Moser v. A&A Services, LLC

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF NEBRASKA
DAVID PRESTBY, individually and on
behalf of all others similarly situated;
DEREK SUMMERVILLE, individually and
on behalf of all others similarly situated;
CONNOR GEERHART, HEATHER
KRUEGER, SAMANTHA MOSER,
TIFFANY SUTHERLIN, and SEAN
SCHRIEO,
Plaintiffs,
v.
A&A SERVICES, LLC,
Defendant.
8:24CV204
MEMORANDUM
AND ORDER
This putative class-action lawsuit is before the Court on a motion to dismiss (Filing
No. 69) filed by defendant A&A Services, LLC, doing business as Sav-Rx (“Sav-Rx”).
Sav-Rx alleges a lack of standing under Federal Rule of Civil Procedure 12(b)(1) and a
failure to state a claim under Rule 12(b)(6). The motion will be granted in part and denied
in part for the reasons stated herein.
TABLE OF CONTENTS
I. 	PROCEDURAL BACKGROUND ............................................................................... 2
II. 	SUMMARY OF COMPLAINT .................................................................................... 3
III. DISCUSSION ............................................................................................................. 12
A. Standard of Review ............................................................................................... 12
B. Subject-Matter Jurisdiction: Article III Standing .................................................. 14
1. Actual Injury ......................................................................................................... 16
(a) Misuse of Stolen Information ......................................................................... 16
(b) Lost Benefit of Their Bargain ......................................................................... 18
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 1 of 66 - Page ID #
<pageID>

2
(c) Lost Value of Private Information ................................................................... 19
(d) Loss of Privacy ............................................................................................... 21
2. Future Injury ......................................................................................................... 26
3. State Statutory Claims .......................................................................................... 32
(a) Nebraska Consumer Protection Act Claim ..................................................... 35
(b) Washington, Pennsylvania, Missouri, and California Statutory Claims ......... 37
C. Failure to State a Claim ......................................................................................... 433
1. Breach of Implied Contract .................................................................................. 44
2. Breach of Third-Party Beneficiary Contract ........................................................ 48
3. Unjust Enrichment ................................................................................................ 49
4. Breach of Fiduciary Duty/Breach of Confidence ................................................. 51
5. Negligence ............................................................................................................ 55
6. Negligence Per Se ............................................................................................... 599
7. Invasion of Privacy/Intrusion upon Seclusion ...................................................... 59
8. Pennsylvania Unfair Trade Practices and Consumer Protection Law .................. 61
IV. CONCLUSION ............................................................................................................ 65
I. 	PROCEDURAL BACKGROUND
Between June 5, 2024, and July 1, 2024, several putative class-action cases were
filed in this forum against Sav-Rx.1 An additional case was filed on February 6, 2025.2
1Santizo v. A&A Services, LLC, 4:24-cv-03109-RFR-RCC; Foster v. A&A Services,
LLC, 7:24-cv-05005-RFR-RCC; Hill v. A&A Services, LLC, 8:24-cv-00205-RFR-RCC;
Krueger v. A&A Services, LLC, 8:24-cv-00206-RFR-RCC; Brown v. A&A Services, LLC,
8:24-cv-00214-RFR-RCC; 	Moser 	v. 	A&A 	Services, 	LLC, 	8:24-cv-00215-RFR-RCC;
Sutherlin v. A&A Services, LLC, 8:24-cv-00216-RFR-RCC; Sayers v. A&A Services, LLC,
8:24-cv-00228-RFR-RCC; Truseell v. A&A Services, LLC, 8:24-cv-00229-RFR-RCC;
Geerhart v. A&A Services, LLC, 8:24-cv-00261-RFR-RCC; T.D. v. A&A Services, LLC,
8:24-cv-00264-RFR-RCC; Pennell v. A&A Services, LLC, 8:24-cv-00210-RFR-RCC;
Prestby et al v. A&A Services, LLC, 8:24-cv-00204-RFR-RCC.
2Schrieo v. A&A Services, LLC et al, 8:25-cv-00051-RFR-RCC.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 2 of 66 - Page ID #
<pageID>

3
Each case alleged the plaintiff was injured by a data breach and/or use of Sav-Rx’s
computer network.
The cases were consolidated into the above-captioned lawsuit. Filing No. 62.
Plaintiffs 	David 	Prestby 	(“Prestby”), 	Derek 	Summerville 	(“Summerville”), 	Connor
Geerhart (“Geerhart”), Heather Krueger (“Krueger”), Samantha Moser (“Moser”), on
behalf of 	herself and 	her 	minor 	children, 	D.P., 	Z.M., C.M., 	W.M., 	Sean 	Schrieo
(“Schrieo”), and Tiffany Sutherlin (“Sutherlin”), on behalf of herself and her minor
children, K.S, K.S, and K.S. (collectively, the “plaintiffs”) filed a consolidated amended
complaint (“amended complaint”) on May 28, 2025. Filing No. 63. Sav-Rx moves to
dismiss under Rule 12(b)(1), arguing the Court lacks subject-matter jurisdiction because
the amended complaint fails to allege facts supporting standing, and even assuming
standing exists, it moves to dismiss under Rule 12(b)(6) for failure to state a claim upon
which relief may be granted. Filing No. 69.
For the reasons discussed below, the Court will grant the Rule 12(b)(1) motion to
dismiss the claims of Geerhart, Krueger, Prestby, Summerville, Schrieo, the minor children
of Moser, and Sutherlin, on behalf of herself and her minor children, for lack of standing.
As to Moser, the Court will dismiss any claims for injunctive and declaratory relief under
Rule 12(b)(1) for lack of standing. The Rule 12(b)(6) motion to dismiss Moser’s negligence
claim for damages will be denied, but all other claims by Moser will be dismissed for
failure to state a claim.
II. 	SUMMARY OF COMPLAINT3
The plaintiffs were members of health plans which contracted with Sav-Rx for
pharmacy-benefit-management services. To provide its services to health-plan customers,
3 While the amended complaint is 109 pages long, it is much shorter once the legal,
repetitive, 	conclusory, 	speculative, 	and 	argumentative 	statements 	are 	disregarded.
Plaintiffs’ 	counsel 	are 	advised 	that 	“to 	secure 	the 	just, 	speedy, 	and 	inexpensive
determination” of this federal case as required by Federal Rule of Civil Procedure 1, the
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 3 of 66 - Page ID #
<pageID>

4
Sav-Rx 	solicited, 	collected, 	and 	stored 	the 	plaintiffs’ 	highly-sensitive 	personally
identifiable information (“PII”) and protected health information (“PHI”) (together,
“Private Information”). Filing No. 63 at 2, 29-30, ¶¶ 2, 142-146.
On October 8, 2023, Sav-Rx discovered an unauthorized third party had accessed
its internal computer network on October 3, 2023. The third party may have gained access
to the plaintiffs’ full names, dates of birth, Social Security numbers, email addresses,
physical addresses, phone numbers, eligibility data, and insurance-identification numbers.
Filing No. 63 at 31, ¶¶ 156-157.
On May 10, 2024, Sav-Rx sent a Notice Letter to individuals affected by the data
breach. The notice stated:
WHAT HAPPENED?
On October 8, 2023, we identified an interruption to our computer network.
As a result, we immediately took steps to secure our systems and engaged
third-party cybersecurity experts. Our information technology systems (“IT
System”) were restored the next business day, and prescriptions were shipped
on time without delay. As part of the investigation, we learned that an
unauthorized third party was able to access certain non-clinical systems and
obtained files that contained health information. After an extensive review
with third-party experts, on April 30, 2024, we discovered that some of the
data accessed or acquired by the unauthorized third party may have contained
your protected health information. Based on the results of the forensic
investigation, we believe the unauthorized third party first accessed the IT
System on or around October 3, 2023.
WHAT INFORMATION WAS INVOLVED?
The information that may have been accessed or acquired included your
name, address, date of birth, and social security number.
Filing No. 63 at 32, ¶ 158. Sav-Rx notified the United States Department of Health and
Human Services (“HHS”) of the breach on May 24, 2024. Filing No. 63 at 4. ¶ 13.
Court expects counsel to invest editing time before filing documents. Failing to do so in
the future may carry consequences greater than this admonishment.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 4 of 66 - Page ID #
<pageID>

5
Sav-Rx told the plaintiffs that any data acquired from its computer network was
destroyed and was not further disseminated, and it promised it had taken steps to enhance
security protocols and controls, technology, policies, and training, and would continue to
assess further options to protect the Sav-Rx IT system. Filing No. 63 at 4, ¶¶ 10-11.
The plaintiffs allege, upon information and belief, that Sav-Rx promised to keep
Private Information private; comply with industry standards related to data security and
Private Information, including the Health Insurance Portability and Accountability Act
(“HIPAA”) and Federal Trade Commission (“FTC”) guidelines; inform consumers of its
legal duties; and comply with all federal and state laws by releasing Private Information
only for reasons related to the services it provides. Filing No. 63 at 30, ¶ 151. Sav-Rx’s
Notice of Privacy Practices (“Privacy Notice”) posted on its website acknowledges it is
“required by law to maintain the privacy and security of [individuals’] protected health
information[,]” and promises to “let [individuals] know promptly if a breach occurs that
may have compromised the privacy or security of [their] information.” Filing No. 63 at 31,
¶ 153. The plaintiffs relied on these promises, but despite published warnings of a spike in
cyberattacks to obtain healthcare information, Sav-Rx did not implement and maintain
adequate data security to protect its systems from unauthorized access, and then it
unreasonably waited more than seven months to publicly disclose the data breach to the
individuals affected. Filing No. 63 at 31, 33-37, ¶¶ 154; 161-162; 166-179.
The plaintiffs allege Sav-Rx failed to comply with HIPAA, and it should have
implemented techniques recommended by the FTC, the United States government, and
standards within the industry to prevent and detect cyber and ransomware attacks. The
plaintiffs’ amended complaint outlines, in detail, the measures they believe Sav-Rx should
have taken to protect their data. Filing No. 63 at 38-40, ¶¶ 181, 182, 185-206. They claim
that had Sav-Rx done so, the data breach could have been prevented; that the massive
cybersecurity breach occurred because Sav-Rx failed to implement and maintain adequate
safeguards. They claim that in Sav-Rx’s hands, the Private Information was accessible,
unencrypted, and vulnerable to acquisition. Filing No. 63 at 33. 40, ¶¶ 163, 183-184.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 5 of 66 - Page ID #
<pageID>

6
The plaintiffs allege their Private Information is now in the hands of cybercriminals.
The plaintiffs (and any minor children they represent in this litigation) allege:
• 	they are current or former participants in a health plan serviced by Sav-Rx;
• 	to obtain Sav-Rx’s medication benefit management services, they were required to
disclose their name, address, date of birth, Social Security number, phone number,
email address, and insurance-identification number;
• 	this information was saved in Sav-Rx’s computer network;
• 	Sav-Rx continues to maintain the Private Information and has a continuing legal
duty and obligation to protect it from unauthorized access and disclosure;
• 	they were very careful about sharing their sensitive Private Information, took
proactive steps to ensure their Private Information was kept safe and secure, and
would 	never 	knowingly 	transmit 	unencrypted 	sensitive 	information 	over 	the
internet;
• 	they would not have disclosed their Private Information to Sav-Rx had they known
of its lax data-security practices;
• 	after receiving the Notice Letter from Sav-Rx, they spent valuable time attempting
to mitigate the risks caused by the data breach, including researching and verifying
that the breach was legitimate, reviewing credit reports and statements, and
monitoring financial accounts for any indication of fraudulent activity;
• 	the Notice Letter was insufficient because it failed to identify the cybercriminals
who perpetrated the data breach and the vulnerabilities they exploited, or the details
about its root cause and mechanism, and without this information, they cannot fully
mitigate the threat;
• 	they have suffered and continue to suffer injuries including loss of time, mitigation
expenses, and anxiety;
• 	they seek damages and statutory damages, and they request an injunction which
orders improvements to Sav-Rx’s data-security systems, policies, and practices,
future annual audits, and adequate credit monitoring services funded by Sav-Rx.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 6 of 66 - Page ID #
<pageID>

