationship Plaintiffs argue that Hannaford owed a fiduciary duty to protect their credit and debit card data, which it breached. Although plaint i f fs concede that the basic grocery purchase transaction doe s no t give rise to a fiduciary relationship, they argue that a fiduciary relationship arises in the context of credit

-10-and debit card use because the customer trusts the merchant to

safeguard her credit or debit card information.

We agree with the district court that the plaintiffs' facts do not make out a confidential re l at i onship with Hannaford 4 and so Hannaford did not owe a f iduciary duty. To state a claim for fiduciary duty under Maine law, a plaintiff must: (1) allege "the actual placing of trust and confidence" in the defendant; (2) "show that there is some disparity in the bargaining positions of the parties;" and (3) show "that the dominant party has abused its position of trust." Leighton v. Fleet Bank of Me., 634 A.2d 453, 457-58 (Me. 1993). The plaintiffs' pleading fails to satisfy these three elements.

First, the plaintiffs have not shown the "trust and confidence" contemplated by Maine confidential relationship cases. Under Maine law, a "fiduciary relationship has been de s c r ibed as 'something approximating business agency, professional relationship, or family tie impelling or inducing the t ru s ting party to relax the care and vigilance ordinarily exercised.'" Bryan R. v. Watchtower Bible & Tract Soc. of N.Y., Inc., 738 A.2d 839, 846 (Me. 1999) (quoting L.C. v. R.P., 563 N.W.2d 799, 801-02 (N.D. 1997)). Accordingly, Maine decision s typically find a

I t is important to note for terminology purposes that 4 under Maine law, a "fiduciary relationship is the same as a confident i a l relationship, which gives rise to the same duties." Stewart v. Machias S av . Bank, 762 A.2d 44, 46 n.1 (Me. 2000) (citing Ruebsamen v. Maddocks, 340 A.2d 31, 36 (Me. 1975)). -11-"plac i ng o f trust and confidence" in the context of family

relationships, joint ventures, or partnerships. See, e.g., Ruebsamen v. Maddocks, 340 A.2d 31 (Me. 1975) (family context); Wood v. White, 122 A. 177 (Me. 1923) (joint venture context). The Maine courts have extended the rule to lender/borrower relationships, but only where one party has a re l at i onship which has permitted it to take advantage of the other in order to use or acquire the other's assets. See Stewart v. Machias Sav. Bank, 762 A.2d 44 (Me. 2000). The plaintiffs do not allege such a relationship here; there are no allegations that this relationship

was anything other than an ordinary arms-length commercial transaction.

Second, the plaintiffs have not pled facts demonstrating disparate bargaining power between the plaintiffs and Hannaford. In the commercial context, the Maine Law Court has required an especially heightened dispa r i t y of power. The plaintiffs must allege "diminished emotional or physical capacity or . . . the letting down of all guards and bars." Stewart, 762 A.2d at 46 (omission in o r i ginal) (quoting Diversified Foods, Inc. v. First Nat'l Bank of Bos., 605 A.2d 609, 615 (Me. 1992)) (internal quotation marks omitted) (holding that a creditor-debtor relationship is not a confidential relationship without a showing of diminished capacity or special vulnerability). Here, the customer is free to use cash or checks, as well as credit or debit

-12-cards, to buy groceries. The customer is free to purchase

groceries elsewhere. Indeed, plaintiffs fail to distingu i s h themselves from any other credit or debit card user in any

comme r c ial setting. See Bryan R., 738 A.2d at 847 (dismissing a claim for breach of fiduciary duty where, inter alia, plaintiff did not allege that his relationship with the defendant church was "distinct from [the defendant church's] relationships with any other members").

Third, the plaintiffs fail to allege facts demonstrating that Hannaford abused a position of trust. Under Maine law, breach of fi du c i a ry duty claims typically require a showing that the dominant party used its position of trust to obtain something from the subordinate party, "acquiring rights in that [property] antagonistic to the person with whose i nte rests he has become associated." Wood, 122 A. at 179 (quoting Trice v. Comstock, 121 F. 620, 627 (8th Cir. 1903)) (internal quotation mark omitted). As the district court noted, there is no suggestion in the complaint that Hannaford provided anything but a fair exchange in groceries in return for the customers' payments or somehow took advantage of the system of allowing customers to u s e cards. In re Hannaford, 613 F. Supp. 2d at 123.

