Opinion ID: 615727
Heading Depth: 2
Heading Rank: 2

Heading: Failure to Allege Cognizable Injury

Text: To summarize, plaintiffs' claims under the Maine UTPA and for a breach of fiduciary relationship fail, but plaintiffs have adequately alleged at least theories of negligence and breach of implied contract. That a general theory of recovery has been adequately pled does not, though, resolve the next question of whether the particular types of damages alleged are recoverable under those theories. We draw a distinction for our analysis among plaintiffs' various claims of damages between those which are best characterized as mitigation costs and those which are not.
Under Maine negligence law, damages must be both reasonably foreseeable, and, even if reasonably foreseeable, of the type which Maine has not barred for policy reasons. Generally, under Maine law, the fundamental test [for both tort and contract recovery] is one of reasonable foreseeability: if the loss or injury for which damages are claimed was not reasonably foreseeable under the circumstances, there is no liability. Horton & McGehee, Maine Civil Remedies § 4-3(b)(3) (4th ed. 2004). But liability in negligence also ordinarily requires proof of personal injury or property damage. In re Hannaford, 4 A.3d at 496. The Maine Law Court has explained that although reasonable foreseeability may set tolerable limits for most types of physical harm, it provides virtually no limit on liability for nonphysical harm. Cameron v. Pepin, 610 A.2d 279, 283 (Me.1992) (emphasis omitted) (quoting Thing v. La Chusa, 48 Cal.3d 644, 257 Cal.Rptr. 865, 771 P.2d 814, 826 (1989)) (internal quotation mark omitted). In cases of nonphysical harm, Maine courts limit recovery by considering not only reasonable foreseeability, but also relevant policy considerations such as societal expectations regarding behavior and individual responsibility in allocating risks and costs. Alexander v. Mitchell, 930 A.2d 1016, 1020 (Me.2007). Maine courts have weighed these considerations in the context of mitigation costs and determined that a plaintiff may recover for costs and harms incurred during a reasonable effort to mitigate, regardless of whether the harm is nonphysical. In re Hannaford, 4 A.3d at 496. The Maine Law Court has expressly said so both in its response to the certified questions and in its decision to apply the Restatement (Second) of Torts § 919. The Restatement (Second) of Torts § 919 provides that [o]ne whose legally protected interests have been endangered by the tortious conduct of another is entitled to recover for expenditures reasonably made or harm suffered in a reasonable effort to avert the harm threatened. Id. § 919(1). It is clear that, as a matter of policy, Maine law encourages plaintiffs to take reasonable steps to minimize losses caused by a defendant's negligence. In re Hannaford, 4 A.3d at 496. To recover mitigation damages, plaintiffs need only show that the efforts to mitigate were reasonable, and that those efforts constitute a legal injury, such as actual money lost, rather than time or effort expended. Id. at 496-97. Maine has interpreted this reasonableness requirement for mitigation, judging whether the decision to mitigate was reasonable at the time it was made. Marchesseault v. Jackson, 611 A.2d 95, 99 (Me. 1992). In Marchesseault, the plaintiff brought a claim for breach of contract after the defendant built a faulty foundation for the plaintiff's house. The court allowed as mitigation costs expenditures made in an unsuccessful effort to remedy the major defects in the foundation rather than destroy the foundation and have it rebuilt. Plaintiff recovered those damages because his efforts to mitigate, while unsuccessful, were a reasonable attempt to avoid further loss. Id. There is not a great deal of Maine law on the subject. And the Law Court's decision on the certified question appears to be the first time the Maine courts have applied § 919 of the Restatement. So we turn to the decisions of other courts under the Restatement, which provide guidance for Maine. See, e.g., Marchesseault, 611 A.2d 95 at 99 (turning to other jurisdictions for guidance in deciding whether to allow recovery of unsuccessful repair costs as mitigation damages under the Restatement (Second) of Contracts); Marois v. Paper Converting Mach. Co., 539 A.2d 621, 623-24 (Me.1988) (Decisions of other courts, however, do interpret the Restatement [(Second) of Torts] and are helpful in the development of our own law.). Other courts' decisions applying § 919 are helpful to plaintiffs' claims. These courts award mitigation costs even when it is not certain at the time that these costs are needed, when mitigation costs are sought but other damages are unavailable, and when mitigation costs exceed the amount of actual damages. The Seventh Circuit, for example, has held that under Restatement § 919 incidental costs expended in good faith to mitigate harm are recoverableeven if the costs turn out to exceed the savings. See Toledo Peoria & W. Ry. v. Metro Waste Sys., Inc., 59 F.3d 637 (7th Cir. 1995) (applying Illinois law). In Toledo, the plaintiff sued to recover for damages sustained to several of its locomotive engines. As to one of the engines, the plaintiff sought to recover both the replacement value of the engine and the cost of attempted repairs, which later turned out to be unsuccessful. The court held it was error to have excluded evidence of the cost of the attempted repairs and allowed the plaintiff full recovery because [a]ny other result would effectively penalize [the plaintiff] for fulfilling its obligation under Illinois law to minimize its damages. Id. at 641. In Kelleher v. Marvin