Pisciotta v. Old Nat. Bancorp

• Court: U.S. Court of Appeals — Seventh Circuit
• Writing for the Court: Ripple
• Citation: Pisciotta v. Old Nat. Bancorp, 499 F.3d 629 (7th Cir. 2007)
• Decision Date: 23 August 2007
• Docket Number: No. 06-3817.,06-3817.
• Parties: Luciano PISCIOTTA and Daniel Mills, on behalf of themselves and others similarly situated, Plaintiffs-Appellants, v. OLD NATIONAL BANCORP, Defendant-Appellee.

499 F.3d 629

Luciano PISCIOTTA and Daniel Mills, on behalf of themselves and others similarly situated, Plaintiffs-Appellants, v. OLD NATIONAL BANCORP, Defendant-Appellee.

No. 06-3817.

United States Court of Appeals, Seventh Circuit.

Argued May 21, 2007.

Decided August 23, 2007.

William N. Riley (argued), Price Waicukauski Riley & Debrota, Indianapolis, IN, for Plaintiffs-Appellants.

Mark J.R. Merkle (argued), Greg A. Small, Krieg Devault, Indianapolis, IN, for Defendant-Appellee.

Before RIPPLE, WOOD and EVANS, Circuit Judges.

RIPPLE, Circuit Judge.

Plaintiffs Luciano Pisciotta and Daniel Mills brought this action on behalf of a putative class of customers and potential customers of Old National Bancorp ("ONB"). They alleged that, through its website, ONB had solicited personal information from applicants for banking services, but had failed to secure it adequately. As a result, a third-party computer "hacker" was able to obtain access to the confidential information of tens of thousands of ONB site users. The plaintiffs sought damages for the harm that they claim to have suffered because of the security breach; specifically, they requested compensation for past and future credit monitoring services that they have obtained in response to the compromise of their personal data through ONB's website. ONB answered the allegations and then moved for judgment on the pleadings under Rule 12(c). The district court granted ONB's motion and dismissed the case. The plaintiffs timely appeal. For the reasons set forth in this opinion, we affirm the judgment of the district court.

I BACKGROUND

A. Facts

ONB operates a marketing website on which individuals seeking banking services can complete online applications for accounts, loans and other ONB banking services. The applications differ depending on the service requested, but some forms require the customer or potential customer's name, address, social security number, driver's license number, date of birth, mother's maiden name and credit card or other financial account numbers. In 2002 and 2004, respectively, Mr. Pisciotta and Mr. Mills accessed this website and entered personal information in connection with their applications for ONB banking services.

In 2005, NCR, a hosting facility that maintains ONB's website, notified ONB of a security breach. ONB then sent written notice to its customers. The results of the investigation that followed have been filed under seal in this court; for present purposes, it will suffice to note that the scope and manner of access suggests that the intrusion was sophisticated, intentional and malicious.

B. District Court Proceedings

Mr. Pisciotta and Mr. Mills, on behalf of a putative class of other ONB website users, brought this action in the United States District Court for the Southern District of Indiana. They named ONB and NCR as defendants and asserted negligence claims against both defendants as well as breach of implied contract claims by ONB and breach of contract by NCR. The plaintiffs alleged that:

[b]y failing to adequately protect [their] personal confidential information, [ONB and NCR] caused Plaintiffs and other similarly situated past and present customers to suffer substantial potential economic damages and emotional distress and worry that third parties will use [the plaintiffs'] confidential personal information to cause them economic harm, or sell their confidential information to others who will in turn cause them economic harm.

R.37 at 2.

In pleading their damages, the plaintiffs stated that they and others in the putative class "have incurred expenses in order to prevent their confidential personal information from being used and will continue to incur expenses in the future." Id. at 4. Significantly, the plaintiffs did not allege any completed direct financial loss to their accounts as a result of the breach. Nor did they claim that they or any other member of the putative class already had been the victim of identity theft as a result of the breach. The plaintiffs requested "[c]ompensation for all economic and emotional damages suffered as a result of the Defendants' acts which were negligent, in breach of implied contract or in breach of contract," and "[a]ny and all other legal and/or equitable relief to which Plaintiffs . . . are entitled, including establishing an economic monitoring procedure to insure [sic] prompt notice to Plaintiffs . . . of any attempt to use their confidential personal information stolen from the Defendants." Id. at 5-6.

NCR moved to dismiss for failure to state a claim; its motion was granted. This ruling has not been appealed. ONB, the remaining defendant, answered the second amended complaint. The plaintiffs moved for class certification. ONB then filed a motion for judgment on the pleadings under Federal Rule of Civil Procedure 12(c) and a memorandum in opposition to class certification.