2. Implied Contract Hannaford cross-appeals from the district court's determination that plaintiffs have made out a claim for an implied

-13-contract. Under Maine law, a "contract i n c ludes not only the 5 promises set forth in express words, but, in addition, all such implied provisions as are indispensable to effectuate the intention of the parties and as arise from the language of the contract and the circumstances under wh i ch it was made." Seashore Performing Arts Ctr., Inc. v. Town of Old Orchard Beach, 676 A.2d 482, 484 (Me. 1996) (quoting Top of the Track Assocs. v. Lewiston Raceways, Inc., 654 A.2d 1293, 1295 (Me. 1995)). The existence of such an implied contract term is determined by the jury, wh i ch considers

Hannaford also argues that the implied contract claim must 5 fail because it is redundant with the plaintiffs' claim for negligence. Hannaford did not make this argument to the district court, so it is waived. See Lamex Foods, Inc. v. Audeliz Lebrón Corp., 646 F.3d 100, 112 n.15 (1st Cir. 2011). Even so, the argument fails on its own terms. Hannaford's argument depends on an analogy to the me di cal malpractice context, in which Maine cou rt s have held implied contract claims to be redundant with claims for negligence. See Johnson v. Carleton, 765 A.2d 571 (Me. 2001); Woolley v. Henderson, 418 A . 2 d 1 1 2 3 (Me. 1980). In so holding, however, these courts have explained that the rule is particular to the medical malpractice context, where "[r]ecognizing the continued vitality of implied contract as an independent cause of action would be fundamentally inconsistent with the modern view that malpractice actions should be predicated on a single basis of liabil i t y - - deviation from the professional standard of care." Johnson, 765 A.2d at 573 n.3 (quoting Woolley, 41 8 A . 2d at 1135) (internal quotation mark omitted). These courts have reasoned that imp l i e d contract is "inadequa[te] . . . as a comprehensive liability base in malpractice actions," Woolley, 418 A.2d at 1135, because a duty "exists though there is clearly no cont ra ctual relation s h ip between the patient and the physician," id. at 1134 (quoting Kozan v. Comstock, 270 F.2d 839, 845 (5th Cir. 1959)). In this case, by contrast, the relationship between Hannaford and its customers was born of a commercial transaction, which imposed contractual obligations separate and apart from the ordinary duty of reasonable care. -14-whe the r the term is indispensable to effectuate the intention of

the parties.

The district court correctly concluded that a jury could reasonably find an implied contract between Hannaford and its customers that Hannaford would not use the credit card data for other people's purchases, would not sell the data to others, and would take reasonable measures to protect the information. In re Hannaford, 613 F. Supp. 2d at 119. When a customer uses a credit card in a commercial transaction, she intends to provide that data to the me r chant only. Ordinarily, a customer does not expect

-- and certainly does not intend -- the merchant to allow unauthorized third-parties to access that data. A jury could reasonably conclude, therefore, that an implicit agreement to safeguard the data is necessary to effectuate the contract.

3. Maine Unfair Trade Practices Act, Me. Rev. Stat.

tit. 5, §§ 205-A to 214 The district court held that the plaintiffs' allegations stated a claim under the Maine UTPA that Hannaford's failure to disclose the data theft p romptly, and possibly its failure to maintain reasonable security systems, was unfair and decept ive. Id. at 128-31. Nonetheless, the district court concluded that the claim failed because the p l a i ntiffs did not allege substantial loss. Id. at 134. We agree that the plaintiffs' claim fails, but for different reasons.

-15-Section 207 of the Maine UTPA, entitled " Unlawful Acts

and Conduct," provides that "[u]nfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade

or commerce are declared unlawful." Me. Rev. Stat. tit. 5, § 207. Under the statute, in defining whether a practice is unlawful, the Maine legislature directed that guidance be sought from the interp re t ations of the Federal Trade Commission Act (FTCA). Id. § 207(1) ("It is the intent of the Legislature that in construing this section the courts will be guided by the interpretations given by the Federal Trade Commission and the Federal Courts to Section 45(a)(1) of the Federal Trade Commission Act (15 U.S.C. § 45(a)(1)), as from time to time amended.").

The Maine courts have looked gene ra lly to the FTCA to determine whether "the act or practice causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by counte rva i ling benefits to consumers or to competition." S e arles v. Fleetwood Homes of Pa., Inc., 878 A.2d 509, 519 n.10 (Me. 2005) (quoting 15 U.S.C. § 45(n)) (internal quotation marks omitted).

