Keith v. IES Communications LLC

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
WO
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF ARIZONA
Cody Keith, individually and on behalf of
those similarly situated,
Plaintiff,
v.
IES Communications, LLC,
Defendant.
No. CV-25-02452-PHX-SHD
ORDER
Pending is Defendant IES Communications, LLC (“IES Communications,” or
“IES”) Motion to Dismiss Plaintiff Cody Keith’s Class Action Complaint (“Motion”).
(Doc. 18.) For the following reasons, IES Communications’ Motion will be denied in part
and granted in part.
I. BACKGROUND
IES Communications is a national technology infrastructure provider with more
than 10,500 employees across over 90 locations in the United States, offering electrical,
mechanical, and communications contracting services. (Doc. 1 at ¶ 21.) IES
Communications maintains the personal identifying information (“PII”) of its current and
former employees, including Plaintiff Cody Keith (“Keith”). (Id. at ¶¶ 2, 22.) Employee
PII includes names, dates of birth, addresses, payroll information, and Social Security
numbers. (Id.)
On or around March 7, 2025, an unauthorized actor gained access to IES’s
Information Technology (“IT”) infrastructure (the “Data Breach”). (Id. at ¶¶ 2 n.1, 7, 29.)
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 1 of 18

- 2 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
IES Communications discovered the intrusion approximately ten days later, on March 17,
2025. (Id. at ¶ 7.) A ransomware group known as “Chaos” claimed credit for the attack,
asserting that it exfiltrated approximately one terabyte of data from IES Communications
and listing IES Communications on its “dark leak site.” (Id. at ¶ 8.) On or around July 3,
2025, Keith received a letter from IES Communications notifying him that his PII—
including his first and last name, date of birth, address, payroll information, and Social
Security number—may have been compromised in the Data Breach. (Id. at ¶ 2; Doc. 18 at
2.)
Keith alleges that, due to the Data Breach, he and others similarly situated have
suffered lost time spent addressing the data breach, diminution in the value of their PII, and
emotional distress. (Doc. 1 at ¶¶ 79–93.) He also alleges that they are at continuing risk
of fraud and identity theft. (Id. at ¶ 93.) Keith further alleges that he has experienced a
significant increase in spam calls and texts soliciting him to provide his PII for jobs he
never applied to. (Id. at ¶ 86.)
Keith filed this putative class action on behalf of himself and all persons whose PII
was compromised in the Data Breach or who otherwise suffered harm as a result of it. (Id.
at ¶ 94.) He proposes the following Class definition: “All persons whose PII was
compromised in the Data Breach or have otherwise suffered harm because of the Data
Breach” (the “Class”). (Id. at ¶ 95.) Keith’s complaint (“Complaint”) asserts five causes
of action on behalf of himself and the Class: (1) negligence/negligence per se; (2) breach
of implied contract; (3) invasion of privacy; (4) unjust enrichment; and (5) declaratory
judgment and injunctive relief. (Id. at ¶¶ 107–182.) Keith seeks damages, restitution, and
injunctive relief requiring IES to, among other things, strengthen its data-security systems,
submit to future annual audits, implement written cybersecurity policies, and continue
providing credit-monitoring services to the class. (Id. at ¶ 119; id. at pp. 33–36.)
IES Communications moved to dismiss the Complaint in its entirety under Rules
12(b)(1) and 12(b)(6). (Doc. 18.) The Parties fully briefed the Motion.1 (Docs. 22, 23.)
1 I find this motion suitable for decision without oral argument. See LRCiv 7.2(f).
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 2 of 18

- 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
II. LEGAL STANDARD
A. Rule 12(b)(1)
A motion to dismiss under Rule 12(b)(1) challenges the court’s subject matter
jurisdiction. Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014). The party invoking
federal jurisdiction bears the burden of establishing jurisdiction. Kokkonen v. Guardian
Life Ins. Co. of Am., 511 U.S. 375, 377 (1994). A challenge to subject matter jurisdiction
may be either facial or factual. Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th
Cir. 2004). IES Communications presents a facial attack to the Complaint. (Doc. 18 at 8–
10.) A facial attack “accepts the truth of the plaintiff’s allegations but asserts that they are
insufficient on their face to invoke federal jurisdiction.” Leite, 749 F.3d at 1121 (quotation
marks omitted). Courts resolve facial attacks under the same standard as a motion to
dismiss under Rule 12(b)(6). Id. That is, “[a]ccepting the plaintiff’s allegations as true
and drawing all reasonable inferences in the plaintiff’s favor, the court determines whether
the allegations are sufficient as a legal matter to invoke the court's jurisdiction.” Id.
A plaintiff invoking federal jurisdiction also bears the burden of establishing
Article III standing, which requires that the plaintiff has “(1) suffered an injury in fact,
(2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely
to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330,
338 (2016). That injury must be “concrete and particularized” and “actual or imminent,
not conjectural or hypothetical.” Id. at 339 (quotation marks omitted). A threatened future
injury must be “certainly impending,” or there must be a “substantial risk” that the harm
will occur to constitute an injury in fact; “allegations of possible future injury are not
sufficient.” Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409, 414 n.5 (2013) (citation
modified).
B. Rule 12(b)(6)
To survive a motion to dismiss under Rule 12(b)(6), a complaint must state a claim
that is “plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009); see Bell Atl.
Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim has facial plausibility when the
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 3 of 18