The district court granted ONB's motion for judgment on the pleadings and denied the plaintiffs' motion for class certification as moot. Specifically, the district court concluded that the plaintiffs' claims failed as a matter of law because "they have not alleged that ONB's conduct caused them cognizable injury." R.78 at 3. In support of its conclusion, the court noted that, under Indiana law, damages must be more than speculative; therefore, the plaintiffs' allegations that they had suffered "substantial potential economic damages" did not state a claim. Id. (emphasis in original).

The district court looked to five cases from other district courts across the Country that had rejected claims for "the cost of credit monitoring as an alternative award for what would otherwise be speculative and unrecoverable damages." Id. Finding their reasoning persuasive, the district court concluded that "[t]he expenditure of money to monitor one's credit is not the result of any present injury, but rather the anticipation of future injury that has not yet materialized." Id. at 4 (citing Forbes v. Wells Fargo Bank, N.A., 420 F.Supp.2d 1018, 1021 (D.Minn.2006)). The court also concluded that, although not enumerated as a separate cause of action in the complaint, the plaintiffs had made allegations that could relate to a claim for negligent infliction of emotional distress; the court dismissed this claim as well. It noted that, as a matter of Indiana law, any such action was dependent on an underlying negligence claim. Id. at 5. Finally, the court concluded that there could be no action for breach of contract under Indiana law in the absence of an allegation of cognizable damages.

The plaintiffs then timely appealed the entry of judgment for ONB on the claims for negligence and breach of implied contract¹ and further asked that this court vacate the order denying class certification as moot.

II DISCUSSION

We review a district court's decision on a 12(c) motion de novo. Moss v. Martin, 473 F.3d 694, 698 (7th Cir.2007). We take the facts alleged in the complaint as true, drawing all reasonable inferences in favor of the plaintiff. Thomas v. Guardsmark, Inc., 381 F.3d 701, 704 (7th Cir.2004). We review the judgment for the defendants by employing the same standard that we apply when reviewing a motion to dismiss under Rule 12(b)(6). Guise v. BWM Mortgage, LLC, 377 F.3d 795, 798 (7th Cir.2004). The complaint must contain only "a short and plain statement of the claim showing that the pleader is entitled to relief." Fed.R.Civ.P. 8(a)(2); see also Conley v. Gibson, 355 U.S. 41, 47, 78 S.Ct. 99, 2 L.Ed.2d 80 (1957). There is no need for detailed factual allegations. Conley, 355 U.S. at 47, 78 S.Ct. 99. However, the statement must "give the defendant fair notice of what the . . . claim is and the grounds upon which it rests." Id. "Factual allegations must be enough to raise a right to relief above the speculative level." Bell Atl. Corp. v. Twombly, ___ U.S. ___, 127 S.Ct. 1955, 1965, 167 L.Ed.2d 929 (2007); see also Jennings v. Auto Meter Prods., Inc., 495 F.3d 466, 472 (7th Cir.2007).

A. Jurisdiction

The plaintiffs filed this action in the district court under the Class Action Fairness Act of 2005, Pub.L. 109-2, § 4, 119 Stat. 4, 9 (codified at 28 U.S.C. § 1332(d)) ("CAFA"), on behalf of a putative class that includes residents of Indiana, Illinois, Kentucky, Missouri, Ohio and Tennessee. Under CAFA, the district court had jurisdiction over this action because "the matter in controversy exceeds the sum or value of $5,000,000, exclusive of interest and costs," 28 U.S.C. § 1332(d)(2), and because at least one member of the proposed class is a citizen of a State different from ONB. Id. § 1332(d)(2)(A). In short, subject to limitations not relevant here, CAFA allows for incomplete diversity. Id.; cf. Strawbridge v. Curtiss, 3 Cranch 267, 7 U.S. 267, 2 L.Ed. 435 (1806) (interpreting the language of the general federal diversity statute to require complete diversity). In calculating the requisite amount in controversy, CAFA requires that the claims of all the plaintiffs be aggregated. 28 U.S.C. § 1332(d)(6); cf. In re Brand Name Prescription Drugs Antitrust Litig., 123 F.3d 599, 607 (7th Cir.1997) (noting the otherwise applicable rule that aggregation is not permitted and, therefore, at least one plaintiff in a particular class must satisfy the jurisdictional minimum).

We have, of course, an independent responsibility to examine our subject matter jurisdiction. See Steel Co. v. Citizens for a Better Env't, 523 U.S. 83, 95, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998). As we have noted, in reaching the conclusion that dismissal was appropriate, the district court in this case relied on several cases from other district courts throughout the Country. Many of those cases have concluded that the federal courts lack jurisdiction because plaintiffs whose data has been compromised, but not yet misused, have not suffered an injury-in-fact sufficient to confer Article III standing.² We are not persuaded by the...