Further, "[i]n determining whether an act or practice is unfair," Maine courts "consider established pub lic policies as evidence to be considered with all other evidence. Such public policy considerations may not serve as a primary basis for such

-16-determi nation." Id. (quoting 15 U.S.C. § 45(n)) (internal

quotation marks omitted).

The Maine UTPA provides for two different enforcement mechanisms: enforcement by the state's Attorney General, Me. Rev. Stat. tit. 5, § 209, and a private cause of action, id. § 213. The Attorney General may seek injunctive relief and may also seek civil penalties for violation of the injunction, including restoration to private i ndivi duals of any ascertainable loss. Id. § 209. The issue here concerns the limits for private causes of action.

Section 213, entitled "Private Remedies," as amended in 1991, provides a private cause of action under the statute:

Any person who purchases or leases goods, services or property, real or personal, primarily for personal, family or household purposes and thereby suffers any loss of money or property, real or personal, as a result of the use or employment by another person of a method, act or practice declared unlawful by section 207 or by any ru l e o r regulation issued under section 207, subsection 2 may bring an action either in the Superior Court or District Court for actual damages, restitution and for such other equitable relief, including an injunction, as the court determines to be necessary and proper. Id. § 213(1).

The text requires that the plaintiff suffer a los s of

money or property as a result of the unlawful act. By vi rtue o f 6

Given our dispo s i t i on, we do not reach Hannaford's 6 argument on cross-appeal that there is an absence of loss resulting from the purchase of goods or services. -17-a 1991 amendment, damages may be awarded, as well as restitutionary

relief. By its literal terms, section 213 does not itself impose

a substantial loss requirement, but the Maine Law Court has so interpreted the statute when considering section 207 in conjunction with section 213. See McKinnon v. Honeywell Int'l, Inc., 977 A.2d 420, 427 (Me. 2009) ("[A] plaintiff [must] suffer 'loss of money or property' before bringing a private action to recover . . . [and] the injury suffered must be substantial.").

The parties actively dispute whether plaintiffs' claims, viewed individually, make out substantial injury, or whether, given the nature of the event, plaintiffs' claims of harm may be viewed

as a collective whole as to substantial injury. I n Tungate v. MacLean-Stevens Studios, Inc., the Law Court said that "[t]he substantial injury requirement is designed to weed out 'trivial or merely speculative harms.'" 714 A.2d 792, 797 (Me. 1998) (quoting Legg v. Castruccio, 642 A. 2 d 9 06, 917 (Md. Ct. Spec. App. 1994)) (holding that a $1.25 commission on a $7.00 product did not rise to the level of substantial injury for purposes of establishing a violation under section 207). We do not view the subject matter of this suit as "trivial" or "merely speculative." We see no case in Maine sufficiently like this one to give us clear guidance on this question and are reluctant to venture where the Maine courts have not. What is clear is that the Maine courts have consistently read the private right of action provision of the UTPA narrowly. -18-See, e.g., McKinnon, 977 A.2d at 427 (interpreting the provision's

requirement that plaintiffs suffer "loss of money or property" to mean "substantial" loss); Bartner v. Carter, 405 A.2d 194, 202-03 (Me. 1979) ( re j ecting a "broad" definition of "restitution" in favor of a narrower "technical" definiti on ) ; see also Hoglund ex rel. Johnson v. DiamlerChrysler Corp., 102 F. Supp. 2d 30, 31 (D. Me. 2000) ("Historica l l y, however, the Law Court has interpreted the UTPA's private remedial provision narrowly."). This is one purpose of the substantial injury requirement. See McKinnon, 977 A.2d at 427 ("The substantial injury requirement is a limitation on the use of the UTPA for a private cause of action."). This narrow app l i cation of the private right of action section is consistent with the Maine legislature's choice of statutory language, which is narrower than that of other states. E.g., compare Me. Rev. Stat. tit. 5, § 2 1 3 (1) (restricting the private right of action to a "person who purchases or leases goods, services or property"), with Mass. Gen. Laws ch. 93A, § 9(1) (allowing "[a]ny person . . . who has been injured" to bring a private action even if that person is not a consumer and not otherwise in privity with the purchaser).

In the seminal case interpreting the private right of action provision of the Maine UT PA , the Law Court in Bartner v. Carter pointed out that "[i]n a private suit, the requirement of loss to the plaintiff consumer resulting from defendant's wrongful act unavoidably limits" both the scope of section 207 and the use of the FTCA and its interpretati on . 4 0 5 A.2d at 201. The court -19-commented that the Maine legi s l ature was concerned about the

possible coercive and improper use of the private cause of action, and that was one rationale for the narrowing. Id. at 201-02.