- 4 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
plaintiff pleads factual content that allows the court to draw the reasonable inference that
the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. A court need
not accept as true “conclusory statements” or “legal conclusions.” Id. A court may dismiss
a complaint “as a matter of law for (1) lack of a cognizable legal theory or (2) insufficient
facts under a cognizable legal claim.” SmileCare Dental Grp. v. Delta Dental Plan of Cal.,
Inc., 88 F.3d 780, 783 (9th Cir. 1996) (citation omitted).
III. DISCUSSION
IES Communications argues that Keith lacks standing to seek prospective injunctive
and declaratory relief, and that each of his five claims fails as a matter of law. (Doc. 18 at
8–19.) I address standing first, because it is a threshold jurisdictional question, and then
the sufficiency of each claim. See Steel Co. v. Citizens for a Better Env’t, 523 U.S. 83, 94–
95 (1998).
A. Article III Standing
Article III standing is assessed separately for each form of relief sought.
TransUnion LLC v. Ramirez, 594 U.S. 413, 431 (2021) (“[S]tanding is not dispensed in
gross; rather, plaintiffs must demonstrate standing for each claim that they press and for
each form of relief that they seek (for example, injunctive relief and damages).”). A
plaintiff who has standing to seek damages for a completed injury does not, for that reason
alone, have standing to pursue prospective injunctive or declaratory relief premised on a
different, future injury. See id. An individual who is “exposed to a risk of future harm
may pursue forward-looking, injunctive relief to prevent the harm from occurring, at least
so long as the risk of harm is sufficiently imminent and substantial.” Id. at 435.
Here, Keith seeks both damages for a completed injury and prospective relief. IES
Communications does not contend that Keith lacks standing to seek damages. I have an
independent obligation to ensure that I have subject matter jurisdiction for each of Keith’s
claims and requested forms of relief. See Fed. R. Civ. P. 12(h)(3). Keith has adequately
alleged an injury in fact sufficient to support a claim for damages. He alleges that his data
was stolen as a result of the Data Breach. (Doc. 1 at ¶¶ 1–2.) He also alleges that he has
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 4 of 18

- 5 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
suffered concrete harm as a result. (See Doc. 1 at ¶¶ 1, 79, 83, 86, 93 (alleging that he
receives increased spam calls, lost time spent trying to protect his information, and suffers
from emotional distress).) And his allegations trace that harm to IES Communications’
conduct. (Id. at ¶ 1.) At the pleading stage, that is enough. See Spokeo, 578 U.S. at 338
(at the pleading stage, plaintiffs must “clearly allege facts demonstrating each element” of
standing).
Keith also seeks injunctive relief in Count 1, Count 5, and the prayer for relief, and
requests a judgment requiring IES Communications to (1) strengthen its data-security
systems, (2) submit to future audits, (3) implement written cybersecurity policies, and
(4) continue credit-monitoring services. (Id. at ¶¶ 119, 175–182; id. at pp. 33–36). As to
Count 5 of his Complaint, Keith seeks a judgment declaring that IES Communications
“owed, and continues to owe” a legal duty to employ reasonable data security and to notify
affected individuals; that it “breached, and continues to breach,” that duty; and that the
breach “continues to cause harm.” (Id. at ¶ 178.) Because these requests are not one form
of relief, standing must be shown for each. TransUnion, 594 U.S. at 431.
1. Keith Lacks Standing to Compel Stronger Systems, Future
Audits, Written Policies, and Declaratory Relief
IES Communications argues that Keith alleges only a completed injury and does
not allege that another breach is certainly impending or presents a substantial risk of
occurring. (Doc. 18 at 8–10.) As to the first three forms of requested injunctive relief, IES
Communications is correct.
Those three requests are aimed at preventing a future intrusion, not at the Data
Breach that already occurred. Allegations of possible future injury are not enough.
Clapper, 568 U.S. at 409. Keith alleges that a breach has already happened. He does not
allege facts showing that another breach of IES Communications’ systems is certainly
impending. His own pleading frames the harm these measures would address as injury “in
the event of another breach.” (Doc. 1 at ¶ 180.) That is a possible future injury, not an
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 5 of 18

