Customer Data Sec. Breach Litig. Melissa Alleruzzo v. Supervalu, Inc. (In re Supervalu, Inc.)

• Decision Date: 31 May 2019
• Docket Number: No. 18-1648,18-1648
• Citation: 925 F.3d 955
• Parties: IN RE: SUPERVALU, INC., Customer Data Security Breach Litigation Melissa Alleruzzo; Heidi Bell; Rifet Bosnjak; John Gross; Kenneth Hanff; David Holmes; Steve McPeak; Gary Mertz; Katherin Murray; Christopher Nelson; Carol Puckett; Alyssa Rocke; Timothy Roldan; Ivanka Soldan ; Melissa Thompkins; Darla Young, Plaintiffs - Appellants v. SuperValu, Inc.; AB Acquisition, LLC; New Albertsons, Inc., Defendants - Appellees
• Court: U.S. Court of Appeals — Eighth Circuit

925 F.3d 955

IN RE: SUPERVALU, INC., Customer Data Security Breach LitigationMelissa Alleruzzo; Heidi Bell; Rifet Bosnjak; John Gross; Kenneth Hanff; David Holmes; Steve McPeak; Gary Mertz; Katherin Murray; Christopher Nelson; Carol Puckett; Alyssa Rocke; Timothy Roldan; Ivanka Soldan ; Melissa Thompkins; Darla Young, Plaintiffs - Appellants

v.SuperValu, Inc.; AB Acquisition, LLC; New Albertsons, Inc., Defendants - Appellees

No. 18-1648

United States Court of Appeals, Eighth Circuit.

Submitted: February 12, 2019

Filed: May 31, 2019

Ben Barnow, Erich Schork, BARNOW & ASSOCIATES, Chicago, IL, Richard L. Coffman, COFFMAN LAW FIRM, Beaumont, TX, John J. Driscoll, Christopher Joseph Quinn, THE DRISCOLL FIRM, Saint Louis, MO, Edwin J. Kilpela, Jr., CARLSON & LYNCH, Pittsburgh, PA, David Langevin, Rhett Anthony McSweeney, MCSWEENEY & FAY, Minneapolis, MN, Karen Riebel, LOCKRIDGE & GRINDAL, Minneapolis, MN, Aron Robinson, LAW OFFICES OF ARON D. ROBINSON, Chicago, IL, John S. Steward, STEWARD LAW FIRM, Saint Louis, MO, for Plaintiffs-Appellants.

David Thomas Cohen, ORRICK & HERRINGTON, New York, NY, Douglas H. Meal, ORRICK & HERRINGTON, Boston, MA, for Defendant-Appellee SuperValu, Inc.

Marc Andre Al, STOEL & RIVES, Minneapolis, MN, Christopher L. Ingram, John L. Landolfi, VORYS & SATER, Columbus, OH, for Defendants-Appellees AB Acquisition, LLC, New Albertsons, Inc.

Before LOKEN, COLLOTON, and KELLY, Circuit Judges.

KELLY, Circuit Judge.

In 2014, hackers accessed customer financial information from hundreds of retail grocery stores operated by SuperValu, Inc., AB Acquisition, LLC, and New Albertsons, Inc. A group of customers sued the stores. We previously affirmed dismissal of all but one of the suit’s named plaintiffs for lack of standing. See In re SuperValu, Inc., 870 F.3d 763 (8th Cir. 2017). On remand, the district court¹ dismissed the remaining plaintiff for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6) and denied plaintiffs’ motion for leave to amend their complaint. We affirm both rulings.

I

Our prior opinion summarizes the facts alleged in the consolidated amended complaint, which we accept as true. See id. at 766–67. We repeat here only the facts relevant to the instant appeal. In 2014, defendants’ grocery stores suffered two cyberattacks that allowed hackers to steal customers’ card information, including their names, credit or debit card account numbers, expiration dates, personal identification numbers, and card verification value codes. The stolen card information is distinct from the type of personally identifying information generally necessary to open a new fraudulent account, "such as social security numbers, birth dates, or driver’s license numbers." Id. at 770. Defendants notified customers of the first attack, which occurred in late June and early July 2014, via a press release on August 14, 2014. On September 29, 2014, they announced a second attack, which took place in late August or early September 2014. Plaintiffs allege that the two data breaches were connected and resulted from the stores’ failure to properly safeguard their customers’ personal information.

Plaintiffs filed multiple putative class actions against the stores, which were consolidated. Defendants moved to dismiss, asserting that the court lacked subject-matter jurisdiction because plaintiffs lacked standing, see Fed. R. Civ. P. 12(b)(1), and that plaintiffs failed to state a claim upon which relief could be granted, see Fed. R. Civ. P. 12(b)(6). The district court granted defendants’ motion under Rule 12(b)(1) and dismissed the complaint without prejudice. It concluded that none of the plaintiffs had alleged an injury in fact because the complaint’s allegations were insufficient to plausibly suggest that plaintiffs were likely to suffer future identity theft. The court did not address defendants’ alternative motion under Rule 12(b)(6).