Pertinently, the court also po i nted out, in discussing the restrictions on recovery in private actions under section 213, that "[c]ommon law actions for negligence and breach of warrant y are available in appropriate cases for non-restitutionary damages in situations where personal injuries or damages to property have occurred." Id. at 203.

It seems unlikely to us that Maine would permit plaintiffs, in cases also pleading that the s ame acts constitute negligence and breach of implied contract, to u s e the private action provision of the UTPA to recover types of damages which Maine has decided are not reasonably foreseeable or barred for policy reasons when asserted under implied contract, negligence, or other theories. In Searles, the Law Court was explicit that public policy considerations factor into interpretation of the UTPA. See 878 A.2d at 519 n.10. As this opinion holds elsewhere, most of plaintiffs' damages claims fail for those reasons. As to the recoverable amounts for mitigation of damages under negligence and implied contract, we see no reason why Maine law would not consider those recoveries under those theories sufficient. 7

We recognize that attorney's fees are available under the 7 Maine UTPA "[i]f the court finds, in any action commenced under [section 213] that there has been a violation of [section] 207." Me. Rev. Stat. tit. 5, § 213(2); see also Beaulieu v. Dorsey, 562 -20-B. Failure to Allege Cognizable Injury To summarize, plaintiffs' claims under the Maine UTPA and fo r a breach of fiduciary relationship fail, but plaintiffs have adequately alleged at l east theories of negligence and breach of implied contract. That a general theory of recovery has been adequately pled does not, though, resolve the next question of whether the particular types of damages alleged are recoverable under those theories. We draw a distinction for our analysis among plaintiffs' various claims of damages between those which are best characterized as mitigation costs and those which are not.

1. Mitigation Damages: Card Replacement Costs and

Credit Insurance Under Maine negligence law, damages must be both reasonably foreseeable, and, even if reasonably foreseeable, of the type which Maine has not barred for policy reasons. Generally, under Maine law, "the fundamental test [for both tort and contract recovery] is one of reasonable fo re s e eability: if the loss or injury for which damages are claimed was not reasonably foreseeable under the circumstances, there is no liability." Horton & McGehee, Maine Civil Remedies § 4-3(b)(3) (4th ed. 2004). But liability in

A.2d 678 (Me. 1989). But we are doubtful the Maine courts would extend these provisions of the UTPA on these facts simply to allow recovery of attorney's fees for mitigation costs. Even the attorney's fees provisions have been recognized as having limits. See Dudley v. Wyler, 647 A.2d 90, 92 (Me. 1994) (denying attorney's fees where plaintiff established a violati on of section 207 but failed to show the loss of money or property require d t o recover under section 213). -21-negligence also " o rdinarily requires proof of personal injury or

property damage." In re Hannaford, 4 A.3d at 496. The Maine Law Court has explained that although reasonable foreseeability " may set tolerable limits for most types of physical harm, it provides virtually no limit on liability for nonphysical harm." Cameron v. Pepin, 610 A.2d 279, 283 (Me. 199 2 ) (emphasis omitted) (quoting Thing v. La Chusa, 771 P.2d 814, 826 (Cal. 1989)) (internal quotation mark omitted). In cases of nonphys i ca l harm, Maine courts limit recovery by considering not only reasonable foresee ability, but also relevant policy considerations such as "societal expectations regarding behavior and individual responsibility in allocating risks and cos t s . " Alexander v. Mitchell, 930 A.2d 1016, 1020 (Me. 2007).

Maine courts have weighed these considerations in the context of mitigation costs and determined that a plaintiff may "recover for costs and harms incurred during a reasonable effort to mitigate," regardless of whether the harm is nonphysical. In re Hannaford, 4 A.3d at 496. The Maine Law Court has expressly said

so both in its respon s e t o the certified questions and in its decis i on t o apply the Restatement (Second) of Torts § 919. The Restatement (Second) of Torts § 919 provides that "[o]ne whose legally protected interests have been endangered by the tortious conduct of another i s entitled to recover for expenditures reasonably made or harm suffered in a reasonable effort to avert the harm threatened." Id. § 919(1). It is clear that, as a matter -22-of policy, Maine law "encourages plaintiffs to take re a sonable