- 6 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
imminent one.
Keith responds that the Ninth Circuit, in both Krottner v. Starbucks Corp., 628 F.3d
1139 (9th Cir. 2010), and In re Zappos.com, Inc., 888 F.3d 1020 (9th Cir. 2018),
established that the theft of sensitive personal information itself is an injury in fact,
including for purposes of obtaining forward-looking relief, because it creates a substantial
risk of identity theft. (Doc. 22 at 3–7.) That response does not establish standing to compel
stronger systems, future audits, or written cybersecurity policies.
Krottner and Zappos address a different injury. In Krottner, employees whose
names, addresses, and Social Security numbers were stored on a stolen laptop alleged a
credible threat of real and immediate harm from that theft. 628 F.3d at 1140–43. The court
cautioned that, had the allegations been more conjectural or hypothetical, such as “if no
laptop had been stolen, and [the plaintiffs] had sued based on the risk that it would be stolen
at some point in the future,” the court “would find the threat far less credible.” Id. at 1143.
The first three forms of injunctive relief that Keith requests rest on a less credible risk: that
IES Communications’ systems might be breached again.
Zappos likewise addressed standing arising from a completed theft of personal
information, not standing to oversee a defendant’s future compliance. 888 F.3d at 1023,
1026–29.2 There, the Ninth Circuit held that plaintiffs whose PII was exposed in a breach
had standing based on a substantial risk of identity theft. Id. at 1027–28. Neither case
holds that theft of data, without more, confers standing to enjoin a defendant to reform its
systems to prevent future harm.
Nor would those three forms of relief redress the injury Keith has alleged. Standing
requires that the injury be “likely to be redressed by a favorable judicial decision.” Spokeo,
578 U.S. at 338; see Lujan v. Defs. of Wildlife, 504 U.S. 555, 561 (1992). Strengthening
systems IES Communications still controls, auditing those systems, or requiring written
2 Zappos was abrogated in part as recognized by Healy v. Milliman, Inc., 164 F.4th
701, 708 (9th Cir. 2026). The court in Healy held that TransUnion abrogated Zappos only
insofar as Zappos “would have permitted unnamed class members to go without
demonstrating standing at trial or in any later claims process.” Id.
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 6 of 18

- 7 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
policies would not retrieve data already outside its possession, and would not prevent
misuse of that data. TransUnion permits injunctive relief only “to prevent the harm from
occurring,” and only when the risk of that harm is sufficiently imminent and substantial.
594 U.S. at 435. A past injury does not confer standing to enjoin hypothetical future
misconduct. See City of Los Angeles v. Lyons, 461 U.S. 95, 105–06 (1983).
The same defect defeats the prospective declaration Keith seeks—a judgment
declaring that IES Communications continues to owe and continues to breach a duty to
employ reasonable data security, and that the continuing breach continues to cause harm.
(Doc. 1 at ¶ 178.) That requested declaration is the declaratory counterpart of the system-
reform injunction. It does not redress the completed theft, and it is not tied to a certainly
impending or substantially likely future breach.
Keith therefore lacks Article III standing to seek injunctive or declaratory relief
requiring IES Communications to (1) strengthen its data-security systems, (2) submit to
future audits, and (3) implement written cybersecurity policies.
2. Keith Has Standing to Seek Continued Credit Monitoring
Credit monitoring is different from the other forms of requested injunctive relief.
The injury that relief would remedy is not a speculative second breach. It is the substantial
risk of identity theft from personal information that has already been stolen.
Krottner held that theft of names, addresses, and Social Security numbers creates “a
credible threat of real and immediate harm” sufficient for Article III injury in fact. 628
F.3d at 1143. Zappos reaffirmed that rule and applied it to a hacking incident. 888 F.3d
at 1023, 1026–27. The court found the sensitivity of the stolen information sufficient, even
for plaintiffs who alleged no misuse beyond the theft, because the stolen information “gave
hackers the means to commit fraud or identity theft.” Id. at 1027–29. TransUnion confirms
that a person exposed to a risk of future harm may pursue forward-looking injunctive relief
to prevent that harm from occurring, if the risk is sufficiently imminent and substantial.
TransUnion, 594 U.S. at 435.
Continued credit monitoring is relief of that kind. It is directed at detecting and
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 7 of 18

