Kuhns v. Scottrade, Inc.

Decision Date21 August 2017
Docket NumberNo. 16-3426, No. 16-3542,16-3426
Citation868 F.3d 711
Parties Matthew KUHNS, Individually and on behalf of all others similarly situated Plaintiff-Appellant/Cross-Appellee v. SCOTTRADE, INC., a Missouri Corporation Defendant-Appellee/Cross-Appellant
CourtU.S. Court of Appeals — Eighth Circuit

Counsel who appeared on the brief and presented argument on behalf of the appellant/cross-appellee was Timothy G. Blood, of San Diego, CA. Christopher Martin Hohn, of Saint Louis, MO. The following attorney(s) appeared on the appellant brief; Joseph J. Siprut, of Chicago, IL., Richard L. Miller, II, of Chicago, IL., Richard S. Wilson, of Chicago, IL., John G. Simon and Anthony G. Simon, both of St. Louis, Mo.

Counsel who appeared on the brief and presented argument on behalf of the appellee/cross-appellant was Christopher Martin Hohn, of St. Louis, Mo. The following attorney(s) appeared on the appellee brief; Thomas Edward Douglass, of Saint Louis, MO., David Michael Mangian, of Saint Louis, MO., Brandi L. Burke, of Saint Louis, MO.

Before WOLLMAN and LOKEN, Circuit Judges, and ROSSITER,* District Judge.

LOKEN, Circuit Judge.

In 2013, hackers accessed the internal database of Scottrade, a securities brokerage firm based in St. Louis, Missouri. The hackers acquired personal identifying information ("PII") of over 4.6 million Scottrade customers, including plaintiff Matthew Kuhns, and exploited the information to operate a stock price manipulation scheme, illegal gambling websites, and a Bitcoin exchange. Kuhns and three others affected by the data breach brought putative class actions against Scottrade. After the actions were consolidated in the United States District Court for the Eastern District of Missouri, plaintiffs filed a Consolidated Class Action Complaint under the Class Action Fairness Act, 28 U.S.C. § 1332(d), asserting, as relevant here, claims of breach of contract, breach of implied contract, unjust enrichment, declaratory judgment, and violation of the Missouri Merchandising Practices Act ("MMPA"), Mo. Rev. Stat. § 407.025. The district court1 concluded plaintiffs lacked Article III standing because they had not suffered injury in fact and dismissed the Consolidated Complaint for lack of subject matter jurisdiction. The court's judgment dismissed the Consolidated Complaint with prejudice. Kuhns appealed, and Scottrade filed a cross-appeal arguing that, even if plaintiffs have standing, Kuhns failed to state a claim upon which relief can be granted. We conclude that plaintiffs have Article III standing, at least for their contract-related claims. We affirm the dismissal with prejudice because the Consolidated Complaint did not state claims upon which relief can be granted.

I. Background.

When Kuhns opened a Scottrade account in 2005, he signed a Brokerage Agreement and provided Scottrade with his name, address, social security number, tax identification number, telephone number, employer information, and work history. The Brokerage Agreement provided that Kuhns agreed to pay Scottrade brokerage fees and commissions for purchases and sales of securities "on a per order basis." Addendum 2 of the Brokerage Agreement was Scottrade's "Privacy Policy and Security Statement" describing "how we protect your personal and financial information that we collect in the course of providing our financial services."

The Statement explained that Scottrade collects customers' PII but will "maintain physical, electronic and procedural safeguards that comply with federal regulations to guard your nonpublic personal information," and "offers a secure server and password-protected environment ... protected by Secure Socket Layer (SSL) encryption." In addition, the Consolidated Complaint alleges that an Online Privacy Statement represented: "We comply with applicable laws and regulations regarding the protection of personal information.... We use industry leading security technologies, including layered security and access controls over personal information."2 A document available on Scottrade's website represented: "We keep all customer information confidential and maintain strict physical, electronic and procedural safeguards to protect against unauthorized access to your information."

Between September 2013 and February 2014, hackers successfully accessed Scottrade's customer databases, extracting the PII of more than 4.6 million Scottrade customers, including Kuhns. The hackers used the acquired PII to operate a stock price manipulation scheme and "operated a dozen illegal Internet gambling websites, and a Bitcoin exchange." The FBI informed Scottrade of the data breach in August 2015. Scottrade sent affected customers a notice of the data breach on October 2, one week after the FBI advised Scottrade that it could inform its customers. The notice explained that customer PII may have been compromised and encouraged customers to be "vigilant for the next 12 to 24 months and report any suspected incidents of fraud." Scottrade arranged to have customers pre-qualified for one year of identity repair and protection services "with no enrollment required," and offered customers free enrollment in one year of credit monitoring and identity theft insurance.

Plaintiffs' Consolidated Class Action Complaint asserted that Scottrade provided deficient cybersecurity in violation of its "contractual and other obligations," resulting in a data breach "by people willing to use the information for any number of improper purposes and scams, including making the information available for sale on the black-market." Kuhns alleged that a portion of the fees paid in connection with his Scottrade account "were used for data management and security," but "one or more data thieves ... transferred, sold, opened, read, mined and otherwise used Mr. Kuhns' PII, without his authorization, to their financial benefit and his financial and other detriment." The Complaint alleged that plaintiffs faced an immediate and continuing increased risk of identity theft and identity fraud; incurred financial costs of monitoring their credit and financial accounts to mitigate against that risk; received Brokerage Agreement services diminished in value and therefore overpaid Scottrade for those services; suffered economic damage from the decline in value of their PII; and suffered invasion of privacy and breach of confidentiality.