steps to minimize losses caused by a defendant's negligence." In

re Hannaford, 4 A.3d at 496. To recover mitigation damages, plaintiffs need only show that the efforts to mitigate were reasonable, and that those efforts constitute a legal injury, such

as actual money lost, rather than time or effort expended. Id. at 496-97. Maine has interpreted this "reasonableness" requirement fo r mitigation, judging whether the decision to mitigate was reasonable "at the time it was made." Marchesseault v. Jackson, 611 A.2d 95, 99 (Me. 1992). In Marchesseault, the plaintiff brought a claim for breach of contract after the defendant built a faulty foundation for the plaintiff's house. The court allowed as mitigation costs expenditures made in an unsuccessful effort to remedy the major defects in the foundation rather than destroy the foundation and have it rebuilt. Plaintiff recovered those damages because his efforts to mitigate, while unsuccessful, were a reasonable attempt to avoid further loss. Id.

There is not a great deal of Maine law on the subject. And the Law Court's decision on the certified question appears to be the first time the Maine courts have applied § 919 of the Restatement. So we turn to the decisions of other courts under the Restatement, which p rovide guidance for Maine. See, e.g., Marchesseau l t , 611 A.2d 95 at 99 (turning to other jurisdictions for guidance in deciding whether to allow recovery of unsuccessful -23-repair costs as mitigation damages under the Restatement (Second)

of Contracts); Marois v. Paper Converting Mach. Co., 539 A.2d 621, 623-24 (Me. 1988) ("Decisions o f other courts, however, do interpret the Rest atement [(Second) of Torts] and are helpful in the development of our own law."). Other courts' decisions applying § 919 are helpful to plaintiffs' claims. These courts award mitigation costs even when it is not certain at the time that these costs are needed, when mitigation costs are sought but other damages are unavailable, and when mitigation costs exceed the amount of actual damages.

The Seventh Circuit, for example, has held that under Restatement § 919 incidental costs expende d in good faith to mitigate harm are recoverable -- even if the costs turn out to exceed the savings. See Toledo Peoria & W. Ry. v. Metro Waste Sys., Inc., 59 F.3d 637 (7th Cir. 1995) (applying Illinois law). In Toledo, the plaintiff sued to recover for damages sustained to several of its locomotive engines. As to one of the engines, the plaintiff sought to recover both the replacement va l ue of the engine and the cost of attempted repairs, which later turned out to be unsuccessful. The court held it was error to have excluded evidence of the cost of the attempted repairs and allowed the plaintiff full recove ry because "[a]ny other result would effectively penalize [the plaintiff] for fulfilling its obligation under Illinois law to minimize its damages." Id. at 641.

-24-In Kelleher v. Marvin Lumber & Cedar Co., 891 A.2d 477

(N.H. 2005), the New Hampshire Supreme Court, applying Restatement § 9 1 9, held that a plaintiff who found rot damage in a numbe r o f his property's windows could recover for the cost of replacing those windows in order to prevent water leakage and other damage to the property. The court allowed the plaintiff to recover the cost of the new windows as reasonable mitigation damages notwithstanding the court's determination that recovery for the rotting windows themselves was barred by the economic loss doctrine. Id. at 496- 97. The Fourth Circuit has noted, applying Restatement § 919, that plaintiffs should not face "a Hobson's choice" between allowing further damage to occur or mitigating the damage at their

own expense. Toll Bros., Inc. v. Dryvit Sys., Inc., 432 F.3d 564, 570 ( 4 th Cir. 2005) (applying Connecticut law). In Toll, a real estate developer removed and replaced defective stucco from homes that it built, and sued the stucco manufacturer in negligence to

recove r its costs. The court concluded that, as a matter of policy, a plaintiff may recover the cost of its reasonable attempts to mitigate, even if the injury is "wholly financial" in nature. Id. In Fogel v. Zell, 221 F.3d 955 (7th Cir. 2000), the court, applying I llinois law, determined that under Restatement § 919 a city which had installed a defectively manufactured sewer pipe "would have been entitled by the doctrine of mitigation of -25-damages to remove the pipe or take other prophylactic or reparative

measures, and to seek restitution of the expense of doing so from [the manufacturer], provided the expense was prudent in the circumstances." Id. at 960-61.

In a Massachusetts case, Automated Donut Systems, Inc. v. Consolidated Rail Corp., 424 N.E.2d 265 (Mass. App. Ct. 1981), the court applied Restatement § 919 to hold that a shipper could

recover the cost of reasonable, but unsuccessful, efforts to repair goods damaged by a railway carrier because allowing recovery would effectuate a policy of encouraging injured parties to avoid loss. Id. at 270-71.