- 8 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
mitigating identity theft from data already in criminal hands, which is the harm Krottner
and Zappos treat as real and immediate. Krottner, 628 F.3d at 1143; Zappos, 888 F.3d at
1027–29; see Doc. 1 at ¶¶ 12–13, 82, 119. Keith alleges that PII, such as Social Security
numbers, were stolen in the Data Breach. (Doc. 1 at ¶¶ 2, 78, 81.) At the pleading stage,
that breach gives rise to a substantial and imminent risk of future identity theft, not a
speculative chain of possibilities. See Zappos, 888 F.3d at 1028–29; Krottner, 628 F.3d at
1143. The court in Zappos also recognized that injunctive relief of this kind can potentially
redress the threatened injury by helping plaintiffs monitor their credit. 888 F.3d at 1030.
Keith therefore has standing to ask that IES Communications continue credit-monitoring
services.
The Motion is therefore granted in part and denied in part on standing. It is granted
insofar as Keith seeks injunctive or corresponding declaratory relief requiring IES
Communications to strengthen its data-security systems, submit to future audits, or
implement written cybersecurity policies. It is denied insofar as it seeks dismissal for lack
of standing to pursue damages or continued credit-monitoring services. This conclusion
does not resolve whether Keith’s alleged injuries are cognizable for purposes of
establishing the damages element of his negligence claim, or whether Count 5 may proceed
as an independent cause of action rather than as a request for a remedy. Those issues are
addressed below.
B. Keith Fails to State a Claim for Negligence (Count 1)
To state a claim for negligence under Arizona law, a plaintiff must plead “(1) the
existence of a duty recognized by law requiring defendants to conform to a certain standard
of care; (2) defendants’ breach of that duty; (3) a causal connection between the breach and
plaintiffs’ resulting injury; and (4) actual damages.” Delci v. Gutierrez Trucking Co., 275
P.3d 632, 634 (Ariz. Ct. App. 2012). IES Communications challenges duty and damages.
(Doc. 18 at 11–14.) Both challenges succeed, and either is independently fatal to Count 1
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 8 of 18

- 9 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
as pled.
1. Duty
Under Arizona law, a duty arises from a special relationship or from public policy.
Quiroz v. ALCOA Inc., 416 P.3d 824, 829 (Ariz. 2018). It is not presumed, and the plaintiff
bears the burden of proving it. Id. at 827. Foreseeability is not a factor in that
determination. Gipson v. Kasey, 150 P.3d 228, 231 (Ariz. 2007). Arizona has “explicitly
declined to recognize special relationships created by foreseeability, that is, where it is
foreseeable that a defendant’s conduct would impact the victim.” Quinalty v. FocusIT
LLC, 2024 WL 5223587, at *4 (D. Ariz. Dec. 26, 2024) (citing Cal-Am Props. Inc. v. Edais
Eng’g Inc., 509 P.3d 386, 390 (Ariz. 2022)).
Keith alleges that IES Communications owed him a duty of care because it collected
and stored his PII and held a “superior position” to prevent the Data Breach. (Doc. 1 at ¶
112.) That allegation describes a duty arising from foreseeability. It does not identify a
recognized special relationship, and it does not identify an Arizona statute or common-law
rule requiring an employer to prevent a third party’s criminal intrusion into its systems. To
support his argument that IES Communications owed Keith a duty to protect his PII, Keith
cites authorities from other circuits that apply other states’ laws, (Doc. 22 at 7–8,) but these
authorities do not supply the missing duty under Arizona law.
Keith also attempts to satisfy the element of duty through alleging negligence per
se. Although he titles his Count 1 “Negligence/Negligence Per Se,” he asserts that he does
not bring negligence per se as an independent claim. (Doc. 22 at 11.) Rather, he argues
that two statutes provide the standard of care. (Id.) Those two statutes are: Section 5 of
the Federal Trade Commission Act (the “FTCA”), which prohibits “unfair . . . practices in
or affecting commerce,” 15 U.S.C. § 45, and Arizona’s Data Breach Notification Law,
Ariz. Rev. Stat. §§ 18-551 and 18-552.3 (Doc. 1 at ¶¶ 114, 118.)
3 Keith raises Arizona’s Data Breach Notification Law in his Complaint, (Doc. 1 at ¶
118) but in his response to the Motion, he discusses the FTCA and HIPAA. (Doc. 22 at
12.) Because Keith made no mention or claim of HIPAA in the Complaint, I treat the
mention of HIPAA in the response as a typo.
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 9 of 18

