Court Opinion

ID: 9501319
Source: CourtListenerOpinion
Date Created: 2023-08-05 19:08:20.952958+00
Date Added: 2024-06-11T18:00:28.219554
License: Public Domain

PRYOR, Circuit Judge,
dissenting:
I agree with the majority opinion that Curry and Moore have standing to sue, but Curry and Moore’s complaint should be dismissed for failure to state a claim. Their complaint fails to allege a plausible basis for finding that AvMed caused them to suffer identity theft, and their claim of unjust enrichment fails as a matter of law.
Because of the paucity of well-pleaded facts about the cause of the identity thefts, the majority opinion “doubt[s] whether the Complaint could have survived a motion to dismiss” if Curry and Moore had “alleged fewer facts,” Majority Opinion at 17, but Curry and Moore’s threadbare allegations about causation fail to “nudge[ ] [the] claims” relating to identity theft “across the line from conceivable to plausible,” Ashcroft v. Iqbal, 556 U.S. 662, 680, 129 S.Ct. 1937, 1951, 173 L.Ed.2d 868 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 1974, 167 L.Ed.2d 929 (2007)). “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’ ” Id. at 678, 129 S.Ct. at 1949 (quoting Twombly, 550 U.S. at 570, 127 S.Ct. at 1974). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. “The plausibility standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully.” Id. (quoting Twombly, 550 U.S. at 556, 127 S.Ct. 1955, 167 L.Ed.2d 929). “Where a complaint pleads facts that are ‘merely consistent with’ a defendant’s liability, it ‘stops short of the line between possibility and plausibility of ‘entitlement to relief.’ ’ ” Id. (quoting Twombly, 550 U.S. at 557, 127 S.Ct. at 1955). “[C]ourts may infer from the factual allegations in the complaint ‘obvious alternative explanation^],’ which suggest lawful conduct rather than the unlawful conduct the plaintiff would ask the court to infer.” Am. Dental Ass’n v. Cigna Corp., 605 F.3d 1283, 1290 (11th Cir.2010) (quoting Iqbal, 556 U.S. at 682, 129 S.Ct. at 1951-52).
The parties do not dispute that laptops containing the sensitive information of Curry and Moore was stolen from AvMed, but Curry and Moore’s second amended complaint fails to plead enough facts to allow a factfinder to draw a reasonable inference that the sensitive information identity thieves used to open the fraudulent accounts in the plaintiffs’ names was obtained from AvMed. In an attempt to bridge this gap, Curry and Moore allege that they have both been very careful to protect their sensitive information. For example, Curry alleges that she “destroys any documents she receives in the mail that contain any of her Sensitive Information, or that contain any information that could otherwise be used to steal her identity, such as credit card offers,” Compl. ¶ 55, and Moore alleges that he “destroys any *1331documents he receives in the mail that contain any of his Sensitive Information, or that contain any information that could otherwise be used to steal his identity,” Compl. ¶71. But the manner in which Curry and Moore care for the sensitive information they receive from third parties tells us nothing about how the third parties care for that sensitive information before or after they send it to Curry and Moore.
The factual allegations in the second amended complaint present obvious alternative explanations], Am. Dental Ass’n, 605 F.3d at 1290 (quoting Iqbal, 556 U.S. at 682, 129 S.Ct. at 1951-52) (internal quotation marks omitted), regarding the cause of the identity theft that Curry and Moore suffered. An unscrupulous third party that possessed the sensitive information of Curry and Moore might have sold that information to the identity thieves who opened the fraudulent accounts or a careless third party might have lost the information that then found its way into the hands of the identity thieves. Although it is conceivable that the unknown identity thieves used the sensitive information stolen from AvMed to open the fraudulent accounts, it is equally conceivable, in the light of the facts alleged in the complaint, that the unknown identity thieves obtained the information from third parties. Curry and Moore do not allege any facts that make it plausible that the unknown identity thieves who opened the fraudulent accounts obtained the sensitive information necessary to do so from AvMed.