The question then becomes whether plaintiffs' mitigation steps were reasonable. This is a contextual question, depending on the facts. Like the district court, we will view all facts in the light most favorable to the plaintiffs.

This case involves a large-scale criminal operation conducted over three months and the deliberate taking of credit and debit ca rd information by sophisticated thieves intending to use the information to their financial advantage . Unlike the cases cited by Hanna fo rd, this case does not involve inadvertently misplace d o r lost data which has not been accessed or misused by third parties. Here, there was actual misuse, and it was apparently global in reach. The thieves appeared to have expertise in accomplishing their theft, and to be sophisticated in how to take advantage of the stolen numbers. The data was used to run up -26-thousands of imp rope r charges across the globe to the customers'

accounts. The card owners were not merely exposed to a hypothetical risk, but to a real risk of misuse.

Further, there is no suggestion there was any way to sort through to predict whose accounts would be used to ring up improper charges. By the time Hannaford acknowledged the breach, over 1,800 fraudulent charges had been identified and the plaintiffs could reasonably expect that many more fraudulent charges would follow. Hannaford did not notify its customers of exactly what data, or whose data, was stolen. It reasonably appeared that all Hannaford customers to have used credit or debit cards during the class period were at risk of unauthorized charges.

That many banks or issuers immediately issued new cards is evidence of the reasonableness of replacement o f cards as mitigation. Those banks thought the cards would be subject to unauthorized use, and cancelled those cards to mitigate their own losses in what was a commercially reasonable judgment. That other financial institutions did not replace cards immediately does not make it unreasonab l e fo r cardholders to take steps to protect themselves.

It was foreseeable, on these facts, that a customer, knowing that her credit or debit card data had been compromised and that thousands of fraudulent charges had resulted from the same security breach, would replace the card to mitigate against misuse

-27-o f the ca rd data. It is true that the only plaintiffs to alle ge 8 having to pay a replacement card fee, Cyndi Fear and Thomas Fear, do not allege that the y experienced any unauthorized charges to their account, but the test for mitigation is not hindsight. Similarly, it was foreseeable that a customer who had experienced unauthorized charges to her account, such as plaintiff Lori Valburn, would reasonably purchase insurance to protect against the consequences of data misuse. 9

Hannaford opposes this conclusion and cites several cases from other jurisdiction s ho lding, on the facts before them, that

Under the Truth in Lending Act, 15 U.S.C. § 1643, and the 8 Electronic Fund Transfer Act, 15 U.S.C. § 1693g, ca rdho l ders are liable for up to $50 in unauthorized charges, with the exception that under the Electronic Fund Transfer Act, a cardholder can be liable for up to $500 if the holder fails to report the fraud within two days.

It may be, as Hannaford suggests, that major card brands have instituted contractual zero-liability protection, with the result that customers are not liable for any amount of a fraudulent charge. But at the motion to dismiss stage, we cannot say that customers face no risk of even a $50 liability from unauthorized use. Nor is Hannaford's argument directly relevant: it does not change the fact that in these circumstances it is entirely reasonable for customers to attempt to mitigate harm to themselves.

Hannaford argues that because the pl a i ntiffs allege no 9 loss of personally identifying information, plaintiff Lori Valburn had no reasonable basis for purchasing "identity theft" insurance. The pla i nt iffs explain that "[a]lthough it was labeled 'identity theft insurance,' the product purchased by Ms. Valburn from Discover Card protected her against the consequences of misuse of the data that had been stolen including the losses and disruptions documented in the Complaint." At the motion to dismiss stage, we draw all reasonable inferences in favor of the plaintiff, including the inference that the product purchased by plaintiff Valburn protected her against misuse of her stolen debit and credit card data. -28-the cost s o f credit monitoring services and identity theft

insurance are not cognizable injuries in negligence claims. All 1 0 of these cases are distinguishable on the ir facts.

Most of the cases involved the ft of expensive computer equipment, rather than a sophisticated breach of electronic data. See Ruiz v. Gap, Inc., 622 F. Supp. 2d 908 (N.D. Cal. 2009); Caudle

v. Towers, Perrin, Forster & Crosby , Inc., 580 F. Supp. 2d 273 (S.D.N.Y. 2008); Kahle v. Litton Loan Servicing LP, 486 F. Supp. 2d 705 (S.D. Ohio 2007); Randolph v. ING Life Ins. & Annuity Co., 486 F. Supp. 2d 1 (D.D.C. 2007). In contrast with the facts here, the pl a i ntiffs in those cases not only failed to allege "that plaintiff[s] or any member[s] of the putative class [had] been the victim[s] of identity fraud or theft," Caudle, 580 F. Supp. 2d at 277, but also failed to allege "that the person stealing the [compute r or] hard drive was motivated by a desire to access the data and had the capabilities to do so," id. at 282. These courts reasoned that because "there [was] no evidence that the thieves or

Hannaford also argues that allowing recovery for 1 0 prophylactic measures such as identity theft i n s urance would provide incentives for the unnecessary purchase of such products. As we have discussed, however, such recovery is bounded by the principle o f reasonableness; recovery is allowable only if the decision to purchase such a product was a reasonable effort to mitigate under the circumstances. See Marchesseau l t v. Jackson, 61 1 A . 2 d 95, 99 (Me. 1992). For example, where neither the plaintiff nor those similarly situated have experienced fraudulent charges resulting from a theft or loss of data, the purchase of credit monitoring services may be unreasonable and not recoverable. Cf. Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629, 639-40 (7th Cir. 2007). By contrast, such insurance may be reasonable in circumstances like those here. -29-other unauthorized individuals were able to access that information

or if accessed that it [was] used for unlawful purposes[,] . . . any injury of Plaintiff[s] [was] purely speculative." Kahle, 486 F. Supp. 2d at 712-13. Here, by contras t , the thieves were sophisticated; they targeted Hannaford's data directly; and they used that data to ring up thousands of charges to customer accounts, including the accounts of many of the plaintiffs.

Another of the cases involved a computer hard drive that

was inadvertently lost. See Melancon v. La. Office of Student Fin. Assistance, 567 F. Supp. 2d 873 (E.D. La. 2008). In Mel an con, unlike the present case, it was "undisputed that no personal data [had] been compromised and Plaintiffs [had] failed to offer evidence that any third pa rt y [had] gained access to the data." Id. at 877. Because the case did not involve actual theft or misuse, the court held that the plaintiffs did not have a reasonable basis for purchasing credit mon itoring services and could not claim those costs as cognizable damages. 1 1

Several other cou rts, in cases not cited by Hannaford, 1 1 have likewise concluded that where data is simply lost or misplaced rather than stolen, and no known misuse has occurred, plaintiffs may no t recover damages including credit monitoring costs. See McLoughlin v. People's United Bank, Inc., No. 3:08-cv-00944(VLB), 2009 WL 2843269 (D. Conn. Aug. 3 1 , 2 0 0 9 ); Willey v. J.P. Morgan Chase, N.A., No. 09 Civ. 1397(CM), 2009 WL 1938987 (S.D.N.Y. July 7, 2009); Shafran v. Harley-Davidson, Inc., No. 07 Civ. 01365(GBD), 2008 WL 763177 (S.D.N.Y. Mar. 20, 2008). In McLoughlin, for example, "there [was] no allegation as to the fate of the missing box of tapes. They could have been inadvertently discarded or destroyed, or they could be collecting dust in some fo rgo t ten warehouse." 2009 WL 2843269 at *7. "It is only through speculation," the court explaine d , "that one concludes that [the -30-Only two of Hannaford's cited cases involve a breach in

which thieves accessed the plaintiffs' dat a held by defendants. S ee Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629 (7th Cir. 2 0 0 7 ) (hackers breached a bank website and stole the personal and financial dat a o f tens of thousands of the bank's customers); Hendri c ks v. DSW Shoe Warehouse Inc., 444 F. Supp. 2d 775, 777 (W.D. Mich. 2006 ) ( hackers accessed "the numbers and names associated with approximately 1,438,281 credit and debit cards and 96,385 checking account numbers and drivers' license numbers" that

were on file with a national shoe retailer). But even in those cases, the plaintiffs failed to allege "that they or any other member of the putative class already had been the victim of identity theft as a result of the breach." Pisciotta, 499 F.3d at 632; see also Hendricks, 444 F. Supp. 2d at 779. These courts reasoned that in the absence of unauthorized charges as to the plaintiffs or those similarly situated, the plaintiffs there lacked

a reasonable basis for fearing there would be unauthorized charges to their accounts as a result of the theft. That very reasoning suggests that these courts would reach a different result if the