Plaintiffs then filed a motion to alter or amend the judgment under Rule 59(e). Plaintiffs attached three declarations from officers of financial institutions who averred that some payment cards issued by their respective institutions incurred fraudulent charges following the data breaches. Plaintiffs’ motion included a request for leave to file an amended complaint but did not attach a proposed amended pleading. The district court denied plaintiffs’ Rule 59(e) motion for failing to meet the standard for newly discovered evidence. It also denied the motion for leave to amend because plaintiffs had not submitted a proposed amended complaint, as required by the court’s local rules. Plaintiffs appealed the district court’s dismissal for lack of subject-matter jurisdiction but did not appeal the denial of their Rule 59(e) motion.

On appeal, we affirmed the district court’s dismissal of all of the named plaintiffs for lack of standing, except for David Holmes. We concluded that no plaintiff had alleged a prospective injury in fact because, as pleaded, the likelihood of future identity theft was purely speculative. In re SuperValu, 870 F.3d at 768–72. But we found that Holmes, the only plaintiff who alleged that he experienced an unauthorized charge to his account, had alleged a present injury in fact. Id. at 772. According to the complaint, Holmes used his credit card at a Shop ’n Save store operated by SuperValu in Belleville, Illinois, on an unspecified date. "On information and belief," Holmes’s card information was compromised as a result of the cyberattacks. Shortly after the data breaches were announced, Holmes noticed a fraudulent charge on his credit card statement and immediately cancelled his credit card, which took two weeks to replace. This was sufficient for standing purposes, but we nonetheless acknowledged that Holmes’s failure to allege certain details—such as "the date he shopped at the affected Illinois store, the amount of the charge, or that the charge was unreimbursed"—"could be fatal to the complaint under the ‘higher hurdles’ of Rules 8(a) and 12(b)(6)." Id. at 773. We remanded to allow the district court to consider defendants’ Rule 12(b)(6) motion as to Holmes in the first instance.

On remand, defendants renewed their motion to dismiss. A week later, plaintiffs filed a second motion for leave to amend. This time, plaintiffs included a proposed amended complaint that added general allegations about the likelihood of identity theft following a data breach. Many of these allegations were based on the same three affidavits plaintiffs had attached to their earlier Rule 59(e) motion. The district court denied plaintiffs’ motion, reasoning that futility and undue delay compelled denial of leave to amend under Rule 15(a)(2). The court then dismissed all claims against AB Acquisition and New Albertsons because Holmes did not shop at an Albertsons store. It also found that Holmes’s negligence, consumer protection, implied contract, and unjust enrichment claims all failed as a matter of law and therefore granted SuperValu’s motion to dismiss in full.

II

We first address the district court’s denial of plaintiffs’ second motion for leave to amend. As an initial matter, the parties dispute which rules govern this motion. Defendants argue that, because the district court initially dismissed the complaint and entered judgment on January 7, 2016, plaintiffs cannot seek leave to amend their complaint unless that judgment is first set aside or vacated under Rule 59(e) or Rule 60(b). Plaintiffs contend that they need not satisfy the requirements of those rules because the court’s initial dismissal was without prejudice. The district court declined to opine on whether the motion was properly construed as a postjudgment motion because, even under the more lenient standards applicable to prejudgment motions, futility and undue delay counseled against granting leave to amend under Rule 15(a)(2).

We have repeatedly explained that "[a] motion for leave to amend after dismissal is subject to different considerations than a motion prior to dismissal." Mountain Home Flight Serv., Inc. v. Baxter Cty., 758 F.3d 1038, 1045 (8th Cir. 2014). Leave to amend should be granted liberally under Rule 15 prior to dismissal. After judgment has been entered, district courts may not ignore the considerations of Rule 15, but leave to amend a pleading will be granted only "if it is consistent with the stringent standards governing the grant of Rule 59(e) and Rule 60(b) relief." United States v. Mask of Ka-Nefer-Nefer, 752 F.3d 737, 743 (8th Cir. 2014). Even if a dismissal is without prejudice, if the court intended the decision to be a final, appealable order, it constitutes dismissal of the entire action, and the more stringent postjudgment standards apply. Mountain Home, 758 F.3d at 1045–46.

The district court’s original dismissal constituted a final, appealable order dismissing the entire action. Plaintiffs acknowledged as much by styling their initial motion to amend as a motion under Rule 59(e) and by appealing the district court’s judgment of dismissal to this court. We reversed that judgment with regard to Holmes, but we affirmed it as to every other named plaintiff. To revive those plaintiffs’ claims, the original judgment must be set aside under Rule 59 or 60 before amendment can be permitted under Rule 15(a)(2). See generally 6 Charles Alan Wright, Arthur R. Miller & Mary Kay Kane, Federal Practice and Procedure § 1489, at 814–24 (3d ed. 2010). Plaintiffs’ proposed amendments relate only to the claims of the previously-dismissed plaintiffs; they do not contain any new allegations specific to Holmes. Thus, the motion must be treated as a postjudgment motion. We review its denial for an abuse of discretion. Middleton v. McDonald, 388 F.3d 614, 616 (8th Cir. 2004).

The district court did not abuse its discretion because plaintiffs’ postjudgment motion is untimely. Plaintiffs filed their motion on November 7, 2017, a year and ten months after the district court’s original judgment. This puts the...