The majority opinion attempts to salvage the complaint by asserting that it alleges that the sensitive information used to steal Curry and Moore’s identities was obtained from AvMed, Majority Opinion at 16, but the complaint alleges no such thing. The majority opinion cites six paragraphs of the complaint to support its conclusion that the complaint plausibly alleges that the sensitive information used to steal Curry and Moore’s identities was obtained from the stolen laptops:
• On or about December 10, 2009, two unencrypted laptop computers were stolen from AvMed’s Gainesville, Florida corporate office.... The laptops contained private, personal information including, but not limited to, protected health information ..., Social Security numbers ..., medical information and other information (collectively, “Sensitive Information”) of approximately 1.2 million AvMed enrollees;
• As a result of AvMed’s failure to implement and follow basic security procedures, Plaintiffs’ Sensitive Information is now in the hands of thieves. Plaintiffs now face a substantial increased risk of identity theft; in fact, Curry and Moore have already experienced repeated instances of identity theft since the data breach ....
• Curry’s Sensitive Information was contained on an unprotected and unencrypted laptop computer that was stolen in the data breach. As a result of the data breach, Curry’s identity was stolen.
• Curry’s identity was stolen and, in or around October 2010, it was used to open bank accounts with Bank of America and activate cards in her name;
• Curry’s Sensitive Information was also used to change her home address with the U.S. Postal Service;
• The E*Trade Financial bank account was opened by an individual using Moore’s Sensitive Information.
Compl. ¶¶ 2, 3, 7, 44, 46, & 61; see also Majority Opinion at 1617. But these paragraphs do not plausibly allege that the identity thieves gained access to Curry and Moore’s sensitive information from the stolen laptops. At most, the complaint alleges that AvMed lost Curry and Moore’s sensitive information on December 10, *13322009, and about a year later, unidentified third parties obtained unspecified sensitive information from an unidentified source and used that unspecified information to engage in identity theft. The complaint, in the words of the majority opinion, alleges nothing “more than a coincidence of time and sequence.” Majority Opinion at 16.
The majority opinion assures us that Curry and Moore have, in fact, alleged something “more than a coincidence of time and sequence” between the stolen laptops and the identity thefts because “Plaintiffs state that the identity thief used Plaintiffs’ sensitive information” to open the fraudulent accounts, id., but that circular reasoning fails. No one disputes that unknown identity thieves used the plaintiffs’ sensitive information to open fraudulent accounts in their names. The dispute is whether the unknown identity thieves obtained that sensitive information from the laptops stolen from AvMed.
The complaint fails to allege a plausible basis for inferring that the unknown identity thieves obtained the sensitive information of Curry and Moore from AvMed. The complaint, for example, does not allege that only AvMed possessed the sensitive information used to open the fraudulent accounts. The complaint does not even allege what sensitive information was used to open financial accounts in the plaintiffs’ names. The complaint alleges, for example, that the sensitive information stolen from AvMed included health and medical information, but the complaint fails to allege that this kind of information was used to open financial accounts in the plaintiffs’ names.
“Determining whether a complaint states a plausible claim for relief [is] a context-specific task that requires the reviewing court to draw on its judicial experience and common sense,” Iqbal, 556 U.S. at 679, 129 S.Ct. at 1950, and that experience reveals that vast numbers of individuals, businesses, and governmental bodies possess our sensitive information, e.g., our names, social security numbers, health information, and other personal data. Technology allows this information to be copied quickly and transmitted over the Internet in an instant. Because of the nature of sensitive information — a social security number and a name are the same regardless of who possesses that information — it may be difficult to pinpoint the source of the sensitive information that is used to commit identity theft. But that difficulty does not relieve Curry and Moore of their burden under Rule 8 to plead a plausible basis for inferring that the sensitive information used by the identity thieves was obtained from AvMed.
The complaint also fails to state a claim of unjust enrichment under Florida law. “Florida courts have held that a plaintiff cannot pursue a quasi-contract claim for unjust enrichment if an express contract exists concerning the same subject matter.” Diamond S Dev. Corp. v. Mercantile Bank, 989 So.2d 696, 697 (Fla.Dist.Ct.App. 2008); see also Am. Safety Ins. Serv., Inc. v. Griggs, 959 So.2d 322, 331 (Fla.Dist.Ct. App.2007) (“A plaintiff may recover under quasi-contract where there is no express or implied-in-fact contract, but the defendant received something of value or benefited from the service supplied.”). The parties do not dispute that they entered into an enforceable contract; they dispute whether the contract has been breached. In that circumstance, a claim of unjust enrichment cannot be maintained.
I respectfully dissent.