Scottrade filed a Motion to Dismiss for lack of subject matter jurisdiction and for failure to state a claim. The district court granted the Rule 12(b)(1) Motion to Dismiss for lack of subject matter jurisdiction because plaintiffs did not have standing to bring their claims. Kuhns (but not the other plaintiffs) appeals that ruling. The district court did not address Scottrade's fully briefed Rule 12(b)(6) Motion to Dismiss for failure to state a claim. Scottrade urges us to affirm the Rule 12(b)(1) dismissal and in a cross appeal urges us to dismiss for failure to state a claim. With the appeal fully briefed and awaiting oral argument before this court, Kuhns filed a motion to voluntarily dismiss his appeal and to dismiss Scottrade's cross-appeal. Kuhns argued that the litigation should proceed in a California action filed by Kuhns's attorneys on behalf of a non-appealing co-plaintiff following the district court's dismissal, which had been remanded to state court based on the district court's ruling that there was no federal subject matter jurisdiction.

II. Standing.

We review a district court's dismissal for lack of subject matter jurisdiction de novo . Diversified Ingredients, Inc. v. Testa , 846 F.3d 994, 995 (8th Cir.), cert. denied , ––– U.S. ––––, 137 S.Ct. 2247, 198 L.Ed.2d 679 (2017). Like the district court, we consider Scottrade's facial attack on jurisdiction based on the face of the Consolidated Complaint and on other materials necessarily embraced by the pleadings, such as relevant contract documents. See Zean v. Fairview Health Servs. , 858 F.3d 520, 526-27 (8th Cir. 2017). We accept all fact allegations as true, and make all reasonable inferences in favor of Kuhns. Carlsen v. GameStop, Inc. , 833 F.3d 903, 908 (8th Cir. 2016).

Constitutional standing (as opposed to statutory standing) is a threshold question that determines whether a federal court has jurisdiction over a plaintiff's claims. Article III extends judicial power only to "cases" and "controversies." This limitation imposes as an "irreducible constitutional minimum" the burden on plaintiff Kuhns to establish that he personally "(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins , ––– U.S. ––––, 136 S.Ct. 1540, 1547, 194 L.Ed.2d 635 (2016) (quotation omitted). In this case, the issue is whether Kuhns suffered an injury in fact, that is, "an invasion of a legally protected interest that is concrete and particularized and actual or imminent, not conjectural or hypothetical." Id. at 1548 (quotations omitted); see Clapper v. Amnesty Int'l, USA , 568 U.S. 398, 133 S.Ct. 1138, 1147, 185 L.Ed.2d 264 (2013).

Though Kuhns asserted, and the parties briefed, additional alleged types of injury in fact, we conclude he has standing regarding his breach of contract and contract-related claims based on allegations that he did not receive the full benefit of his bargain with Scottrade. Kuhns alleges that a portion of the fees paid in connection with his Scottrade account were used to meet Scottrade's contractual obligations to provide data management and security to protect his PII. When Scottrade breached those obligations, Kuhns received brokerage services of lesser value. He asserts that the difference between the amount he paid and the value of the services received is an actual economic injury that establishes injury in fact for his contract-related claims.

We have previously explained that "a party to a breached...

To continue reading

Request your trial
58 cases
  • Dinerstein v. Google, LLC, No. 19 C 4311
    • United States
    • U.S. District Court — Northern District of Illinois
    • September 4, 2020
    ...The injury therefore stemmed from traditional principles of contract law that did not depend on financial harm."); Kuhns v. Scottrade, Inc. , 868 F.3d 711, 716 (8th Cir. 2017) (quoting Carlsen v. GameStop, Inc. , 833 F.3d 903, 909 (8th Cir. 2016) ) ("[A] party to a breached contract has a j......
  • Perdue v. Hy-Vee, Inc.
    • United States
    • U.S. District Court — Central District of Illinois
    • April 20, 2020
    ...conduct amounted to false, deceptive, or misleading conduct."). Defendant urges the Court to follow the opinion in Kuhns v. Scottrade, Inc. , 868 F.3d 711, 719 (8th Cir. 2017), where the court granted defendant's motion to dismiss plaintiffs' Missouri MPA claim; however, in that case, a sec......
  • CHKRS, LLC v. City of Dublin
    • United States
    • U.S. Court of Appeals — Sixth Circuit
    • January 4, 2021
    ...the lack of standing. See, e.g. , Hicks v. State Farm Fire & Cas. Co. , 965 F.3d 452, 463 (6th Cir. 2020) (citing Kuhns v. Scottrade, Inc. , 868 F.3d 711, 716 (8th Cir. 2017) ); Springer v. Cleveland Clinic Emp. Health Plan Total Care , 900 F.3d 284, 287–90 (6th Cir. 2018). Consider also wh......
  • Griffey v. Magellan Health Inc.
    • United States
    • U.S. District Court — District of Arizona
    • September 27, 2021
    ...to dismiss stage, courts cannot be left to "guess" how a party failed to perform their contractual obligations. Kuhns v. Scottrade, Inc. , 868 F.3d 711, 718 (8th Cir. 2017).Plaintiffs allege that Magellan failed to uphold its bargain when it did not "properly monitor the computer network an......
  • Request a trial to view additional results
1 books & journal articles

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT