Alonso v. Blue Sky Resorts, LLC

• Decision Date: 14 April 2016
• Docket Number: Case No. 4:15-cv-00016-TWP-TAB
• Parties: Annie Alonso and Natalie Hardt, and all others similarly situated, Plaintiffs, v. Blue Sky Resorts, LLC, French Lick West Baden Development Park, LLC, and Blue Sky Casinos, LLC, Defendants.
• Court: U.S. District Court — Southern District of Indiana

179 F.Supp.3d 857

Annie Alonso and Natalie Hardt, and all others similarly situated, Plaintiffs,

v.Blue Sky Resorts, LLC, French Lick West Baden Development Park, LLC, and Blue Sky Casinos, LLC, Defendants.

Case No. 4:15-cv-00016-TWP-TAB

United States District Court, S.D. Indiana, New Albany Division.

Signed April 14, 2016

Jessica A. Wegg, Syed Ali Saeed, Saeed & Little LLP, Ryan R. Frasher, Ryan Frasher P.C., Indianapolis, IN, for Plaintiffs.

James M. Hinshaw, John F. McCauley, Bingham Greenebaum Doll LLP, Indianapolis, IN, for Defendants.

French Lick West Baden Development Park, LLC, pro se.

ENTRY ON DEFENDANTS' MOTION TO DISMISS

TANYA WALTON PRATT, JUDGE

This matter is before the Court on a Motion to Dismiss pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6), filed by Defendants Blue Sky Resorts, LLC, and Blue Sky Casinos, LLC (collectively, “Blue Sky”) (Filing No. 34). Plaintiffs Annie Alonso (“Alonso”) and Natalie Hardt (“Hardt”) (collectively, “Plaintiffs”), filed this consumer action lawsuit individually and on behalf of all other individuals similarly situated, alleging Breach of Implied Contract, Unjust Enrichment, and Breach of Duty of Good Faith and Fair Dealing after their personal information was stolen as a result of a data breach of Blue Sky's servers. For the following reasons, the Court GRANTS Blue Sky's Motion to Dismiss.

I. BACKGROUND

Blue Sky owns and operates the French Lick Resort¹ located in Southern Indiana. Alonso, a resident of Indiana, stayed at Blue Sky's West Baden Springs Hotel from July 27 to July 29, 2014, and paid for her room with her credit card. Hardt, a resident of Kentucky, stayed at Blue Sky's French Lick Springs Hotel from May 23 to May 26, 2014, and she also paid for her room with her credit card.

On January 19, 2015, Blue Sky learned that it had suffered a data breach committed by hackers who had installed a malware program on one of its servers on French Lick Resort's point of sale system. This malware allowed the hackers to periodically obtain certain credit card information from some, but not all, of the resort's customers who had used their credit cards at the resort—specifically the names, credit card numbers, and card expiration dates were stolen (Filing No. 36 at 3–4). Upon discovering the data breach, Blue Sky immediately provided information to law enforcement authorities and employed a specialized computer technology team to investigate, isolate, and eliminate the malware.

The concealment of the malware was so sophisticated that it was undetected by these experts for several days. An internal investigation revealed that the malware had been installed on the point of sale system on April 23, 2014, and it was not disabled until January 21, 2015, two days after the first notification of a data breach.

Starting on January 26, 2015, Blue Sky provided notification of the data breach to its customers by sending letters directly to them. Additionally, starting on January 26, 2015, Blue Sky began notifying the Attorneys General in fifteen states, including Indiana. On January 27, 2015, Blue Sky provided notification to major news publications in the affected areas, established a call center for customer inquiries and concerns, established free credit monitoring services with Experian for customers, and established insurance coverage for identity theft situations arising out of the data breach of up to $1 million per credit card number. Customers also were encouraged to carefully monitor their credit card statements for unauthorized transactions and were advised to cancel their credit cards and request replacement cards.

According to the Third Amended Complaint (Filing No. 33), Alonso's credit card was replaced in January 2015, and Hardt's credit card was replaced in June 2014. Alonso and Hardt each suffered damages as a result of Blue Sky's inability to safeguard their personal data. Specifically, Alonso was delinquent in her automatic credit card payment to her AT&T account when her credit card was cancelled due to the data breach, and she spent over an hour of her time changing various automatic credit card payment setups. Hardt also spent over an hour of her time researching and signing up with a credit card monitoring service for which she is being charged $8.49 per month. Neither Alonso nor Hardt have alleged or offered any evidence that their credit card information was actually used, resulting in any fraudulent transactions on their accounts.

Alonso and Hardt allege that there is a class of others similarly situated who had their personal information stolen.² Plaintiffs describe the purported class as “[a]ll persons who live in the United States and whose personal and/or financial information was breached as a result of the Data Breach discovered by the Defendants in January 2015.” (Filing No. 33 at 8.) Plaintiffs allege that they, and the purported class members, were overcharged for their purchase of products and services at the French Lick Resort in that a portion of the purchase price was dedicated to ensuring that customers were protected and safeguarded from data breaches.

II. LEGAL STANDARD

A motion to dismiss under Rule 12(b)(1) challenges the court's subject matter jurisdiction. The burden of proof is on the plaintiff, the party asserting jurisdiction. United Phosphorus, Ltd. v. Angus Chem. Co ., 322 F.3d 942, 946 (7th Cir.2003), overruled on other grounds by Minn – Chem, Inc. v. Agrium, Inc ., 683 F.3d 845 (7th Cir.2012) (en banc ). “The plaintiff has the burden of supporting the jurisdictional allegations of the complaint by competent proof.” Int'l Harvester Co. v. Deere & Co ., 623 F.2d 1207, 1210 (7th Cir.1980). “In deciding whether the plaintiff has carried this burden, the court must look to the state of affairs as of the filing of the complaint; a justiciable controversy must have existed at that time.” Id . “When ruling on a motion to dismiss for lack of subject matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1), the district court must accept as true all well-pleaded factual allegations, and draw reasonable inferences in favor of the plaintiff, unless standing is challenged as a factual matter.” Ezekiel v. Michel , 66 F.3d 894, 897 (7th Cir.1995) (citation omitted). Furthermore, “[t]he district court may properly look beyond the jurisdictional allegations of the complaint and view whatever evidence has been submitted on the issue to determine whether in fact subject matter jurisdiction exists.” Id. (citation and quotation marks omitted).

Federal Rule of Civil Procedure 12(b)(6) allows a defendant to move to dismiss a complaint that has failed to “state a claim upon which relief can be granted.” Fed. R. Civ. P. 12(b)(6). When deciding a motion to dismiss under Rule 12(b)(6), the court accepts as true all factual allegations in the complaint and draws all inferences in favor of the plaintiff. Bielanski v. County of Kane , 550 F.3d 632, 633 (7th Cir.2008).

The complaint must contain a “short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). In Bell Atlantic Corp. v. Twombly, the United States Supreme Court explained that the complaint must allege facts that are “enough to raise a right to relief above the speculative level.” 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). Although “detailed factual allegations” are not required, mere “labels,” “conclusions,” or “formulaic recitation[s] of the elements of a cause of action” are insufficient. Id. “[I]t is not enough to give a threadbare recitation of the elements of a claim without factual support.” Bissessur v. Ind. Univ. Bd. of Trs. , 581 F.3d 599, 603 (7th Cir.2009). The allegations must “give the defendant fair notice of what the … claim is and the grounds upon which it rests.” Twombly , 550 U.S. at 555, 127 S.Ct. 1955. Stated differently, the complaint must include “enough facts to state a claim to relief that is plausible on its face.” Hecker v. Deere & Co. , 556 F.3d 575, 580 (7th Cir.2009) (citation and quotation marks omitted). To be facially plausible, the complaint must allow “the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (citing Twombly , 550 U.S. at 556, 127 S.Ct. 1955 ).

III. DISCUSSION

Blue Sky moves to dismiss the Third Amended Complaint under Rule 12(b)(1), asserting Alonso and Hardt lack standing in that they present no allegations of a concrete and actual injury or a foreseeable concrete and actual injury that is traceable to the challenged conduct. Blue Sky also moves to dismiss under Rule 12(b)(6), alleging Alonso and Hardt fail to present a cognizable claim for their alleged injuries. The Court will address each contention in turn.

A. Dismissal Under Rule 12(b)(1)

Blue Sky argues that Plaintiffs have failed to establish Article III standing, and thus, their claims should be dismissed pursuant to Rule 12(b)(1). The standard to establish Article III standing has been articulated by the Supreme Court as follows:

First, the plaintiff must have suffered an “injury in fact”—an invasion of a legally protected interest which is (a) concrete and particularized, and (b) “actual or imminent, not ‘conjectural’ or ‘hypothetical.’ ” Second, there must be a causal connection between the injury and the conduct complained of—the injury has to be “fairly...traceable to the challenged action of the defendant, and not...the result of the independent action of some third party not before the court.” Third, it must be “likely,” as opposed to merely “speculative,” that the injury will be “redressed by a favorable decision.”

Lujan v. Defenders of Wildlife , 504 U.S. 555, 560–61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) (citations omitted). These three elements are the “irreducible constitutional minimum of standing.” Id. at 560, 112 S.Ct. 2130. Plaintiffs have the burden to...