- 10 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Negligence per se is “not a cause of action separate from common law negligence.”
Rosales v. Rollag, 2024 WL 4333698, at *5 (D. Ariz. Sept. 27, 2024). “It is a doctrine
under which a plaintiff can establish the duty and breach elements of a negligence claim
based on a violation of a statute that supplies the relevant duty of care.” Johnson v. Yuma
Reg’l Med. Ctr., 769 F. Supp. 3d 936, 954 (D. Ariz. 2024); Griffey v. Magellan Health Inc.,
562 F. Supp. 3d 34, 47 (D. Ariz. 2021). The doctrine therefore helps Keith only if one of
the cited statutes supplies a duty. Neither statute does.
Courts in this District have repeatedly held that the FTCA does not create an
affirmative duty, or evidence of a duty, to protect individuals from data breaches. Johnson,
769 F. Supp. 3d at 955; Gannon v. Truly Nolen of Am., Inc., 2023 WL 6536477, at *2 (D.
Ariz. Aug. 31, 2023). The contrary authorities Keith cites, (Doc. 22 at 12,) do not change
the result. Weisenberger v. Ameritas Mut. Holding Co., 597 F. Supp. 3d 1351 (D. Neb.
2022), and In re Arby’s Rest. Grp. Inc. Litig., 2018 WL 2128441 (N.D. Ga. Mar. 5, 2018),
arise outside this Circuit, do not apply Arizona law, and expressly limit their analysis to
the law of the forum state.
Keith’s reliance on Arizona’s Data Breach Notification Law, (Doc. 1 at ¶ 118,) fares
no better. That statute requires certain individuals who maintain PII to notify those affected
by a security system breach within forty-five days. See Ariz. Rev. Stat. § 18-552(B). The
Legislature, however, specified that only the attorney general can enforce a knowing and
willful violation of the statute. Id. § 18-552(L). A statute that does not provide a private
right of action cannot supply the duty of care for a private negligence per se claim.
Johnson, 769 F. Supp. 3d at 955 (finding that statutes that provide their own enforcement
mechanisms and do not create private rights of action do not provide evidence of a duty).
Keith therefore cannot rely on Arizona’s Data Breach Notification Law to support an
independent negligence per se claim.
Because Keith fails to allege a legally cognizable duty, his negligence claim fails,
and the negligence per se theory fails with it.
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 10 of 18

- 11 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
2. Actual Damages
Even if Keith alleged a legally cognizable duty, his negligence claim fails because
he has not adequately alleged cognizable damages. Arizona law requires that negligence
damages be “actual and appreciable, non-speculative, and more than merely the threat of
future harm.” Johnson, 769 F. Supp. 3d at 947 (quoting CDT, Inc. v. Addison, Roberts &
Ludwig, C.P.A., P.C., 7 P.3d 979, 982–83 (Ariz. Ct. App. 2000)).4
Keith alleges four categories of damages: (1) lost time and an increased risk of future
harm; (2) loss of the benefit of his bargain; (3) diminution in the value of his PII; and
(4) emotional distress. (Doc. 1 at ¶¶ 125–126.) Each category fails under settled Arizona
authority.
First, “general allegations of lost time are not cognizable injuries,” and “threats of
future harm, on their own, are not cognizable negligence injuries.” Johnson, 769 F. Supp.
3d at 949, 950; see also Griffey, 562 F. Supp. 3d at 46. Keith alleges that he spent time
changing passwords and monitoring his accounts. (Doc. 1 at ¶¶ 79–80.) He does not allege
any tangible out-of-pocket loss and thus does not satisfy the standard of “actual and
appreciable” damages. Johnson, 769 F. Supp. 3d at 949–50.
Second, Keith contends that he and the Class “conferred a benefit, including their
valuable PII, on [IES Communications] as a condition of employment.” (Doc. 1 at ¶ 165.)
He further alleges that “[i]n so conferring this benefit, [they] understood that part of the
benefit [IES Communications] derived from the PII would be applied to data security
efforts to safeguard the PII. (Id.) Keith does not, however, adequately allege any
representation or agreement under which his wages were tied to cybersecurity measures.
Even if Keith adequately alleged such an agreement, benefit-of-the-bargain damages are a
contract measure, not a tort measure, and “successful tort plaintiffs are not entitled to have
4 “[P]leading damages sufficient for standing does not necessarily establish
compensable damages” for a negligence claim. Johnson, 769 F. Supp. 3d at 948 (D. Ariz.
2024) (citation omitted); see also Doe v. Chao, 540 U.S. 614, 624–25 (2004) (explaining
establishing injury-in-fact may open the courthouse door for standing purposes, but it does
not necessarily create a cause of action of damages absent more than abstract injuries).
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 11 of 18

- 12 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
damages computed on a contract.” S. Union Co. v. Sw. Gas Corp., 180 F. Supp. 2d 1021,
1040 (D. Ariz. 2002). Courts in this District also require that such damages be tied to a
specific representation or contractual term, not a generalized “understanding.” See
Johnson, 769 F. Supp. 3d at 948 (rejecting benefit of the bargain damages because plaintiffs
“ma[de] no specific allegations that they intended for part of the price they paid for services
was to be used to provide adequate security”); see also Durgan v. U-Haul Int'l Inc., 2023
WL 12140653, at *5 (D. Ariz. July 28, 2023) (finding benefit of the bargain damages
unwarranted when “the Complaint [did] not allege that U-Haul made promises regarding
data security to induce Plaintiffs to contract for its services”). Keith’s benefit-of-the-
bargain theory thus fails to satisfy the damages requirement for a negligence claim.
Third, Keith’s diminution-in-value theory also fails under Arizona law. Keith
argues that he need not assign a dollar value to his compromised data at the pleading stage,
and that it is enough to allege a market for stolen PII, including that such information can
“sell for as much as $363 per record” and that his information’s value was diminished by
its alleged “release onto the Dark Web.” (Doc. 22 at 11; Doc. 1 at ¶¶ 60, 65, 68–71, 75.)
Generalized allegations of purported black-market value do not establish that a
plaintiff’s own information actually lost value but rather “call[] for speculation.” Johnson,
769 F. Supp. 3d at 947–48; see Griffey, 562 F. Supp. 3d at 46. A plaintiff asserting a
diminution-in-value theory “must establish both the existence of a market for [their]
personal information and an impairment of [their] ability to participate in that market.”
Johnson, 769 F. Supp. 3d at 947 (citing Griffey, 562 F. Supp. 3d at 46).
Keith alleges neither. He does not allege that he ever sold, attempted to sell, or
intended to sell his PII, or that the Data Breach impaired any ability to do so. See id. at
948. His general allegations about the value of PII on the black market, (Doc. 1 at ¶¶ 64–
65, 75), cannot override those requirements. See Griffey, 562 F. 3d Supp. at 46 (declining
“to recognize the “dark web” as a legitimate market by which individuals may sell their
information”). The diminution-in-value theory therefore fails and cannot support a
negligence claim.
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 12 of 18

- 13 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Fourth, Keith’s emotional-distress allegations lack the physical consequence
Arizona law requires. Arizona does not permit “recovery for mental disturbance unless
physical injury, illness, or other physical consequence accompany it, or physical harm
develops as a result of the plaintiff’s emotional distress.” Johnson, 769 F. Supp. 3d at
949–50 (quoting Dehart v. Johnson & Johnson, 562 F. Supp. 3d 189, 198 (D. Ariz. 2022)).
Keith alleges only that he and the Class are “forced to live with the stress and anxiety” that
their PII “may be disclosed,” and that they have suffered “anxiety, stress, emotional
distress, loss of privacy, and are at an increased risk of future harm.” (Doc. 1 at ¶¶ 92–93.)
He alleges no physical injury, illness or physical consequence. His generalized allegations
of stress and anxiety are insufficient. Johnson, 769 F. Supp. 3d at 950.
Keith therefore has not alleged cognizable damages under any of the four theories
he advances. Count 1 will be dismissed.
C. Keith Fails to State a Claim for Breach of Implied Contract (Count 2)
A valid contract, whether express or implied, requires “offer, acceptance of the
offer, consideration, sufficient specification of terms so that the obligations involved can
be ascertained,” and an intent to be bound. Day v. LSI Corp., 174 F. Supp. 3d 1130, 1153
(D. Ariz. 2016). Keith’s implied-contract claim fails for two reasons.
First, Keith fails to allege sufficiently specific terms. He points to IES
Communications’ Privacy Policy, which states that IES Communications “will not disclose
Users’ PII to third parties without [] permission,” except for certain business purposes.
(Doc. 1 at ¶ 28.) That provision addresses voluntary third-party disclosures, but it does not
state what, if any, data-security measures IES Communications would employ to prevent
unauthorized criminal intrusion. General privacy-policy language is insufficient to supply
the specific terms of an implied-in-fact contract to maintain reasonable data security.
Johnson, 769 F. Supp. 3d at 955; Griffey, 562 F. Supp. 3d at 51; Durgan, 2023 WL
12140653, at *6.
Second, Keith fails to allege consideration. “[A] promise to perform a pre-existing
duty is insufficient consideration.” Griffey, 562 F. Supp. 3d at 52 (quoting Hisel v.
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 13 of 18

- 14 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Upchurch, 797 F. Supp. 1509, 1521 (D. Ariz. 1992)). Keith alleges that he provided his
personal information as a condition of employment. (Doc. 1 at ¶¶ 128–131.) The exchange
he describes is personal information for employment, which he received. (Id. at ¶ 1.) Keith
also alleges that IES Communications had a duty under state and federal law to use
“adequate cybersecurity measures.” (Doc. 1 at ¶ 130.) But he does not allege that IES
Communications promised to do anything beyond what it was already legally obligated to
do. A privacy policy that merely restates existing legal obligations cannot supply
consideration for an implied contract. In re Banner Health Data Breach Litig., 2017 WL
6763548, at *4 (D. Ariz. Dec. 20, 2017).
Because there is no enforceable implied contract between Keith and IES
Communications, Keith’s claim for breach of the implied covenant of good faith and fair
dealing likewise fails. In re Banner Health, 2017 WL 6763548, at *5. Count 2 will
therefore be dismissed.
D. Keith Fails to State a Claim for Invasion of Privacy (Count 3)
Under Arizona law, invasion of privacy by intrusion requires that a defendant
“intentionally intrude[], physically or otherwise, upon the solitude or seclusion of another
or his private affairs,” in a manner that “would be highly offensive to a reasonable person.”
Feins v. Goldwater Bank NA, 2022 WL 17552440, at *5 (D. Ariz. Dec. 9, 2022) (quoting
Hart v. Seven Resorts Inc., 947 P.2d 846, 853 (Ariz. Ct. App. 1997)). The intrusion must
be intentional. Steinaker v. Sw. Airlines, Co., 2021 WL 11730573, at *5 (D. Ariz. Mar. 11,
2021).
Keith does not allege that IES Communications acted intentionally. He alleges that
Chaos, an independent criminal actor, hacked into IES Communications’ systems and
obtained his PII. (Doc. 1 at ¶¶ 7–8.) His theory of IES Communications’ liability is that
IES Communications inadequately safeguarded that information and maintained it in a
“negligent and/or reckless” manner. (Id. at ¶¶ 5–6.) Keith’s argument is therefore based
on a failure to prevent a third party’s crime. His allegations describe negligent inaction,
not an intentional intrusion by IES Communications. See Bozek v. Ariz. Lab. Force Inc.,
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 14 of 18

- 15 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
2025 WL 264174, at *6 (D. Ariz. Jan. 22, 2025). Negligence is not an intentional intrusion.
See Feins, 2022 WL 17552440, at *5–6.
Even if the failure to take proper security precautions was itself intentional, the
disclosure here was the work of hackers in a single breach, and Keith does not allege that
IES Communications intended for any third party to widely disseminate his information.
See Bozek, 2025 WL 264174, at *6; see also Feins, 2022 WL 17552440, at *5–6. His
argument that the “ubiquity” of data breaches made IES Communications “substantially
certain” that its security failures would result in a breach, (Doc. 22 at 14,) does not supply
the missing intent required to adequately allege an invasion of privacy claim. Feins, 2022
WL 17552440, at *5–6; Bozek, 2025 WL 264174, at *6.
Count 3 will therefore be dismissed.
E. Keith Fails to State a Claim for Unjust Enrichment (Count 4)
“Unjust enrichment occurs when one party has and retains money or benefits that in
justice and equity belong to another.” Griffey, 562 F. Supp. 3d 34, 48 (quoting Trustmark
Ins. Co. v. Bank One, Ariz., NA, 48 P.3d 485, 491 (Ariz. Ct. App. 2002)). A plaintiff must
plead “(1) an enrichment; (2) an impoverishment; (3) a connection between the enrichment
and the impoverishment; (4) the absence of justification for the enrichment and the
impoverishment; and (5) the absence of a legal remedy.” Id. Keith’s claim fails at the first
element.
Keith does not allege that he paid IES Communications for services. He alleges that
he provided his PII as a condition of employment. (Doc. 1 at ¶¶ 108, 128, 165.) His
enrichment theory is that IES Communications “enriched itself by saving the costs [it]
reasonably should have expended on data security measures,” and that it “calculated to
avoid its data security obligations” by “utilizing cheaper, ineffective security measures.”
(Id. at ¶¶ 166–167.) He also alleges that he understood part of the benefit IES
Communications derived from his PII would be applied to data security. (Id. at ¶ 165.)
Griffey considered the same theory. The plaintiffs in that case alleged that they
provided money or labor so the defendant could fund adequate security, and that the
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 15 of 18

- 16 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
defendant enriched itself by spending less than it should have on security measures.
Griffey, 562 F. Supp. 3d at 48. The court held that this theory does not establish an
enrichment unless the plaintiff plausibly alleges that the defendant's security was
inadequate. Id. at 48–49. A breach, standing alone, does not show that the system was
inadequate, because an adequate system and a successful intrusion are not mutually
exclusive. Id. at 50. A list of industry standards, without allegations identifying which
standards the defendant failed to meet and how its systems fell below them, is also
conclusory. Id. The court explained that, without sufficient allegations that the defendant’s
security was inadequate, “there is no way to establish…that [defendant] was enriched, that
Plaintiffs were impoverished, or that there was a connection between the enrichment and
impoverishment.” Id.
The same is true here. Keith alleges that Chaos accessed IES Communications’
systems and claimed to have taken one terabyte of data. (Doc. 1 at ¶¶ 7–8.) That intrusion
does not establish that the security systems were inadequate. Griffey, 562 F. Supp. 3d at
49. Without a proper allegation that IES Communications’ systems were inadequate, there
is no way to establish on the pleadings that IES Communications was enriched, that Keith
was impoverished, or that there was a connection between the two. Griffey, 562 F. Supp.
3d at 50.
Count 4 will therefore be dismissed.
F. Declaratory Judgment and Injunctive Relief (Count 5) are Not
Independent Causes of Action
Independent of the standing ruling discussed above, supra Section III.A, Count 5
fails for the additional reason that declaratory judgment and injunctive relief are remedies,
not standalone causes of action. The Federal Declaratory Judgment Act, 28 U.S.C. §
2201(a), does not itself confer federal subject matter jurisdiction or create a substantive
cause of action; it merely provides a form of relief with respect to claims over which the
[C]ourt has independent subject matter jurisdiction. Skelly Oil Co. v. Phillips Petroleum
Co., 339 U.S. 667, 671–72 (1950); see also Colonial Sav., FA v. Gulino, 2010 WL
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 16 of 18

- 17 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
1996608, at *8 (D. Ariz. May 19, 2010). Likewise, injunctive relief is a remedy available
upon a showing of liability on an underlying cause of action, not a freestanding claim.
Lorona v. Ariz. Summit Law Sch., LLC, 151 F. Supp. 3d 978, 997 (D. Ariz. 2015).
Because Count 5 does not assert any independent substantive claim, it is dismissed
with prejudice as a standalone claim.
IV. Leave to Amend
Leave to amend should be freely given “when justice so requires,” Fed. R. Civ. P.
15(a)(2), but dismissal without leave to amend is appropriate when amendment would be
futile. Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc). Amendment would
be futile as to Keith’s standing to seek injunctive or declaratory relief requiring IES
Communications to strengthen its data-security systems, submit to future audits, or
implement written cybersecurity policies because Keith cannot plead facts showing that
another breach is certainly impending or presents a substantial risk of occurring, rather than
merely possible. Amendment of Count 5 would likewise be futile because declaratory
judgment and injunctive relief are remedies rather than independent causes of action.
Because the other deficiencies identified could potentially be cured by amendment, I will
grant Keith leave to amend his remaining claims.
V. CONCLUSION
Keith has Article III standing to pursue damages and continued credit-monitoring
services. He lacks standing to seek injunctive or declaratory relief requiring IES
Communications to strengthen its data-security systems, submit to future audits, or
implement written cybersecurity policies. Each of his five causes of action fails to state a
claim under Rule 12(b)(6) for the reasons set forth above. Keith will, however, be granted
leave to amend as to his claims, except as to Count 5, which may not be asserted as a
standalone claim.
Accordingly,
IT IS ORDERED that IES Communications’ Motion to Dismiss, (Doc. 18), is
granted as follows:
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 17 of 18

- 18 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
(1) Keith’s requests for injunctive or declaratory relief requiring IES
Communications to strengthen its data-security systems, submit to future audits, or
implement written cybersecurity policies are dismissed without leave to amend.
(2) Keith’s negligence claim (Count 1) is dismissed with leave to amend.
(3) Keith’s breach of implied contract claim (Count 2) is dismissed with leave
to amend.
(4) Keith’s invasion of privacy claim (Count 3) is dismissed with leave to amend.
(5) Keith’s unjust enrichment claim (Count 4) is dismissed with leave to amend.
(6) Keith’s standalone claim for declaratory and injunctive relief (Count 5) is
dismissed without leave to amend.
IT IS FURTHER ORDERED that any amended pleading shall be filed by no later
than October 21, 2026.
IT IS FINALLY ORDERED that if Plaintiff fails to file an amended complaint by
October 21, 2026 the Clerk of Court shall enter judgment accordingly and close this case
without further order from the Court.
Dated this 7th day of October, 2026.
Case 2:25-cv-02452-SHD Document 24 Filed 10/07/26 Page 18 of 18