Bohnak v. Marsh & McLennan Cos.

Bohnak v. Marsh & McLennan Cos.

Opinion

ORDER AND OPINION DENYING IN PART AND GRANTING IN PART MOTION TO DISMISS FOR LACK OF SUBJECT-MATTER JURISDICTION AND FAILURE TO STATE A CLAIM

ALVIN K. HELLERSTEIN, U.S.D.J.:

Plaintiffs Nancy Bohnak ("Bohnak") and Janet Lea Smith ("Smith"), (collectively "Plaintiffs") bring a nationwide class action complaint against Defendants Marsh & McLennan Companies, Inc. and Marsh & McLennan Agency, LLC ("Defendant MMA"), (collectively [*2]  "Defendants"), for alleged injuries arising from a data breach compromising Plaintiffs' personally-identifiable information ("PII") in Defendants' possession. Complaint ("Compl.), ECF No. 1. Plaintiffs bring state-law claims for (1) negligence, (2) breach of implied contract, and (3) breach of confidence. They allege jurisdiction pursuant to 28 U.S.C. 1332(d) (class action alleging damages in excess of $5 million exclusive of interest and costs, more than 100 members in the proposed class, and diverse citizenship between at least one Class Member and Defendants). Defendants move to dismiss for lack of subject-matter jurisdiction (R. 12(b)(1)) and for failure to state a claim upon which relief may be granted (R. 12(b)(6)). (ECF No. 23). For the reasons discussed below, Defendants' motion to dismiss for lack of subject matter jurisdiction is denied, and their motion to dismiss for failure to state a claim is granted.

BACKGROUND

The following facts are taken from the Complaint, which I must "accept[] as true" for the purpose of this motion. Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S. Ct. 1937, 173 L. Ed. 2d 868 (2009). Plaintiffs are Florida residents and former employees of Defendant MMA, Compl. ¶¶ 58, 67, providing professional services in the areas of risk, strategy, and people," Id. ¶ 26, and serving [*3]  the risk prevention and insurance needs of middle market companies in the United States. Id. ¶ 4. Defendants are New York corporations that stored the PII of at least 7,000 individuals—data which included "Social Security or other federal tax identification numbers, driver's license or other government issued identification, and passport information"—including, but not limited to, Plaintiffs' Social Security or other federal tax id number, which Defendants acquired directly from Plaintiffs, or through Defendants' purchase of or merger with Plaintiffs' former employers. Id. ¶ 7-8, 58, 67. The PII of individuals is of "high value to criminals," and evidenced by the prices they will pay through the dark web. Id. ¶ 44. Social security numbers are among the most useful kind of personal information to have stolen because they may be put to a variety of fraudulent uses and are difficult for an individual to change, particularly because an individual cannot obtain a new Social Security number without significant paperwork and evidence of actual misuse. Id. ¶¶ 45-46. Notwithstanding the sensitivity of the information in Defendants' possession, none of the data was encrypted. Id. ¶ 8.

In contrast, [*4]  Plaintiffs Bohnak and Smith were very careful about sharing their PII and have never knowingly transmitted their unencrypted sensitive PII over the internet or any other unsecured source. Id. ¶¶ 61, 70. They store any documents containing their PII in a safe and secure location or destroy the documents. Id. ¶¶ 62, 71. Further they diligently choose unique usernames and passwords for their various online accounts. Id.

Full case includes Shepard's, Headnotes, Legal Analytics from Lex Machina, and more.