lost tapes] are in possession of an individual who i s dr iven to maliciously mine the tapes for the personal data that they contain. Accordi ngl y , this is not a 'risk of injury' case but rather a speculation as to a possible risk of injury." Id. The court concluded that because the plaintiffs' "claim [was] founded solely on the fear, unsupporte d by any allegation of malfeasance, of i dent i t y theft," the plaintiffs could not recover. Id. at *8 . Here, by contrast, thieves accessed and misused the data, resulting in thousands of fraudulent charges to Hannaford customers, including plaintiffs. -31-plaintiffs alleged that they had suffered fraudulent charges to

their accounts. Here, plaintiff Valburn purchased theft insurance

on ly after learning of an unauthorized $500 cash withdrawal f rom her account and speaking with the fraud unit at Di s cove r Card. Knowing her personal data had been breached and misused, and knowing the thieves were sophisticated and had rung up thousands of unauthorized charges, plaintiff Valburn had a reasonable basis for purchasing identity theft insurance to avoid further damage.

Hannaford also argue s that even if these damages are cognizable in negligence, they are not cognizable in contract. In support of this argument, Hannafo rd cites the Maine Law Court's statement, in its answer to the certified questions, that "contract damages are more restricted than compensatory damages for a tort." In re Hannaford, 4 A.3d at 497. While true, that statement is inapplicable here. As explained by the Law Court and the body of precedent on which it relied, contract damages are more restricted in that they disallow "recovery of damages for mental or emotional distress suffered solely as the result of a breach of contract,"

even if foreseeable. Rubin v. Matthews Int'l Corp., 503 A.2d 694, 696 (Me. 1986); see also Stull v. First Am. Title Ins. Co., 745 A.2d 975, 981 (Me. 2000); Marquis v. Farm Family Mut. Ins. Co., 628 A.2d 644, 651 (Me. 1993). Plaintiffs' claims for identity theft insurance and replacement card fees involve actual financial losses from credit and debit card misuse. Under Maine contract law, these financial losses are recoverable as mitigation damages so long as -32-they are reasonable. See, e.g., Marchesseault, 611 A.2d at 99;

Restatement (Second) of Contracts § 350 & cmt. h ("[C]osts incurred i n a reasonable but unsuccessful effort to avoid loss are recoverable.").

2. Remaining Damages Claims General principles of recovery in both contract and tort, which are not app l i cable to the mitigation damages we have discussed, do bar the plaintiffs' remaining claims. The district court correctly concluded that the plaintiffs' claims for loss of reward points, loss of reward point earning opportunities, and fees for pre- authorization changes were not recoverable. These 1 2 injuries were too attenuated from the data breach because they were incurred as a result of third parties' unpredictable responses to the cancellation of plaintiffs' credit or debit cards. See Stubbs

v. Bartlett, 478 A.2d 690 (Me. 1984) (concluding that a wife's loss of medical insurance was too attenuated an injury where it arose from a car accident that caused her husband to lose his job and his

We reject the plaintiffs' argument that the question of 1 2 foreseeability vel non should have gone to the jury and the district court had no role to play. The district court was correct to consider initially foreseeability as a question of law. In address i ng the certified questions, the Law Court indicated that some harms are too far attenuated as a matter of law to constitute cognizable injury in Maine. See In re Hannaford Bros. Co. Customer Data Sec . B reach Litig., 4 A.3d 492, 496-97 (Me. 2010). Indeed, the plaintiffs later a c knowledge as much when they argue that "[o]nly if it is clear that no reasonable jury could find that the specific element of consequential damages was or should have been foreseeable . . . can the court step in and rule out a particular element of loss as unforeseeable as a matter of law." -33-employer-provide d medical insurance). We doubt that under Maine

law it is reasonably foreseeable that an issuing bank would deny a cardholder's entitlement to accumulated points when the card ha s merely been replaced with a new one. Nor, under Maine law, is it reasonably foreseeable that pre-authorization arrangements, which

are usually in the merchant's inte re s t and are accordingly free-of-charge to set up, would involve change fees in the event of

a c redit or debit card replacement. Moreover, we do not think Maine, as a policy matter, would find such damages compensable. III. We conclude that the two forms of mitigation damages we have discussed are cognizable under Maine law and we reverse the district court's di smissal of the plaintiffs' negligence and implied contract claims as to those damages. We affirm the district court's dismissal of the remaining claims. So ordered. No costs are awarded.

-34-