Lumber & Cedar Co., 152 N.H. 813, 891 A.2d 477 (2005), the New Hampshire Supreme Court, applying Restatement § 919, held that a plaintiff who found rot damage in a number of his property's windows could recover for the cost of replacing those windows in order to prevent water leakage and other damage to the property. The court allowed the plaintiff to recover the cost of the new windows as reasonable mitigation damages notwithstanding the court's determination that recovery for the rotting windows themselves was barred by the economic loss doctrine. Id. at 496-97. The Fourth Circuit has noted, applying Restatement § 919, that plaintiffs should not face a Hobson's choice between allowing further damage to occur or mitigating the damage at their own expense. Toll Bros., Inc. v. Dryvit Sys., Inc., 432 F.3d 564, 570 (4th Cir.2005) (applying Connecticut law). In Toll, a real estate developer removed and replaced defective stucco from homes that it built, and sued the stucco manufacturer in negligence to recover its costs. The court concluded that, as a matter of policy, a plaintiff may recover the cost of its reasonable attempts to mitigate, even if the injury is wholly financial in nature. Id. In Fogel v. Zell, 221 F.3d 955 (7th Cir. 2000), the court, applying Illinois law, determined that under Restatement § 919 a city which had installed a defectively manufactured sewer pipe would have been entitled by the doctrine of mitigation of damages to remove the pipe or take other prophylactic or reparative measures, and to seek restitution of the expense of doing so from [the manufacturer], provided the expense was prudent in the circumstances. Id. at 960-61. In a Massachusetts case, Automated Donut Systems, Inc. v. Consolidated Rail Corp., 12 Mass.App.Ct. 326, 424 N.E.2d 265 (1981), the court applied Restatement § 919 to hold that a shipper could recover the cost of reasonable, but unsuccessful, efforts to repair goods damaged by a railway carrier because allowing recovery would effectuate a policy of encouraging injured parties to avoid loss. Id. at 270-71. The question then becomes whether plaintiffs' mitigation steps were reasonable. This is a contextual question, depending on the facts. Like the district court, we will view all facts in the light most favorable to the plaintiffs. This case involves a large-scale criminal operation conducted over three months and the deliberate taking of credit and debit card information by sophisticated thieves intending to use the information to their financial advantage. Unlike the cases cited by Hannaford, this case does not involve inadvertently misplaced or lost data which has not been accessed or misused by third parties. Here, there was actual misuse, and it was apparently global in reach. The thieves appeared to have expertise in accomplishing their theft, and to be sophisticated in how to take advantage of the stolen numbers. The data was used to run up thousands of improper charges across the globe to the customers' accounts. The card owners were not merely exposed to a hypothetical risk, but to a real risk of misuse. Further, there is no suggestion there was any way to sort through to predict whose accounts would be used to ring up improper charges. By the time Hannaford acknowledged the breach, over 1,800 fraudulent charges had been identified and the plaintiffs could reasonably expect that many more fraudulent charges would follow. Hannaford did not notify its customers of exactly what data, or whose data, was stolen. It reasonably appeared that all Hannaford customers to have used credit or debit cards during the class period were at risk of unauthorized charges. That many banks or issuers immediately issued new cards is evidence of the reasonableness of replacement of cards as mitigation. Those banks thought the cards would be subject to unauthorized use, and cancelled those cards to mitigate their own losses in what was a commercially reasonable judgment. That other financial institutions did not replace cards immediately does not make it unreasonable for cardholders to take steps to protect themselves. It was foreseeable, on these facts, that a customer, knowing that her credit or debit card data had been compromised and that thousands of fraudulent charges had resulted from the same security breach, would replace the card to mitigate against misuse of the card data. [8] It is true that the only plaintiffs to allege having to pay a replacement card fee, Cyndi Fear and Thomas Fear, do not allege that they experienced any unauthorized charges to their account, but the test for mitigation is not hindsight. Similarly, it was foreseeable that a customer who had experienced unauthorized charges to her account, such as plaintiff Lori Valburn, would reasonably purchase insurance to protect against the consequences of data misuse. [9] Hannaford opposes this conclusion and cites several cases from other jurisdictions holding, on the facts before them, that the costs of credit monitoring services and identity theft insurance are not cognizable injuries in negligence claims. [10] All of these cases are distinguishable on their facts. Most of the cases involved theft of expensive computer equipment, rather than a sophisticated breach of electronic data. See Ruiz v. Gap, Inc., 622 F.Supp.2d 908 (N.D.Cal.2009); Caudle v. Towers, Perrin, Forster & Crosby, Inc., 580 F.Supp.2d 273 (S.D.N.Y.2008); Kahle v. Litton Loan Servicing LP, 486 F.Supp.2d 705 (S.D.Ohio 2007); Randolph v. ING Life Ins. & Annuity Co., 486 F.Supp.2d 1 (D.D.C.2007). In contrast with the facts here, the plaintiffs in those cases not only failed to allege that plaintiff[s] or any member[s] of the putative class [had] been the victim[s] of identity fraud or theft, Caudle, 580 F.Supp.2d at 277, but also failed to allege that the person stealing the [computer or] hard drive was motivated by a desire to access the data and had the capabilities to do so, id. at 282. These courts reasoned that because there [was] no evidence that the thieves or other unauthorized individuals were able to access that information or if accessed that it [was] used for unlawful purposes[,] ... any injury of Plaintiff[s] [was] purely speculative. Kahle, 486 F.Supp.2d at 712-13. Here, by contrast, the thieves were sophisticated; they targeted Hannaford's data directly; and they used that data to ring up thousands of charges to customer accounts, including the accounts of many of the plaintiffs. Another of the cases involved a computer hard drive that was inadvertently lost. See Melancon v. La. Office of Student Fin. Assistance, 567 F.Supp.2d 873 (E.D.La. 2008). In Melancon, unlike the present case, it was undisputed that no personal data [had] been compromised and Plaintiffs [had] failed to offer evidence that any third party [had] gained access to the data. Id. at 877. Because the case did not involve actual theft or misuse, the court held that the plaintiffs did not have a reasonable basis for purchasing credit monitoring services and could not claim those costs as cognizable damages. [11] Only two of Hannaford's cited cases involve a breach in which thieves accessed the plaintiffs' data held by defendants. See Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629 (7th Cir.2007) (hackers breached a bank website and stole the personal and financial data of tens of thousands of the bank's customers); Hendricks v. DSW Shoe Warehouse Inc., 444 F.Supp.2d 775, 777 (W.D.Mich.2006) (hackers accessed the numbers and names associated with approximately 1,438,281 credit and debit cards and 96,385 checking account numbers and drivers' license numbers that were on file with a national shoe retailer). But even in those cases, the plaintiffs failed to allege that they or any other member of the putative class already had been the victim of identity theft as a result of the breach. Pisciotta, 499 F.3d at 632; see also Hendricks, 444 F.Supp.2d at 779. These courts reasoned that in the absence of unauthorized charges as to the plaintiffs or those similarly situated, the plaintiffs there lacked a reasonable basis for fearing there would be unauthorized charges to their accounts as a result of the theft. That very reasoning suggests that these courts would reach a different result if the plaintiffs alleged that they had suffered fraudulent charges to their accounts. Here, plaintiff Valburn purchased theft insurance only after learning of an unauthorized $500 cash withdrawal from her account and speaking with the fraud unit at Discover Card. Knowing her personal data had been breached and misused, and knowing the thieves were sophisticated and had rung up thousands of unauthorized charges, plaintiff Valburn had a reasonable basis for purchasing identity theft insurance to avoid further damage. Hannaford also argues that even if these damages are cognizable in negligence, they are not cognizable in contract. In support of this argument, Hannaford cites the Maine Law Court's statement, in its answer to the certified questions, that contract damages are more restricted than compensatory damages for a tort. In re Hannaford, 4 A.3d at 497. While true, that statement is inapplicable here. As explained by the Law Court and the body of precedent on which it relied, contract damages are more restricted in that they disallow recovery of damages for mental or emotional distress suffered solely as the result of a breach of contract, even if foreseeable. Rubin v. Matthews Int'l Corp., 503 A.2d 694, 696 (Me.1986); see also Stull v. First Am. Title Ins. Co., 745 A.2d 975, 981 (Me.2000); Marquis v. Farm Family Mut. Ins. Co., 628 A.2d 644, 651 (Me.1993). Plaintiffs' claims for identity theft insurance and replacement card fees involve actual financial losses from credit and debit card misuse. Under Maine contract law, these financial losses are recoverable as mitigation damages so long as they are reasonable. See, e.g., Marchesseault, 611 A.2d at 99; Restatement (Second) of Contracts § 350 & cmt. h ([C]osts incurred in a reasonable but unsuccessful effort to avoid loss are recoverable.).
General principles of recovery in both contract and tort, which are not applicable to the mitigation damages we have discussed, do bar the plaintiffs' remaining claims. The district court correctly concluded that the plaintiffs' claims for loss of reward points, loss of reward point earning opportunities, and fees for pre-authorization changes were not recoverable. [12] These injuries were too attenuated from the data breach because they were incurred as a result of third parties' unpredictable responses to the cancellation of plaintiffs' credit or debit cards. See Stubbs v. Bartlett, 478 A.2d 690 (Me.1984) (concluding that a wife's loss of medical insurance was too attenuated an injury where it arose from a car accident that caused her husband to lose his job and his employer-provided medical insurance). We doubt that under Maine law it is reasonably foreseeable that an issuing bank would deny a cardholder's entitlement to accumulated points when the card has merely been replaced with a new one. Nor, under Maine law, is it reasonably foreseeable that pre-authorization arrangements, which are usually in the merchant's interest and are accordingly free-of-charge to set up, would involve change fees in the event of a credit or debit card replacement. Moreover, we do not think Maine, as a policy matter, would find such damages compensable.