7
Filing No. 63 at 7, 9-16, 18-24, 26-27, 30, 32, 34, ¶¶ 8, 33, 39-45, 53-59, 67-74, 85-91, 99-
105, 112-121, 128-135, 148-149, 159, 164.
In addition to the foregoing allegations applicable to all the plaintiffs, the amended
complaint alleges that after and because of the data breach:
• 	Geerhart, who resides in the State of Washington, received more phishing emails.
He also believes his medical and prescription information was included in the stolen
data because he received targeted advertising regarding the medical condition for
which he receives prescription medication through Sav-Rx. Filing No. 63 at 9, 11,
¶¶ 38, 47.
• 	Krueger, who resides in Wisconsin, received more spam emails and texts, and
targeted advertisements. Filing No. 63 at 12, 14, ¶¶ 52; 61.
• 	Moser, who resides in Pennsylvania with her children, (Filing No. 63 at 14, ¶ 66),
alleges that shortly after the data breach, someone fraudulently accessed her Venmo
account, which was associated with the email address provided to Sav-Rx. She
alleges “upon information and belief,” that her Private Information “was used to
impersonate Plaintiff Moser and gain access to her Venmo account. Alternatively,
threat actors used the data that was stolen to scam Plaintiff Moser into providing
access to her Venmo account, such as through a phishing email.” Filing No. 63 at
16, ¶ 76. In November 2023, she received a bank alert stating her PII, including her
name, address, date of birth, Social Security number, and email address, were
detected on the dark web, and she experienced a noticeable uptick in spam and
phishing texts, emails, and phone calls following the date breach. Filing No. 63 at
17, ¶¶ 77-78. She is particularly concerned with the exposure of her children’s
Private Information. Filing No. 63 at 17, ¶ 79.
• 	Prestby, from Minnesota, spent additional time changing all his passwords and
enrolling in the credit monitoring and identity-theft-protection services through
Equifax offered by Sav-Rx. Filing No. 63 at 19, ¶¶ 91, 93.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 7 of 66 - Page ID #
<pageID>

8
• 	Summerville, an Ohio resident, now receives so many spam calls that he no longer
answers the phone. Filing No. 63 at 22, ¶ 107.
• 	Sutherlin, who lives in Missouri, received notice from Credit Karma that her Private
Information was detected on the dark web. To mitigate her risks, she went to her
financial institutions to secure her accounts and resolve any fraudulent transactions,
spending over $50 for gasoline, and she spoke to credit card companies by phone to
verify and challenge any fraudulent credit-card transactions. She did not sign up for
the credit monitoring offered by Sav-Rx because she did not want to trust her
sensitive information to any Sav-Rx-affiliated entity, and she did not want to
jeopardize her ability to successfully sue Sav-Rx. Filing No. 63 at 24, ¶¶ 120, 121.
She claims she lost out on a contract accounting project worth over $1,000 in labor
due to the data breach. Filing No. 63 at 25, ¶ 122. Sutherlin receives more spam
calls, social media direct messages, emails, and text messages following the data
breach. She is also concerned that others will use her children’s exposed PII and
PHI. Filing No. 63 at 25, ¶ 123.
• 	Schrieo, from California, received more phishing emails and targeted advertising
regarding the medical condition for which he receives prescription medication
through Sav-Rx. He was also subject to tracking software while using Sav-Rx’s
websites.4 Filing No. 63 at 26, ¶ 130. Using JavaScript codes on its website pages,
Sav-Rx was able to capture IP addresses for user geolocation, obtain demographic
information, and monitor the user’s activity on the website and the dates and times
of access. The software collects browser information, clicks, ad clicks, scrolling
percentages, page views, user interactions with a form, search results from site
searches, and video engagement. Although the website contains a privacy policy, it
is tucked away at the bottom and may not be seen by the user, and it does not require
the user’s acknowledgement or consent to the tracking software. After the tracking
4https://auth.savrx.com/login, and https://savrx.com/.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 8 of 66 - Page ID #
<pageID>

9
software collects user information, Google shares it with Google Analytics, which
creates customizable reports. Contrary to the language of its privacy policy, Sav-Rx
has access to the Google Analytics reports for analysis and uses the information for
its marketing. Schrieo did not consent to or know that Sav-Rx was collecting his
user information while using the Sav-Rx website.5 Filing No. 63 at 26, 28, 54-56,
¶¶ 127, 137, 247-252.
When unencrypted Private Information is posted on the dark web, it can be sold for
targeted marketing efforts, or to commit identity theft and fraud. Social Security numbers
are highly marketable. When they are stolen, victims face an increased risk that others will
access 	their 	bank 	accounts, 	credit 	cards, 	driving 	records, 	tax 	records 	and 	returns,
employment histories, and other confidential information. The information stolen during
the Sav-Rx data breach contained several identifiers, including full names, dates of birth,
Social Security numbers, email addresses, physical addresses, phone numbers, eligibility
data, and insurance identification numbers. Such packages of per-person identifying
information are especially marketable because they are more easily used to commit
monetary crimes, including through social engineering. Filing No. 63 at 51-54, ¶¶ 232-246.
If a cyberthief collects Private Information and posts it for sale on the dark web, and
if the information is actually sold and used for identity theft, the victims may be required
to expend substantial time and money to repair the damage to their good name and credit
5 The amended complaint alleges all the plaintiffs’ rights under California privacy
laws were violated by the tracking software. Filing No. 63 at 8, ¶ 31. This allegation, and
all others like it within the amended complaint, assumes that those who are not California
citizens are bound by, or can assert a legally protected interest in, California’s privacy laws.
As will be discussed more thoroughly later in this opinion, there is a general presumption
against extraterritorial application of a state’s statutes because doing so may violate the
Due Process and Full Faith and Credit clauses of the constitution. See Johannessohn v.
Polaris Industries, Inc., 450 F. Supp. 3d 931, 962 (D. Minn. 2020) (citing Arnold v. Cargill,
Inc., No. CIV. 012086 (DWF/AJB), 2002 WL 1576141, at *2 (D. Minn. July 15, 2002)
(citing In re Pratt, 219 Minn. 414, 18 N.W.2d 147, 153 (Minn. 1945)).
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 9 of 66 - Page ID #
<pageID>

10
record. In the case of health-information theft, the victims may incur out-of-pocket costs
for healthcare. In addition, identity thieves may incur debt, apply for employment, file tax
documents, or request government benefits in the victims’ names. It can take months or
years to discover identity information was stolen. And correcting the damage thereafter
may include contacting credit bureaus to place fraud alerts on accounts, reviewing and
correcting credit reports, contacting companies to remove fraudulent charges, and placing
a credit freeze on credit—all of which is difficult, costly, and time-consuming. When
identity theft arises from a misappropriated Social Security number, changing that number
to eliminate further risks is far more difficult than cancelling and replacing a driver’s
license or credit card. Filing No. 63 at 44-51, 54 ¶¶ 207-231, 246.
The plaintiffs allege that due to the data breach, they suffered actual injuries,
including
a) 	invasion of privacy;
b) 	theft of PII and PHI;
c) 	lost or diminished value of their PII and PHI;
d) 	past and future lost time, money, and opportunity costs associated with
mitigation and protective measures to deal with the effects of the data breach,
including 	the 	money 	and 	time 	required 	to 	secure 	credit 	and 	account
monitoring, reports, and freezes; dispute unauthorized charges; and close or
modify accounts;
e) 	lost benefit of their bargain with Sav-Rx; specifically, Sav-Rx and/or its Sav-
Rx’s healthcare partners received money which was, in part, for the cost of
adequate computer security that Sav-Rx did not provide;
f) 	imminent injury arising from the substantially increased risk of additional
future fraud, identity theft, and misuse resulting from PII and PHI being
placed in the hands of criminals;
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 10 of 66 - Page ID #
<pageID>

11
g) 	ongoing future risk that PII and PHI will be used for identity theft, resulting
in potential tax return fraud, and out-of-pocket losses for fraudulent loans,
credit-card usage, medical and utility billings;
h) 	current, future, and ongoing risk of theft and misuse of their Private
Information which Sav-Rx still possesses in an unencrypted form and in an
insufficiently protected computer system;
i) 	increased exposure to future phishing, data intrusion, and other illegal
schemes; and
j) 	fear, anxiety, and emotional distress due to the harm caused by the data
breach and the increased risk of future harm.
Filing No. 63 at 11-14, 16-17, 19-22, 24-28, 56-58, ¶¶ 46-51, 60-65, 75-83. 92-97, 106-
111, 122-126, 136-141, 253-266.
The plaintiffs purport to represent themselves and a putative class of 2.8 million
others whose Private Information was unlawfully accessed due to the Sav-Rx data security
breach. The amended complaint contains the plaintiffs’ allegations of fact and law in
support of their request for class certification, (Filing No. 63 at 60-65, ¶¶ 268-282), and
defines the six putative classes the plaintiffs’ intend to represent; a Nationwide Class, and
Washington, Pennsylvania, Missouri, and California subclasses, each comprised of persons
“whose Private Information was accessed and/or acquired by an unauthorized party as a
result of the Data Breach reported by Defendant in May 2024, including all persons who
received notice of the Data Breach,” and a California Tracking Technology Subclass
comprised of “all individuals residing in California who visited the SavRX website in the
year preceding the filing of Plaintiff Schrieo’s original Complaint and whose information
was collected by SavRX without their express consent.” Filing No. 63 at 59-60, ¶ 267.
The amended complaint demands compensatory, consequential, punitive, statutory,
and nominal damages, equitable/injunctive relief, a declaratory judgment, and assessment
of attorney fees, costs, and litigation expenses.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 11 of 66 - Page ID #
<pageID>

12
III. 	DISCUSSION
A. 	Standard of Review
Sav-Rx argues the plaintiffs lack standing to pursue this action, and even if they
have standing, they have failed to state a claim. “To survive a motion to dismiss, a
complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief
that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl.
Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is facially plausible if supported by
sufficient factual allegations to reasonably infer that the defendant is liable for the
misconduct alleged. Id.
The plaintiff need not provide “detailed factual allegations” but must give “enough
to raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555. Neither
“naked assertions devoid of further factual enhancement” nor “[t]hreadbare recitals of the
elements of a cause of action, supported by mere conclusory statements” suffice. Roberson
v. Dakota Boys & Girls Ranch, 42 F.4th 924, 928 (8th Cir. 2022) (quoting Iqbal, 556 U.S.
at 678); accord Jones v. City of St. Louis, 104 F.4th 1043, 1046 (8th Cir. 2024). “Courts
must not presume the truth of legal conclusions couched as factual allegations.” Jones, 104
F.4th at 1046 (quoting Hager v. Ark. Dep’t of Health, 735 F.3d 1009, 1013 (8th Cir. 2013)).
Citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 563 (1992), the plaintiffs argue
that 	while 	the 	Twombly/Iqbal 	standard 	applies 	to 	Rule 	12(b)(6) 	motions, 	general
allegations are sufficient to allege standing. Filing No. 73 at 6. Lujan stated that at the
pleading stage, general factual allegations of injury resulting from the defendant’s conduct
may be sufficient because on a motion to dismiss, we “presum[e] that general allegations
embrace those specific facts that are necessary to support the claim.” Lujan, 504 U.S. at
561. Relying on Lujan, the Eighth Circuit has stated standing under Article III presents
only a threshold inquiry, and requires only general allegations of injury, causation, and
redressability.6 In re SuperValu, Inc., 870 F.3d 763, 773 (8th Cir. 2017).
6 The Lujan statement was dicta, and it predates the holdings in Twombly and Iqbal.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 12 of 66 - Page ID #
<pageID>

13
But SuperValu relied on statements of fact, not the general, conclusory, and
speculative allegations within the complaint before it, to decide whether the plaintiff had
adequately alleged standing. The analysis in SuperValu was consistent with the Eighth
Circuit’s prior ruling in Stalley v. Catholic Health Initiatives, 509 F.3d 517 (8th Cir. 2007).
Stalley held that when reviewing a complaint to determine whether the plaintiff has
sufficiently alleged standing, “our standard of review is the same standard we apply in
Rule 12(b)(6) cases.” Id. at 521 (citing Mattes v. ABC Plastics, Inc., 323 F.3d 695, 697-98
(8th Cir. 2003)). “We accept as true all factual allegations in the complaint, giving no effect
to conclusory allegations of law. . . . The plaintiff must assert facts that affirmatively and
plausibly suggest that the pleader has the right he claims (here, the right to jurisdiction),
rather than facts that are merely consistent with such a right.” Id. (citing Twombly, 550
U.S. 544). See also In re U.S. Office of Personnel Management Data Security, 928 F.3d
42, 54 (2019).
Consistent with Stalley, the Court rejects the plaintiffs’ argument that standing is
subject to a lesser pleading standard than stating a claim for relief. The Court applies the
Twombly/Iqbal standard to Sav-Rx’s motion to dismiss under both Rule 12(b)(1) and
12(b)(6). That said, when determining standing, it is “crucial . . . not to conflate Article III’s
requirement of injury in fact with a plaintiff’s potential causes of action, for the concepts
are not coextensive.” Turtle Island Foods, SPC v. Thompson, 992 F.3d 694, 699 (8th Cir.
2021) (quoting Braden v. Wal–Mart Stores, Inc., 588 F.3d 585, 591 (8th Cir. 2009)). In
assessing a plaintiff’s Article III standing, the Court assumes that on the merits, the
plaintiffs’ claims would be successful. Am. Farm Bureau Fed’n v. U.S. Env’t Prot. Agency,
836 F.3d 963, 968 (8th Cir. 2016) (citing Muir v. Navy Fed. Credit Union, 529 F.3d 1100,
1106 (D.C. Cir. 2008)). Where standing is called into question, the court must address that
jurisdictional issue before addressing the merits of a case. Turtle Island Foods, 992 F.3d at
699 (quoting Brown v. Medtronic, Inc., 628 F.3d 451, 455 (8th Cir. 2010)).
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 13 of 66 - Page ID #
<pageID>

14
B. 	Subject-Matter Jurisdiction: Article III Standing
Sav-Rx moves to dismiss, arguing the amended complaint does not allege that the
plaintiffs suffered an injury-in-fact traceable to the Sav-Rx data breach. Sav-Rx moves to
dismiss for lack of Article III standing to consider the plaintiffs’ claims.
Under Article III of the Constitution, the jurisdiction of the federal courts is limited
to resolving only cases or controversies. U.S. Const. art. III, § 2, cl. 1. To prove standing.
a plaintiff must show that he or she (i) suffered an injury-in-fact that is concrete,
particularized, and actual or imminent; (ii) the injury was likely caused by the defendant;
and (iii) the injury would likely be redressed by judicial relief. Lujan, 504 U.S. at 560–61.
“Where, as here, a case is at the pleading stage, the plaintiff must ‘clearly. . . allege facts
demonstrating’ each element” of the standing analysis. Spokeo, Inc. v. Robins, 578 U.S.
330, 338 (2016), as revised (May 24, 2016) (quoting Warth v. Seldin, 422 U.S. 490, 491)).
Even when the plaintiff has alleged injury sufficient to meet the case or controversy
requirement, the Court must also assure that the plaintiff has claim-specific standing; that
is, the plaintiff must assert his or her own legal rights and interests for each claim raised
and cannot rest a claim for relief on the legal rights or interests of third parties. See Warth,
422 U.S. at 499.
To establish an injury-in-fact, the plaintiffs must allege a concrete and particularized
injury that is actual or imminent. An injury is particularized if it affects the plaintiff in a
personal and individual way. See Spokeo, 578 U.S. at 339. An injury is concrete if it is real,
not conjectural or hypothetical. See id. at 340. Injuries can be tangible or intangible. See
id. Tangible injuries are relatively easy to recognize, but intangible harm requires a more
thorough analysis. Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917, 926 (11th Cir.
2020).
Even where a plaintiff alleges injury-in-fact, standing does not exist absent a
showing of traceability. “An injury is fairly traceable if the plaintiff shows ‘a causal
connection between the injury and the conduct complained of’ that is ‘not . . . th[e] result
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 14 of 66 - Page ID #
<pageID>

15
[of] the independent action of some third party not before the court.’” SuperValu, 870 F.3d
at 768 (quoting Lujan, 504 U.S. at 560). “[C]ausation to support standing is not
synonymous with causation sufficient to support a claim.” Parsons v. DOJ, 801 F.3d 701,
715 (6th Cir. 2015). The fact that a different data breach may have exposed the plaintiffs’
Private Information does not necessarily negate their standing to sue Sav-Rx for allowing
a theft to occur. See Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688, 696 (7th Cir.
2015).
Here, the plaintiffs seek to represent classes of allegedly injured persons, but class
representation does not alter the standing analysis. The plaintiffs must still
allege and show that they personally have been injured, not that injury has
been suffered by other, unidentified members of the class to which they
belong and which they purport to represent. Unless [they] demonstrate the
requisite case or controversy between themselves personally and [Sav-Rx],
none may seek relief on behalf of himself or any other member of the class.
Warth, 422 U.S. at 502) (internal quotation marks omitted). To proceed as a putative class
action, at least one named plaintiff for the defined class must have standing and “[e]ach
plaintiff's standing must be assessed individually.” SuperValu, 870 F.3d at 768, 773.
The amended complaint alleges the plaintiffs suffered actual harm and/or a certainly
impending or substantial risk of future harm recognized as cognizable by statute or
historical common law. The plaintiffs claim that due to Sav-Rx’s lack of sufficient data
security, their Private Information has been misused, and they were deprived of the benefit
of their bargain with Sav-Rx; lost the value of their Private Information; experienced a loss
of privacy; expended time and money on risk mitigation efforts, with associated lost
opportunities; and suffer anxiety and emotional distress.7 Each of these categories is an
alleged present or actual harm. The plaintiffs also seek to recover for the ongoing risk that
7 The plaintiffs claim Sav-Rx did not promptly inform them of the data breach, but
they “do not seek to rely on this delay as an independent basis for standing.” Filing No. 73
at 15, n. 5.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 15 of 66 - Page ID #
<pageID>

16
their Private Information will be used to commit fraud and identity theft, causing them
emotional distress and mitigation labor, expense, and lost opportunities. To allege injury-
in-fact for this intangible and anticipated harm, the plaintiffs must allege a certainly
impending or substantial risk. The plaintiffs allege that, considered in the totality, and even
individually, their actual and anticipated injuries satisfy the injury-in-fact requirement for
standing and based on the allegations in the amended complaint, those injuries are traceable
to the Sav-Rx data breach. Filing No. 73 at 5.
1. 	Actual Injury
(a) 	Misuse of Stolen Information
The plaintiffs allege their data, and the data of all putative class members, was stolen
in the Sav-Rx data breach and has been used and will continue to be used by criminals to
exploit them and profit from their misfortune. Filing No. 63 at 45 ¶ 211. This conclusory
statement will not be considered unless supported by allegations of fact.
The amended complaint states that after the data breach, all plaintiffs other than
Prestby received more spam, unwanted calls, texts, and/or e-mails; Prestby expended time
changing passwords and enrolling in the monitoring program offered by Sav-Rx; Geerhart
and Schrieo received phishing emails and advertising targeted at the medical conditions for
which 	they 	received 	medication 	through 	Sav-Rx’s 	pharmacy-management 	services;
Moser’s Venmo account was accessed; Moser’s and Sutherlin’s Private Information was
posted on the dark web; all the plaintiffs spent time and money attempting to mitigate the
risk of identity theft, and in Sutherlin’s case, to the exclusion of performing a accounting
job worth $1,000; and they all experienced emotional distress. Filing No. 73 at 6.
Setting aside their conclusory allegations, the only misuse alleged by Geerhart,
Krueger, and Summerville is receipt of unwanted spam calls, texts, and/or e-mails.
Receiving unsolicited spam emails, messages, and calls does not constitute a cognizable
injury, see Johnson v. Yuma Reg’l Med. Ctr., 769 F. Supp. 3d 936, 950 (D. Ariz. 2024),
and a spike in unsolicited marketing and cyber ploys received by phone, email, and
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 16 of 66 - Page ID #
<pageID>

17
messaging applications is not an actual harm sufficient to confer standing, see McCombs
v. Delta Grp. Elecs., Inc., 676 F. Supp. 3d 1064, 1074 (D.N.M. 2023) (collecting cases).
As to Moser’s Venmo account, she does not allege the account was used or altered
by a third party. Access to the Venmo account, without any financial loss or tampering, is
not an actual misuse. See SuperValu, 870 F.3d at 770 (holding theft of credit cards that
were not actually used without authorization is not an actual harm). And even assuming
the Venmo access is considered an actual harm, Moser has failed to allege traceability. She
does not allege that Sav-Rx had her Venmo password, as necessary to access the account,
in its computer system at the time of the data breach. See Holmes v. Elephant Ins. Co., 156
F.4th 413, 420 n. 3 (4th Cir. 2025) (noting an uptick in spam texts and calls to the plaintiff’s
cell phone cannot be attributable to a data breach where the stolen data did not include
phone numbers). Apparently recognizing this gap in the traceability chain, Moser alleges
“upon information and belief, [her PII] was used to impersonate Plaintiff Moser and gain
access to her Venmo account. Alternatively, threat actors used the data that was stolen to
scam Plaintiff Moser into providing access to her Venmo account, such as through a
phishing email.” Filing No. 63 at 16, ¶ 76. These allegations are wholly speculative and
must be disregarded. See SuperValu, 870 F.3d at 770. Moser has failed to allege an injury-
in-fact arising from actual access or misuse of her Venmo account traceable to the Sav-Rx
data breach.
Moser and Sutherlin claim they experienced actual misuse because their Private
Information is now posted on the dark web and has likely been sold or is available for sale
to a cybercriminal. However, in Supervalu, the plaintiffs alleged their credit card
information was harvested by cybertheft, the defendants’ lax security practices made that
theft possible, plaintiffs’ credit card information was stolen, and “on information and
belief,” illicit websites were selling their credit-card information to counterfeiters and
fraudsters. SuperValu disregarded the allegation made “on information and belief” as
speculative and held that the plaintiffs’ remaining allegations were sufficient to show
credit-card theft but not actual harm from misuse of the stolen information. See id.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 17 of 66 - Page ID #
<pageID>

18
Likewise, the allegation that the plaintiffs’ identifying information was posted on the dark
web supports a finding of theft, but absent some nonspeculative allegation that the
information has been used without authorization by a third party, Moser and Sutherlin have
failed to allege an actual misuse of their Private Information traceable to the Sav-Rx data
breach.
Having considered the allegations of fact in the amended complaint, the Court finds
the plaintiffs have failed to allege an injury-in-fact and traceability due to actual misuse of
their Private Information.
(b) 	Lost Benefit of Their Bargain
The plaintiffs allege they disclosed their Private Information to Sav-Rx and Sav-Rx
promised to protect it. They claim the parties therefore had an implied bargain for data
security 	which 	Sav-Rx 	breached 	by 	failing 	to 	adequately 	safeguard 	their 	Private
Information from cyberattack. Filing No. 73 at 12. Sav-Rx argues the plaintiffs’ benefit-of
-the-bargain claim fails because they did not allege they bargained for or paid Sav-Rx
specifically for data-security measures, and they do not allege if or how the value of Sav-
Rx’s pharmacy-benefit-management services was diminished because of the data breach.
Filing No. 70 at 17.
The plaintiffs have not alleged facts showing data security was a condition of any
bargain they made with Sav-Rx, that they directly paid anything to Sav-Rx, or that any
portion of the premium they paid to their health-insurance plan was designated for data
security and passed on to Sav-Rx for that purpose. The plaintiffs allege they would not
have used Sav-Rx’s services had they known of its inadequate security protocols. Setting
aside its speculative nature, that statement does not show Sav-Rx had reason to believe the
plaintiffs’ payments to their respective health plans were made, in part, for data security
provided by Sav-Rx. From the facts alleged, the plaintiffs had no contract with Sav-Rx,
and they sustained no injury-in-fact based of an alleged loss of the benefit of their bargain.
See Katz v. Pershing, LLC, 672 F.3d 64, 77 (1st 	Cir. 2012) (denying a benefit-of-the-
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 18 of 66 - Page ID #
<pageID>

19
bargain claim against insurer’s contractor because if plaintiff was overcharged for what he
received, it was by the insurer, not the defendant contractor, and an attempt to show
traceability 	by 	alleging 	the 	inflated 	fees 	were 	“passed 	on” 	to 	the 	contractor 	was
speculative); In re Sci. Applications Int'l Corp. Backup Tape Data Theft Litig. (SAIC), 45
F. Supp. 3d 14, 30 (D.D.C. 2014) (rejecting plaintiffs’ benefit of the bargain claim,
explaining that to the extent plaintiffs were asserting “some indeterminate part of their
[insurance] premiums went toward paying for security measures, such a claim is too flimsy
to support standing.”). See also Tate v. EyeMed Vision Care, LLC, No. 1:21-CV-36, 2023
WL 6383467, at *5 (S.D. Ohio Sept. 29, 2023); C.C. v. Med-Data Inc., No. 21-2301-DDC-
GEB, 2022 WL 970862, at *9 (D. Kan. Mar. 31, 2022).
(c) 	Lost Value of Private Information
The plaintiffs argue the monetary value of their Private Information was diminished
when it was disseminated to third parties during and because of the Sav-Rx data breach.
Filing No. 73 at 12. In support of this claim, they cite to allegations that a black market
exists for the sale and monetization of their PII and Social Security numbers, and now that
their information is no longer private, it is worth less; specifically noting the Private
Information of Moser and Sutherlin is now on the dark web. Filing No. 73 at 12. Sav-Rx
argues “plaintiffs plead no facts showing the existence of a market for a person’s
information, or how the value of such information decreased.” Filing No. 70 at 16.
The plaintiffs’ loss-of-value claim characterizes their Private Information as a
commodity which can be bought and sold, with its monetary value to the plaintiffs
diminished when third parties possess and are able to sell it. Filing No. 73 at 11. However,
“PII does not have an inherent monetary value.” Willingham v. Glob. Payments, Inc., 2013
WL 440702, at *7 (N.D. Ga. Feb. 5, 2013). The plaintiffs’ general allegations of purported
black-market value fail to show their information actually lost value, and such allegations
are speculative. See Johnson, 769 F. Supp. 3d at 947. In accordance with the reasoning and
holding of the majority of courts, this Court likewise rejects the plaintiffs’ claim for their
diminished loss of value of their PII. The plaintiffs did not allege that but for the data
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 19 of 66 - Page ID #
<pageID>

20
breach, they could have monetized their Private Information, or that it was actually
monetized on the black market. See In re Canon U.S.A. Data Breach Litig., No. 20-CV-
6239 (AMD) (SJB), 2022 WL 22248656, at *8 (E.D.N.Y. Mar. 15, 2022) (citing Svenson
v. Google Inc., No. 13-CV-4080, 2016 WL 8943301, at *9 (N.D. Cal. Dec. 21, 2016)).
“Even assuming that Plaintiffs’ data has value on the black market, Plaintiffs do not allege
any facts explaining how their personal information became less valuable as a result of the
breach or that they attempted to sell their information and were rebuffed because of a lower
price-point attributable to the security breach.” In re Zappos.com, Inc., 108 F. Supp. 3d
949, 954 (D. Nev. 2015). See also Remijas, 794 F.3d at 695 (rejecting the plaintiffs’
argument that private information is an intangible commodity, the loss of which confers
standing; refraining “from supporting standing on such an abstract injury, particularly since
the complaint does not suggest that the plaintiffs could sell their personal information for
value); Pulliam v. W. Tech. Grp., LLC, No. 8:23-CV-159, 2024 WL 356777, at *8 (D. Neb.
Jan. 19, 2024) (Buescher, J.), appeal dismissed, No. 24-1300, 2025 WL 511011 (8th Cir.
Feb. 4, 2025) (denying claim that loss of value of private information is a concrete injury
(collecting cases)); EyeMed, 2023 WL 6383467, at *5) (holding loss of value of private
information is not a concrete injury where the plaintiffs alleged that their “PII has intrinsic
economic value, as shown by the booming corporate and black market for PII”); Cooper v.
Bonobos, Inc., No. 21-CV-854 (JMF), 2022 WL 170622, at *5 (S.D.N.Y. Jan. 19, 2022);
Fero v. Excellus Health Plan, Inc., 304 F. Supp. 3d 333, 341, 755 (W.D.N.Y. 2018)
(collecting cases); Welborn v. Internal Revenue Serv., 218 F. Supp. 3d 64, 78 (D.D.C.
2016); Khan v. Children’s Nat’l Health Sys., 188 F. Supp. 3d 524, 533 (D. Md. 2016);
SAIC, 45 F. Supp. 3d at 30. But see Negron v. Ascension Health, No. 4:24-CV-00669-JAR,
2025 WL 2710014, at *7 (E.D. Mo. Sept. 23, 2025) (disagreeing with Pulliam and finding
that although there is no traditional analogue for the harm arising from loss of identifying
information, the inherent value of PII is significant and the loss of privacy is a concrete
injury) (relying on In re Marriott Int’l, Inc., Customer Data Sec. Breach Litig., 440 F.
Supp. 3d 447, 461 (D. Md. 2020) (acknowledging a loss of value of PII where plaintiff
suffered lower credit scores and fraudulent accounts and tax returns were filed due to the
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 20 of 66 - Page ID #
<pageID>

21
data breach; “the growing trend across courts that have considered this issue is to recognize
the lost property value of this information”) (collecting cases)).
This Court finds the plaintiffs’ alleged loss of value of Private Information due to
its diminished market value is not a concrete injury sufficient to support a finding of injury-
in-fact in these circumstances.
(d) 	Loss of Privacy
Although the terms are often used interchangeably, loss of value of private
information and loss of privacy from disclosure of private information are not the same. A
loss-of-privacy claim is not about the sale of PII as a commodity or its value in the
marketplace, but an intangible harm experienced by a person when his or her personal
information is disclosed. The plaintiffs argue data-breach victims suffer an immediate
privacy injury that is independently sufficient to confer standing. Filing No. 73 at 13.
Sav-Rx argues the plaintiffs’ vague allegations of lost privacy do not support a cognizable
injury. Filing No. 70 at 17.
An intangible harm can be concrete and support standing but not all intangible
harms do. See Muransky, 979 F.3d at 926. When considering alleged intangible harms for
standing purposes, the Court must consider “both history and the judgment of Congress”
to determine whether it constitutes an injury-in-fact. Spokeo, 578 U.S. at 340-341. An
intangible harm must either have “a close relationship to a harm that has traditionally been
regarded as providing a basis for a lawsuit in English or American courts,” or where no
traditional law analogue exists, a harm defined as a cognizable injury by congressional
legislation. See id. at 341. When based on a federal statute, “a bare procedural violation”
of a statute, “divorced from any concrete harm,” does not satisfy the injury-in-fact
requirement. Id.
When considering whether an alleged harm has a common-law analogue, the
inquiry focuses on types of harm protected at common law, not whether those harms are
actionable in the case now before the court. See Holmes, 156 F.4th at 421; accord Pileggi
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 21 of 66 - Page ID #
<pageID>

22
v. Wash. Newspaper Publ’g Co., LLC, 146 F.4th 1219, 1229 (D.C. Cir. 2025) (collecting
cases). Concrete injuries for standing purposes are those with “a close relationship to a
harm traditionally recognized as providing a basis for a lawsuit in American courts.”
TransUnion LLC v. Ramirez, 594 U.S. 413, 424 (2021) (emphasis added). “[A] plaintiff
doesn’t need to demonstrate that the level of harm he has suffered would be actionable
under a similar, common-law cause of action. But he does need to show that the type of
harm he’s suffered is similar in kind to a type of harm that the common law has recognized
as actionable.” Perez v. McCreary, Veselka, Bragg & Allen, P.C., 45 F.4th 816, 822 (5th
Cir. 2022); see also Drazen v. Pinto, 74 F.4th 1336, 1344 (11th Cir. 2023) (collecting
cases).
Under American common law, invasion of privacy—specifically, “Publicity Given
to Private Life,” Restatement (Second) of Torts § 652D—allows recovery for public
disclosure of true but private information, the release of which would be highly offensive
to a reasonable person. For this harm, the mere publication to a third party is insufficient;
publicity is required. The public-disclosure-of-private-information tort makes concrete the
intangible harm suffered when personal identifying information the plaintiff would
justifiably prefer to tightly control is released into a public forum. See Holmes, 156 F.4th
at 425; Barclift v. Keystone Credit Servs., LLC, 93 F.4th 136, 145 (3d Cir.), cert. denied,
145 S. Ct. 169 (2024) (holding disclosure of identifying information is closely related to
the tort of public disclosure of private information; without the publicity component,
plaintiff’s alleged harm is not analogous to the tort); Bohnak v. Marsh & McLennan Cos.,
Inc., 79 F.4th 276, 285 (2d Cir. 2023) (exposure of private PII to unauthorized third parties
bears some relationship to a well-established common-law analogue: public disclosure of
private facts); Clemens v. ExecuPharm Inc., 48 F.4th 146, 159 (3d Cir. 2022) (intangible
harms like the publication of personal information can qualify as concrete injuries).
Applying Spokeo, loss of privacy due to the public disclosure of private information
can cause a concrete harm. Here, Moser and Sutherlin claim their social security numbers
along with other identifying information such as name, address, and date of birth, were
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 22 of 66 - Page ID #
<pageID>

23
posted on the dark web—a public forum. The Court finds this publication would plausibly
be highly offensive to a reasonable person. Moser and Sutherlin have therefore alleged loss
of privacy as a concrete injury. However, as to all other plaintiffs, there is no factual
allegation of a public posting on the dark web or otherwise.8 Geerhart, Krueger, Prestby,
Summerville, and Schrieo have failed to allege a concrete harm arising from loss of
privacy. See Holmes, 156 F.4th at 425.
While Moser and Sutherlin have alleged injury-in-fact, to sufficiently allege
standing, they must also allege facts to support traceability. Traceability requires a
connection between a plaintiff’s injury and the defendant’s conduct, which logically
requires a temporal element. See Hulse v. Acadian Ambulance Serv. Inc., No. 6:24-CV-
01011, 2025 WL 1453847, at *10 (W.D. La. May 19, 2025). Here, the amended complaint,
and Sutherlin’s initial complaint filed in this forum on June 5, 2024, (Prestby et al v. A&A
Services, LLC, 8:24-cv-00204-RFR-RCC, Filing No. 1 (June 5, 2024)), allege general
statements of a connection between the Sav-Rx data breach and the dark-web postings, but
Sutherlin merely alleges that “as a result of” the data breach, her Private Information was
posted on the dark web. Without supporting facts, the clause “as a result” is conclusory.
Here, Sutherlin provides no specificity showing how her PII was posted on the dark web,
and alleges no facts indicating a connection, temporal or otherwise, between the breach
and the posting. While Sutherlin alleges she is very careful about exposing her Private
Information to others—and therefore the information posted on the dark web is presumably
from the Sav-Rx data breach—this statement, standing alone, is insufficient to show a
8 The plaintiffs allege that “on information and belief,” all plaintiffs’ PII was
published on the dark web, “as evidenced by the alerts received by Plaintiffs Moser and
Sutherlin.” Filing No. 63 at 6, ¶ 23. The assertion made “on information and belief” is
speculative, not factual, and it does not support a claim that the PII of all plaintiffs was
posted on the dark web. See SuperValu, 870 F.3d at 770. Likewise, the plaintiffs’ claim
that their unencrypted Private Information will end up for sale on the dark web because
that is the modus operandi of hackers and cybercriminals is speculative. Filing No. 63 at
45, ¶ 208, 211.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 23 of 66 - Page ID #
<pageID>

24
connection between the Sav-Rx data breach and her leaked information.9 Sutherlin has
therefore failed to sufficiently allege facts showing the public disclosure of her Private
Information is traceable to the Sav-Rx data breach. See Harvey v. Nat'l Amusements, Inc.,
No. CV 24-10027-GAO, 2025 WL 928776, at *3 (D. Mass. Mar. 27, 2025) (concluding
the receipt of notice of fraud two years after a data breach failed to adequately allege
specific facts to support a plausible conclusion of traceability to the data breach); Santos-
Pagan v. Bayamon Med. Ctr., No. CV 20-1237 (BJM), 2024 WL 4350990, at *7 (D.P.R.
Sept. 30, 2024) (finding no traceability where plaintiff alleged an account was set up after
a cyberattack, but did not allege facts suggesting a link between the two events, including
any specific timeframe between the cyberattack and opening the fraudulent account).
In contrast, Moser alleges her information was found on the dark web in November
of 2023, only one month after the Sav-Rx data breach.10 This temporal proximity between
the dark web posting and the Sav-Rx data breach is sufficient to “nudge” the traceability
issue “across the line from conceivable to plausible.” Twombly, 550 U.S. at 569-70; Webb
v. Injured Workers Pharmacy, LLC, 72 F.4th 365, 374 (1st Cir. 2023) (holding the temporal
connection between the filing of the false tax return and the timing of the data breach, along
with plaintiff’s allegation that she was “very careful about sharing her PII,” was enough to
allege traceability). Moser has sufficiently alleged both injury-in-fact and traceability
sufficient to support a finding of standing. See Roma v. Prospect Med. Holdings, Inc., No.
CV 23-3216, 2024 WL 3678984, at *7 (E.D. Pa. Aug. 6, 2024) (finding traceability
9 Sutherlin is also the named plaintiff in Sutherlin v. AT&T Inc., 4:24-cv-00740-SRC,
(E.D. Mo. May 27, 2024), filed one week before her lawsuit in this forum, wherein she
alleges the same identifying information was exfiltrated from the AT&T network during
the same time frame as the Sav-Rx data breach.
10 Moser is also a named plaintiff in the class-action litigation against Google, see
Chaz Williams-Oswill, et al., v. Google LLC, Case No. 24-cv-435800 (Super. Ct. of Cal.
Cnty. of Santa Clara filed April 9, 2024), but it does not appear Social Security numbers
were allegedly disclosed in that data breach.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 24 of 66 - Page ID #
<pageID>

25
between defendant’s conduct and plaintiffs’ injuries when stolen data appeared on the dark
web one month after the data breach).
In summary, only Moser has alleged an actual injury traceable to the Sav-Rx data
breach. The remaining question is redressability. Article III standing requires identifying a
remedy that will redress the individual plaintiff’s injuries. See California v. Texas, 593
U.S. 659, 660 (2021). The plaintiffs “must demonstrate standing separately for each form
of relief sought.” Friends of the Earth, Inc. v. Laidlaw Env’t Servs., Inc., 528 U.S. 167, 185
(2000). Damages are an available remedy for loss of privacy, see Restatement (Second) of
Torts § 652H (1977), so as to that requested relief, Moser has shown redressability.
But Moser also seeks declaratory and injunctive relief to prevent future loss of
privacy. She requests a court order stating Sav-Rx’s “existing data security and vendor
management measures do not comply with its contractual obligations and duties of care to
adequately secure” her Private Information, and an order requiring Sav-Rx to “comply with
its contractual obligations and duties of care, and “implement and maintain reasonable data
security measures” as outlined in the amended complaint. Filing No. 63 at 106, ¶ 523.
“Past exposure to illegal conduct does not in itself show a present case or
controversy regarding injunctive relief . . . if unaccompanied by any continuing, present
adverse effects.” O’Shea v. Littleton, 414 U.S. 488, 495-96 (1974). “For injunctive relief,
which is a prospective remedy, the threat of injury must be ‘actual and imminent, not
conjectural or hypothetical.’” Summers v. Earth Island Inst., 555 U.S. 488, 493 (2009)). If
a plaintiff’s right to damages will remedy the harm caused and an ordinary action at law is
readily available, a declaratory judgment and injunction serve no purpose. See City of Los
Angeles v. Lyons, 461 U.S. 95, 105 (1983). Equitable remedies are unavailable “absent a
showing of irreparable injury, a requirement that cannot be met where there is no showing
of any real or immediate threat that the plaintiff will be wronged again—a “likelihood of
substantial and immediate irreparable injury.” Id. at 111.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 25 of 66 - Page ID #
<pageID>

26
Here, Moser alleges Sav-Rx has retained her Private Information, it has not
implemented adequate data security, and the exposure of her information is an ongoing
risk. She is alleging a right to prospective relief to avoid or limit the risk of a future breach
of Sav-Rx’s computer system. But Moser has not alleged any facts indicating an imminent
risk of a future breach of Sav-Rx’s computer system. She has therefore failed to allege
standing to obtain the requested injunctive and declaratory relief as redress for the loss of
privacy caused by Sav-Rx’s alleged lack of data security.
2. 	Future Injury
For this stage of the case, Moser has alleged loss of privacy as an injury-in-fact,
traceable to the Sav-Rx data breach, that can be redressed by an award of damages.
Geerhart, Krueger, Prestby, Summerville, Schrieo, and Sutherlin have not sufficiently
alleged an injury-in-fact based an actual injury arising from the data breach. However, the
plaintiffs all claim they are currently facing a future risk of identity theft and fraud due to
the disclosure of their PII, and they seek recovery for future mitigation efforts, lost time
and opportunities, and ongoing emotional distress arising from that future risk.11 The risk
of “future injury can be sufficient to establish Article III standing.” SuperValu, 870 F.3d at
769 (citing Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013)).
Sav-Rx argues the plaintiffs have pleaded no facts to show misuse of information
obtained in the data breach, and even if the Court accepts conclusory allegations of an
increased risk of future harm, the plaintiffs have failed to allege facts showing a “certainly
impending” or “substantial” risk of future harm. Filing No. 76 at 5. The plaintiffs argue
they have pleaded a sufficiently imminent substantial risk of future identity theft by
alleging that cybercriminals successfully targeted, accessed, and exfiltrated their Private
11 To be clear, Moser’s right to injunctive and declaratory relief as redress for loss
of privacy is substantively different than her claim of injury-in-fact due to the risk of future
misuse of her Private Information. As to the former, Moser is requesting relief to limit
future data breaches of the Sav-Rx system. In contrast, by claiming the risk of future injury
as an injury-in-fact, Moser is arguing she faces an imminent risk of future misuse of Private
Information obtained in the Sav-Rx data breach that occurred in October of 2023.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 26 of 66 - Page ID #
<pageID>

27
Information from Sav-Rx’s computer systems, Sav-Rx’s Notice Letter stated plaintiffs’
Social Security numbers, names, dates of birth, and addresses were in the accessed files,
and Sav-Rx admitted that highly sensitive data was exfiltrated.12 Filing No. 73 at 8.
“The question here is whether the complaint adequately alleges that plaintiffs face
a ‘certainly impending’ or ‘substantial risk’ of identity theft as a result of the data breaches
purportedly caused by [Save Rx’s] deficient security practices.” SuperValu, 870 F.3d at
769 (citing Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158 (2014) (quoting Clapper,
568 U.S. at 414 n. 5)). Allegations forecasting an “attenuated chain of possibilities” cannot
support standing. Clapper, 568 U.S. at 410-11. The mere risk of future misuse by
unauthorized third parties is too speculative. See TransUnion, 594 U.S. at 438.
The facts of each case must be considered when deciding whether a risk of future
harm is certainly impending or substantial. In this case, Sav-Rx notified the plaintiffs that
their name, address, date of birth, and Social Security number “may” have been accessed
or acquired by a third party during the data breach. Courts have held that the risk of future
harm posed by a data-security breach is speculative when cybercriminals “may” have
accessed PII. Reilly v. Ceridian Corp., 664 F.3d 38, 43 (3d Cir. 2011). “For a person's
privacy to be invaded, their personal information must, at a minimum, be disclosed to a
third party. Existing case law and legislation support that common-sense intuition: If no
12 The plaintiffs allege that according to the Notice Letter, their “Private Information
was accessed and stolen in the Data Breach.” Filing No. 63 at 33, ¶ 160. The Notice Letter
actually says, “your name, address, date of birth, and social security number” “may have
been accessed or acquired.” Filing No. 63 at 32, ¶ 158 (emphasis added). Likewise, the
plaintiffs allege Sav-Rx admitted the plaintiffs’ Private Information “was accessed and
exfiltrated by unauthorized third parties in the Data Breach.” Filing No. 63 at 68, ¶ 307.
The Notice Letter does not state the data “was” accessed and exfiltrated. The distinction
makes a difference. A chain of possibilities does not support a certainly impending or
substantial future risk, particularly where the first link is data access that may not have
occurred.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 27 of 66 - Page ID #
<pageID>

28
one has viewed your private information (or is about to view it imminently), then your
privacy has not been violated.” SAIC, 45 F. Supp. 3d at 28.
Assessing the risk of future harm for standing is a fact-intensive endeavor. The
Court must carefully consider a multitude of factors, none of which is conclusive to the
ultimate finding, beginning with the type of information stolen and to what extent it can be
used to cause harm. Compared to Social Security numbers and dates of birth, drivers’-
license numbers and credit cards do not pose the same risk of future identity theft or fraud
because a driver’s license can be changed, and a credit card cancelled. See Baysal v.
Midvale Indem. Co., 78 F.4th 976, 979 (7th Cir. 2023), reh’g denied, No. 22-1892, 2023
WL 6144390 (7th Cir. Sept. 20, 2023) (observing drivers’ licenses are neutral—neither
embarrassing nor private; “Social Security numbers are unique personal identifiers that can
be used for identity theft, but license numbers change over time. . .”); SuperValu, 870 F.3d
at 770 (noting the “stolen Card Information does not include any personally identifying
information, such as social security numbers, birth dates, or driver's license numbers,” and
a stolen credit card “generally cannot be used alone to open unauthorized new accounts”).
When a plaintiff can and does promptly mitigate the risk by rendering the stolen
information obsolete, the risk of future harm is eliminated. See Tsao v. Captiva MVP Rest.
Partners, LLC, 986 F.3d 1332, 1344 (11th Cir. 2021) (deciding that since the plaintiff
“immediately cancelled his credit cards following disclosure of the [data] breach,” the
future risk of credit-card fraud was eliminated); Whalen v. Michaels Stores, Inc., 689 F.
App’x 89, 90 (2d Cir. 2017) (unpublished summary order) (concluding that where the
plaintiff promptly cancelled her credit card “and no other [PII] – such as her birth date or
Social Security number” was stolen, she failed to allege a plausible threat of future fraud).
In contrast, dates of birth cannot be changed, and changing a Social Security number
or name is an onerous, long process. When this type of data is stolen, the risk of future
identity theft is greater. See In re Equifax Inc. Customer Data Security Breach Litigation,
999 F.3d 1247 (2021) (finding no hesitation in holding that the plaintiffs adequately alleged
a “material” and “substantial” risk of identity theft because unequivocal damage can be
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 28 of 66 - Page ID #
<pageID>

29
done with Social Security numbers, names, and dates of birth); McMorris v. Carlos Lopez
& Assocs., LLC, 995 F.3d 295, 302 (2d Cir. 2021) (“[D]issemination of high-risk
information 	such 	as 	Social 	Security 	numbers 	and 	dates 	of 	birth–especially 	when
accompanied by victims’ names–makes it more likely that those victims will be subject to
future identity theft or fraud.”); Attias v. CareFirst, Inc., 865 F.3d 620, 628 (D.C. Cir.
2017) (same).
“Where 	plaintiffs 	fail 	to 	present 	evidence 	or 	make 	any 	allegations 	that 	an
unauthorized third party purposefully obtained the plaintiffs’ data, courts have regularly
held that the risk of future identity theft is too speculative to support Article III standing.”
McMorris, 995 F.3d at 301. However, the plaintiffs face a real risk of misuse of their
information following a data breach when their information is deliberately taken in a
targeted attack by cyberthieves intent on using the information to their financial advantage.
See Webb, 72 F.4th at 375. While at this stage of the litigation, the Court must consider
only the allegations in the amended complaint, when cybercriminals allegedly hack a
computer system and extract private identifying information, the Court can reasonably
infer they intend to use it for fraud or identity theft. See Galaria v. Nationwide Mut. Ins.
Co., 663 F. App’x 384, 388-90 (6th Cir. 2016); Remijas, 794 F.3d at 693.
The targeted nature of a data breach and the subsequent listing of the information
on the dark web weigh in favor of standing. See Clemens, 48 F.4th at 146 (finding an
employee faced substantial risk of identity theft or fraud by virtue of her personal
information being made available on the dark web). Alleging the plaintiffs’ PII was
available for sale on the dark web following a data breach, and that it could be promptly
used to commit identity theft or fraud, provides strong support for concluding those
plaintiffs established an Article III injury in fact. See McMorris, 995 F.3d at 302 (citing
Fero, 304 F. Supp. 3d at 341, 344-45); Green-Cooper v. Brinker Int’l, Inc., 73 F.4th 883,
890 (11th Cir. 2023) (concluding posting on the dark web presents a substantial risk of
future injury—future misuse of personal information associated with the hacked credit
card). But see Holmes, 156 F.4th at 431 (finding dark-web posting did not support
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 29 of 66 - Page ID #
<pageID>

30
impending risk of identity theft where no threat existed if no one chose to buy and then use
the posted information; a “speculative chain of possibilities” cannot support a finding of
substantial risk of harm).
Without allegations of some actual misuse of the data, a plaintiff will have difficulty
meeting the burden of alleging that the threatened harm of future identity theft is “certainly
impending” or presents a “substantial risk” of harm. Tsao, 986 F.3d at 1344; see also
Tignor v. Dollar Energy Fund, Inc., 745 F. Supp. 3d 189, 201 (W.D. Pa. 2024) (deciding
a plaintiff who alleged her PII may have been accessed, but did not allege it was used for
fraudulent activity, identity theft, or published on the dark web did not allege imminent
future risk sufficient to support standing). Courts are more likely to conclude that plaintiffs
have established a substantial risk of future injury where they can show that at least some
part of the compromised dataset was misused, even if their own data has not yet been
affected. See McMorris, 995 F.3d at 302; Webb, 72 F.4th at 375 (“[T]he actual misuse of a
portion of the stolen information increases the risk that other information will be misused
in the future.”); Equifax, 999 F.3d at 1262 (“The actual identity theft already suffered by
some Plaintiffs further demonstrates the risk of identity theft all Plaintiffs face—though
actual identity theft is by no means required when there is a sufficient risk of identity
theft.”). But see Holmes, 156 F.4th at 429 (relying on TransUnion, 594 U.S. at 438, and
holding the fact that other members of the class already had their information disseminated
was not enough to establish imminence); Supervalu, 870 F.3d at 769-70 (finding named
plaintiffs whose credit cards were not used for fraudulent purposes failed to allege a future
risk of harm even though other named plaintiffs incurred fraudulent charges).
And typically, any allegations of misuse must have a temporal connection with the
data breach. As breaches fade further into the past, the plaintiffs’ threatened injuries
become more speculative. See Beck v. McDonald, 848 F.3d 262, 275 (4th Cir. 2017); In re
Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 641 (3d Cir. 2017) (The
“more time that passes between a data breach and an instance of identity theft, the more
latitude a defendant has to argue that the identity theft is not ‘fairly traceable’ to the
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 30 of 66 - Page ID #
<pageID>

31
defendant’s data breach.” (quoting In re Adobe Sys., Inc. Privacy Litig., 66 F.Supp.3d 1197,
1215 n.5 (N.D. Cal. 2014))).
Here, the plaintiffs’ names, addresses, dates of birth, and Social Security numbers
“may” have been accessed or acquired by a third party through the Sav-Rx data breach. It
was allegedly a targeted attack, and Moser and Sutherlin were notified that their Private
Information is now posted on the dark web. Moser alleges she received the notice one
month after the data breach; Sutherlin does not allege when her notice was received. But
at the time the amended complaint was filed, nearly 20 months had passed since the Sav-Rx
data breach, and the plaintiffs do not allege that their Private Information, or the Private
Information of any of the 2.8 million putative class members they seek to represent, was
actually used to commit fraud or identity theft. While all but Prestby allege receiving
increased spam calls or texts, targeted advertising, and phishing emails following the
breach, such messaging is pervasive, and an uptick is not particularly persuasive to show a
certainly impending or substantial risk of identity theft. Having considered the plaintiffs’
factual allegations in the totality, the Court finds they have failed to allege a certainly
impending or substantial risk of future harm arising from the Sav-Rx data breach. The
alleged future risk of harm is not an injury-in-fact and cannot support a finding of standing.
The plaintiffs argue that the costs and time expended to mitigate their future risk of
identity theft and fraud, and the opportunities they lost while doing so, are injuries-in-fact
for the purposes of standing. Lost time and opportunities are not cognizable injuries. See
Johnson, 769 F. Supp. 3d at 949. “[G]eneral allegations of time spent dealing with
verifying the legitimacy of the breach, exploring creditor monitoring and identity theft
protections, and self-monitoring accounts without alleging any out-of-pocket expenses or
means to measure any damages based on specific amounts of time spent . . . are
speculative” and cannot support a finding of standing. Id.
Moreover, the plaintiffs “cannot manufacture standing merely by inflicting harm on
themselves 	based 	on 	their 	fears 	of 	hypothetical 	future 	harm 	that 	is 	not 	certainly
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 31 of 66 - Page ID #
<pageID>

32
impending.” Clapper, 568 U.S. at 416. Having failed to allege a substantial or certainly
impending risk of future harm, the plaintiffs cannot allege an injury-in-fact based on their
expenditure of time, effort, and money to protect themselves against the speculative threat
of future fraud and identity theft. See SuperValu, 870 F.3d at 771.
The same analysis applies to the plaintiffs’ claim for emotional distress arising from
the risk of future identity theft. Emotional distress may serve as a basis for standing only
when experienced in response to a separate risk of harm that is certainly impending or
substantial. Since the plaintiffs have failed to allege a future risk of harm as an injury-in-
fact, their emotional distress arising from their perceived risk of harm is not a concrete
injury.
3. 	State Statutory Claims
Legally protected interests may arise from the Constitution, common law, or statutes
creating legal rights, the violation of which supports standing. See Lujan, 504 U.S. at 578.
Interests protected under the Constitution or federal statute, and harms recognized as
injuries under the common law have nationwide application when assessing standing. But
extraterritorial application of state statutes may violate rights secured under the Due
Process and Full Faith and Credit Clauses. The Due Process Clause prohibits the
application of state law which is only casually or slightly related to the litigation, while the
Full Faith and Credit Clause requires the forum to respect the laws and judgments of other
states, subject to the forum’s own interests in furthering its public policy. See Phillips
Petroleum Co. v. Shutts, 472 U.S. 797, 819 (1985).
To apply a state’s consumer-protection statutes in a constitutionally permissible
manner, that state must have a significant contact or significant aggregation of contacts,
creating state interests, such that choosing to apply its law is neither arbitrary nor
fundamentally unfair. See In Re St. Jude Med., 425 F.3d 1116, 1120 (8th Cir. 2005). Even
if the language of a state statute purports to afford protection to both in-state and out-of-
state persons, the Court cannot rely on the statutory language and forego a choice-of-law
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 32 of 66 - Page ID #
<pageID>

33
analysis. See id. The Court initially evaluates whether there is an actual conflict between
the laws of the forum state and other relevant states. If the laws are not in conflict, no
further analysis is necessary because out-of-state plaintiffs will not incur a constitutional
injury if the outcome is the same irrespective of which state’s law is applied. See id.
Here, the plaintiffs are from the states of Washington, Wisconsin, Pennsylvania,
Minnesota, Ohio, Missouri, and California. Their amended complaint purports to assert
claims under the Nebraska Consumer Protection Act (“NCPA”), Neb. Rev. Stat. § 59-1609,
on behalf of themselves and a putative nationwide class. And each named plaintiff alleges
the right to represent a plaintiff-specific putative class claim based on the consumer-
protection statutes of his or her home state. When considering choice-of-law, this Court
need not review and compare the NCPA with each state’s consumer-protection laws and
assumes differing state statutory protection. Consumer-protection statutes are not a
uniformly adopted body of law like the Uniform Commercial Code. Instead, ‘“[s]tate
consumer-protection laws vary considerably, and courts must respect these differences
rather than apply one state’s law” to [consumer transactions] in other states with different
rules.’” Id. (quoting In re Bridgestone/Firestone, Inc., 288 F.3d 1012, 1018 (7th Cir.
2002)).
When application of differing states’ laws may result in different outcomes, the
Court must perform a choice-of-law analysis. In this case, the plaintiffs have invoked the
Court’s diversity jurisdiction under the Class Action Fairness Act, 28 U.S.C. § 1332(d)(2)),
(Filing No. 63 at 9, ¶ 34), and therefore the forum state’s choice-of-law rules govern which
state’s law applies to the merits of the case. See Davis v. BMW of N. Am., LLC, No. 2:19-
CV-19650 (MEF)(AME), 2025 WL 3268653, at *5 (D.N.J. Nov. 24, 2025) (collecting
cases); Waithaka v. Amazon.com, Inc., 404 F. Supp. 3d 335, 345 (D. Mass. 2019), aff’d,
966 F.3d 10 (1st Cir. 2020); In re Facebook Biometric Info. Privacy Litig., 185 F. Supp.
3d 1155, 1167-68 (N.D. Cal. 2016) (quoting NVIDIA GPU Litig., 2009 WL 4020104, at
*5 (N.D. Cal. Nov. 19, 2009)). In deciding choice-of-law questions, Nebraska follows the
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 33 of 66 - Page ID #
<pageID>

34
Restatement (Second) of Conflict of Laws. See Inacom Corp. v. Sears, Roebuck and Co.,
254 (1987)).
“Courts consistently examine the specific claims made in a particular case to
determine whether a claim under a consumer protection statute should be treated as a tort
or a contract action for choice of law purposes.” Stevens v. Nelnet Servicing, LLC, No. CV
3:24-0280, 2025 WL 1334071, at *5 (S.D.W. Va. May 7, 2025); In re Arizona Theranos,
Inc. Litigation, 256 F.Supp.3d 1009, 1040-41 (D. Ariz. 2017); Bridgestone/Firestone, 155
F. Supp. 2d at 1079 n. 6). If contract law is the focus of the plaintiff’s claim, Nebraska’s
choice-of-law analysis rests on the factors in Restatement (Second) of Conflict of Laws
§ 188. Specifically, the Court considers the place of contracting, the place of negotiation
of the contract, the place of performance, the location of the subject matter of the contract,
and the residence or place of business of the parties. These contacts are to be evaluated
according to their relative importance with respect to the particular issue. See, e.g., Wise v.
Zwicker & Associates, P.C., 780 F.3d 710, 715, 717, 718 (6th Cir. 2015). Where tort law
is the focus of a plaintiff’s claim, Nebraska applies “the most significant relationship”
factors enunciated in Restatement (Second) of Conflict of Laws §§ 145-148; specifically,
where the injury occurred, where the conduct causing the injury occurred, the residence
and place of business of the parties, and where any relationship between the parties is
centered. If the defendant allegedly misinformed the plaintiff about its product or service,
courts 	also 	consider 	where 	the 	plaintiff 	acted 	in 	reliance 	upon 	the 	defendant’s
representations, where the plaintiff received the representations, and the state where the
representations were made. See, e.g., Inacom, 254 F.3d at 688 (applying Nebraska’s
choice-of-law rules and holding Nebraska law governed a fraudulent-concealment claim
against an Illinois company where the plaintiff received and relied on the defendant’s
representations at the plaintiff’s Nebraska headquarters, attempted to comply in Nebraska,
and suffered injuries in Nebraska); Shaw v. Marriott Intern., Inc., 605 F.3d 1039, 1045,
1046 (D.C. Cir. 2010).
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 34 of 66 - Page ID #
<pageID>

35
Against this backdrop, the Court evaluates whether standing exists for the plaintiffs’
consumer-protection claims based on state-specific statutes.13
(a) 	Nebraska Consumer Protection Act Claim
The plaintiffs allege Sav-Rx was required to implement and maintain data-security
procedures and practices as reasonable under the circumstances, including safeguards that
protect the personal information when the individual or commercial entity disposes of the
personal information, see Neb. Rev. Stat. §§ 87-806(2), 87-808.426, and its failure to do
so injured the public interest. Filing No. 63 at 87-88, ¶¶ 420-427. They argue they have
standing to assert claims under the NCPA because they are persons injured by “a violation
of §§ 59-1602 to 59-1606 which directly or indirectly affects the people of Nebraska,”
(Filing No. 73 at 31) (quoting Arthur v. Microsoft Corp., 676 N.W.2d 29, 38 (Neb. 2004)),
their data was breached and exposed in Nebraska, their injury was suffered in Nebraska;
and Sav-Rx “owns, licenses, or maintains computerized data that includes personal
information about a resident of Nebraska.” Filing No. 73 at 31 (quoting Filing No. 63 at
87, ¶ 422).
Sav-Rx counters that the plaintiffs lack standing to assert an NCPA claim because
none of the named plaintiffs are Nebraska residents, they were not injured in Nebraska,
and applying the NCPA extraterritorially violates the Due Process and Full Faith and Credit
Clauses of the U.S. Constitution. Filing No. 70 at 34-35.
“[P]rotection of out-of-state parties’ constitutional rights requires an inquiry into
their claims’ contacts with [Nebraska] and their individual state laws before concluding
[Nebraska] law may apply.” St. Jude, 425 F.3d at 1120. The plaintiffs’ NCPA claim alleges
Sav-Rx did not implement adequate measures to protect their Private Information from a
data breach, and by incorporating paragraphs 1 through 272 of the amended complaint,
13 The parties’ briefing does not evaluate standing and choice-of-law for the
consumer-protection claims. While the Court could request additional briefing, in the
interest of moving this consolidated case forward, it conducted its own research and applied
that research to the facts alleged.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 35 of 66 - Page ID #
<pageID>

36
their NCPA claim also alleges Sav-Rx misrepresented and misled the plaintiffs regarding
the safeguards it had in place. Although the plaintiffs’ amended complaint names, by
headings, other claims arising in both tort and contract, the focus of their NCPA claim lies
in tort. See, e.g., Stevens, 2025 WL 1334071, at *5 (concluding that where the plaintiff’s
consumer protection claims alleged “misrepresentation of services,” they are, at their core,
negligence based and sound in tort); Kreger v. Gen. Steel Corp., No. CIV.A. 07-575, 2010
WL 2902773, at *12 (E.D. La. July 19, 2010) (same).
Based on the allegations in the amended complaint, Sav-Rx is located in Nebraska,
and the cause of any injury to the plaintiffs—third-party access to Sav-Rx’s data—occurred
in Nebraska. As such, Nebraska may have a strong interest in regulating and remedying
Sav-Rx’s alleged insufficient data-protection measures. But state consumer-protection
laws are focused on protecting each state’s citizens, and this interest outweighs Nebraska’s
interest in policing alleged corporate misconduct. See Pa. Emp. Benefit Tr. Fund v. Zeneca,
Inc., 710 F. Supp. 2d 458 (D. Del. 2010) (“Michigan’s interest in protecting its citizens
from fraudulent practices pursuant to the MCPA trumps Delaware’s interest in regulating
the behavior of businesses within its jurisdiction.”); Carideo v. Dell, Inc., 706 F. Supp. 2d
1122, 1129 (W.D. Wash. 2010) (deciding Washington’s “manifest interest in protecting its
citizens, enforcing its consumer protection laws, and deterring future wrongful conduct”
outweighs Texas’ interests in Texas-based companies’ conduct); Goshen v. Mut. Life Ins.
Co. of N.Y., 774 N.E.2d 1190, 1195-96 (N.Y. Ct. App. 2002) (holding the New York
Consumer Protection Act was “not intended to police the out-of-state transactions of New
York companies”).
The plaintiffs allege that because of the Sav-Rx data breach, they face the risk of
identity theft or fraud, have expended time and effort to mitigate their risks, and are anxious
and distressed about the potential misuse of their Private Information. These alleged
injuries either have or may occur in the states where the plaintiffs reside, not Nebraska.
There is little or no direct relationship between the plaintiffs and Sav-Rx; the plaintiffs
have a contract with their health plans which, in turn, contracted with Sav-Rx for specific
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 36 of 66 - Page ID #
<pageID>

37
services. Any data-privacy notices or representations by Sav-Rx were posted on the internet
and presumably read by the plaintiffs while in their home states, and Sav-Rx’s Notice
Letter and its representations regarding the potential impact of the data breach was received
by the plaintiffs in their home states.
Having applied Nebraska’s choice-of-law rules to the alleged facts, the Court finds
the plaintiffs’ states of residence have the most significant relationship with their
consumer-protection claims. The plaintiffs may have claims under the consumer-protection
laws of their home states, but they cannot assert legally protected interests under the NCPA.
They therefore lack standing to assert an NCPA claim. See In re Pharm. Indus. Average
Wholesale Price Litig., 230 F.R.D. 61, 82, 83 (D. Mass. 2005) (holding consumer’s home
state had a more significant relationship to alleged fraudulent conduct violating state
consumer-protection laws, not the state where defendants had their principal places of
business); Lyon v. Caterpillar, Inc., 194 F.R.D. 206, 214, 215 (E.D. Pa. 2000) (same). As
named plaintiffs for putative classes, the plaintiffs “lack standing to assert claims under the
laws of the states in which they do not reside or in which they suffered no injury.” Insulate
SB, Inc. v. Advanced Finishing Sys., Inc., No. 13–2644 (ADM/SER), 2014 WL 943224,
*11 (D. Minn. Mar. 11, 2014). See also McGuire v. BMW of N. Am., LLC, No. 13–7356,
2014 WL 2566132, *6 (D.N.J. June 6, 2014); Zaycer v. Sturm Foods, Inc., 896 F. Supp. 2d
399, 409 (D. Md. 2012); In re Packaged Ice Antitrust Litig., 779 F. Supp. 2d 642, 657 (E.D.
Mich. 2011); In re Checking Account Overdraft Litig., 694 F. Supp. 2d 1302, 1325 (S.D.
Fla. 2010); In re Wellbutrin XL Antitrust Litig., 260 F.R.D. 143, 156–58 (E.D. Pa. 2009);
Smith v. Lawyers Title Ins. Corp., No. 07-12124, 2009 WL 514210, *3 (E.D. Mich. Mar.
2, 2009); In re Graphics Processing Units Antitrust Litig., 527 F. Supp. 2d 1011, 1027
(N.D. Cal. 2007).
(b) 	Washington, 	Pennsylvania, 	Missouri, 	and 	California
Statutory Claims
Geerhart, 	a 	resident 	of 	the 	State 	of 	Washington, 	alleges 	claims 	under 	the
Washington Consumer Protection Act (“WCPA”), RCW 19.86.010 et seq., (Filing No. 63,
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 37 of 66 - Page ID #
<pageID>

38
at 88-91); ¶¶ 428-443; Washington Data Breach Disclosure Law (“WDBDL”), RCW
19.255.005 et seq., (Filing No. 63 at 91-92, ¶¶ 444-449); and Washington Uniform Health
Care Information Act (“UHCIA”), RCW 70.02.005 et seq., (Filing No. 63 at 92-93, ¶¶ 450-
455).
Moser, a resident of Pennsylvania, seeks recovery under the Pennsylvania Unfair
Trade Practices and Consumer Protection Law (“UTPCPL”), 73 P.S. §§ 201-1–201-10.
Filing No. 63 at 93-96, ¶¶456-466.
Sutherlin, a Missouri resident, alleges a right to recover under the Missouri
Merchandising Practices Act (“MMPA”), Mo. Rev. Stat. § 407.005 et seq. Filing No. 63
at 96-98, ¶¶ 467-481.
Schrieo, a resident of California, alleges claims under the California Consumer
Privacy Act (“CCPA”), Cal. Civ. Code §§ 1798.100-1798.199, (Filing No. 63 at 99-100,
¶¶ 482-489); California Invasion of Privacy Act (“CIPA”), Cal. Pen. Code §§ 630-638.55,
(Filing No. 63 at 100-103, ¶¶ 490-505); California Confidentiality of Medical Information
Act (“CMIA”), Cal. Civil Code §§ 56 - 56.37, (Filing No. 63 at 103-104, ¶¶ 506-511); and
California Unfair Competition Law (“CUCL”), Cal. Bus. & Prof. Code §§ 17200-17210,
(Filing No. 63 at 104-105, ¶¶512-516).
Having thoroughly reviewed the allegations, the Court finds that for each claim, the
plaintiffs allege a breach of duties akin to duties arising in tort, not contract law. Applying
the previously discussed Nebraska choice-of-law rules for tort actions, as to each plaintiff,
any injuries sustained occurred in the states where the plaintiffs reside, and those states
have a substantial interest in protecting their citizens. Geerhart, Moser, Sutherlin, and
Schrieo are each asserting rights to recover under statutes for their respective home states,
and each can assert a legally protected interest sufficient to pursue his or her state-specific
statutory claim(s).
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 38 of 66 - Page ID #
<pageID>

39
But an alleged state statutory violation does not, in and of itself, establish Article III
standing. 	Each 	plaintiff 	must 	still 	show 	a 	concrete 	injury-in-fact 	traceable 	to 	the
defendant’s alleged statutory violation. See Spokeo, 578 U.S. at 340; Van Patten v. Vertical
Fitness Grp., LLC, 847 F.3d 1037, 1048 (9th Cir. 2017) (quoting Kwikset Corp. v. Superior
Court, 246 P.3d 877, 885 (Cal. 2011) (denying standing under CUCL due to the lack of a
concrete injury). A state legislature cannot “confer Article III standing upon a plaintiff who
suffers no concrete harm merely by authorizing a private right of action based on a bare
violation of a state statute.” Ross v. AXA Equitable Life Ins. Co., 115 F. Supp. 3d 424, 434
(S.D.N.Y. 2015) (collecting cases); see also In re: Cmty. Health Sys., Inc., No. 15-CV-
222-KOB, 2016 WL 4732630, at *17 (N.D. Ala. Sept. 12, 2016) (finding no Article III
injury-in-fact on state statutory claims where there was no injury-in-fact for purposes of
common-law claims). “[S]tanding in federal court is a question of federal law, not state
law. No matter its reasons, the fact that a State thinks a private party should have standing
to seek relief for a generalized grievance cannot override this Court’s settled law to the
contrary.” Hollingsworth v. Perry, 570 U.S. 693, 715 (2013). “
Refusing to entertain generalized grievances ensures that . . . courts exercise
power that is judicial in nature, . . and ensures that the Federal Judiciary
respects the proper—and properly limited—role of the courts in a democratic
society, . . . States cannot alter that role simply by issuing to private parties
who otherwise lack standing a ticket to the federal courthouse.
Id.
The Court has concluded Moser has standing to pursue claims arising from the data
breach, explaining her loss of privacy is an injury-in-fact, traceable to the data breach,
which can be redressed by an award of damages. Her claim under the UTPCPL raises
essentially the same factual allegations already addressed, and she requests actual damages.
For the reasons previously stated, Moser has standing to pursue a UTPCPL claim.
Geerhart’s claim under the WDBDL includes no factual allegations of resulting
harm. Sav-Rx’s delayed notice of the data breach may be a violation of the WDBDL, but
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 39 of 66 - Page ID #
<pageID>

40
Geerhart has not alleged any injury caused by the violation. He therefore lacks standing to
pursue this claim.
Geerhart requests actual damages for violation of his rights under the WCPA and
the UHCIA; Sutherlin requests actual damages and injunctive relief under the MMPA; and
Schrieo seeks statutory or actual damages and injunctive relief under the CCPA, and
injunctive relief under the CUCL. All these claims raise substantially the same allegations
previously 	discussed—Sav-Rx 	failed 	to 	adequately 	protect 	the 	plaintiffs’ 	Private
Information, resulting in unauthorized release of the information to a third party, and actual
misuse or the future risk of misuse; loss of time, money, and opportunities due to mitigation
efforts; 	and 	emotional 	distress. 	Geerhart, 	Sutherlin, 	and 	Schrieo 	seek 	damages 	to
compensate for their actual and anticipated harm, and Sutherlin and Schrieo request an
order requiring Sav-Rx to implement improved data security to prevent future harm. But
as previously discussed, these plaintiffs have not sufficiently alleged an actual harm, or a
certainly impending or substantial risk of future harm, arising from the data breach. They
therefore also lack standing to pursue the state statutory claims.
Schrieo alleges Sav-Rx used tracking software on its websites to collect information
on Schrieo’s website usage without his knowledge or consent in violation of CIPA. He
further claims it violated the CMIA by using the tracking technology to collect his
prescription history and insurance identification information and then, though its use of
inadequate data security, allowed disclosure of his medical information to third parties. He
seeks damages under CIPA and injunctive relief under both CIPA and CMIA. The parties’
briefing does not specifically address Article III standing for the website-tracking claims.
Schrieo’s CIPA and CMIA claims are substantively different than the statutory and
common-law data-breach claims previously discussed. These claims do not allege the theft
of Private Information by a third party, but rather an active, intentional, and nonconsensual
monitoring by Sav-Rx of Schrieo’s online conduct. Federal courts have held that violating
CIPA and the CMIA by using online tracking programs to harvest and disclose a website
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 40 of 66 - Page ID #
<pageID>

41
user’s navigation analytics and tendencies, user information, and medical information is a
violation of privacy and an injury-in-fact sufficient to support standing. See In re Facebook,
Inc. Internet Tracking Litig., 956 F.3d 589, 599 (9th Cir. 2020) (holding collecting an
individual’s likes, dislikes, interests, and habits, through use of a tracking program and
without affording users a meaningful opportunity to control or prevent the unauthorized
exploration of their private lives, was an injury-in-fact); Campbell v. Facebook, Inc., 951
F.3d 1106 (9th Cir. 2020) (holding an alleged violation of CIPA, which provides a private
right of action for unauthorized reading and use of information obtained while an electronic
communication is in transit, satisfies the concrete-injury requirement for injury-in-fact
element for Article III standing); In re Google Inc. Cookie Placement Consumer Priv.
Litig., 806 F.3d 125, 134 (3d Cir. 2015) (finding an injury-in-fact where the defendants,
while serving advertisements to plaintiffs’ personal web browsers, implanted tracking
cookies on those computers); Doe v. N. Cal. Fertility Med. Ctr., No. 22-CV-01861-DAD-
JDP, 2024 WL 246178, at *5 (E.D. Cal. Jan. 23, 2024) (holding “posting” of plaintiffs’
medical information on the internet in violation of CMIA was an injury-in-fact sufficient
to support standing).
Schrieo alleges that Sav-Rx used tracking software to collect information about
users’ behavior and activity on the Sav-Rx website, and while he used the website, he was
subject to its tracking software. He claims that without his knowledge and consent, it
tracked where he accessed the website and what he viewed while on it, and on information
and belief, it collected his prescription history and insurance-identification information.
Filing No. 63 at 26, 56 ¶¶ 251. He claims the Sav-Rx privacy policy states it will never
share information for marketing purposes without written permission, which he claims is a
misrepresentation since it uses the tracking software to improve its own marketing. Filing
No. 63 at 56, ¶ 251.14 Schrieo does not allege that while visiting the website, he made any
14 Schrieo alleges he received more phishing emails and targeted advertising
regarding his medical condition for which he receives prescription medication from
Sav-Rx, but he alleges this increase was caused by the data breach, with no mention of the
website-tracking allegations. Filing No. 63 at 28, ¶ 137.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 41 of 66 - Page ID #
<pageID>

42
communications that could have been intercepted, or that he navigated the website’s
contents, entered information or text, or took any actions other than simply opening the
webpage and then closing it. Schrieo’s sparce allegations regarding the alleged CIPA and
CIMA tracking violations do not support a finding of injury-in-fact sufficient to support
standing. See Daghaly v. Bloomingdales.com, LLC, No. 23-4122, 2024 WL 5134350, at *1
(9th Cir. Dec. 17, 2024) (finding the plaintiff lacked standing to assert a CIPA claim where
he alleged defendant’s website intercepts the website users’ communications, monitors
their actions, and transmits the collected information to third parties but failed to allege her
own interactions with the website other than stating she accessed it).15
In summary, of the named plaintiffs, only Moser has alleged facts showing the
existence of a case or controversy. Specifically, she has sufficiently alleged a loss of
privacy through 	public disclosure of 	highly sensitive information—an actual harm
recognized under the common law—that is traceable to the Sav-Rx data breach and
redressable by her requested award of damages. She alleges she was personally harmed by
the Sav-Rx data breach,16 and she has standing to pursue an action to recover for that harm.
Moser raises several legal theories of recovery, each of which will now be individually
addressed.
15 Even had Schrieo alleged standing, he failed to state a CIPA or CMIA claim.
Sav-Rx “was the party that was meant to, and did, receive Plaintiff’s communications,” so
“under the party exception to [CIPA], any alleged interception of the communications is
not actionable.” Pena v. GameStop, Inc., 670 F. Supp. 3d 1112, 1118 (S.D. Cal. 2023).
Schrieo has failed to allege a CMIA violation because a “plaintiff must plead an
‘affirmative communicative act’ by the defendant, which does not occur if the information
is stolen.” Stasi v. Inmediata Health Grp. Corp., 501 F. Supp. 3d 898, 922 (S.D. Cal. 2020).
16 Moser alleges that she seeks recovery for not only herself, but for her minor
children. There are no allegations indicating the children’s Private Information was
disclosed on the dark web or otherwise subject to actual or threatened misuse. So, while
Moser has standing as to her own interests, she cannot assert claims on behalf of her minor
children because they lack standing.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 42 of 66 - Page ID #
<pageID>

43
C. 	Failure to State a Claim
Of the theories of recovery alleged in the amended complaint, Moser has standing
to pursue the following claims: breach of implied contract; breach of third-party-
beneficiary contract; unjust enrichment; breach of fiduciary duty/breach of confidence;
invasion of privacy/intrusion upon seclusion; negligence; negligence per se; and violation
of the Pennsylvania UTPCPL.17 For each claim, the allegations in paragraphs 1 through
282 of the amended complaint are incorporated by reference. Filing No. 63 at 1-65.
As to the common-law claims, Moser argues Nebraska law governs her claims,
explaining Nebraska applies the most-significant-relationship test to determine choice-of-
law, and using this test in data-breach cases, courts have consistently concluded that the
state where the defendant and its breached servers are located, not the plaintiffs’ home
states, have the most significant relationship to the claims alleged. Filing No. 73 at 17-18.
Sav-Rx does not affirmatively dispute this statement, but as to every claim raised, cites
Nebraska law and the law in each named plaintiff’s state. Filing No. 70 at 19.
“A district court must conduct an individualized choice-of-law analysis that is
susceptible to meaningful appellate review to ensure that the application of a given state's
‘law is neither arbitrary nor fundamentally unfair.’” Hale v. Emerson Elec. Co., 942 F.3d
401, 404 (8th Cir. 2019) (quoting St. Jude, 425 F.3d at 1120) (quoting Allstate Ins. Co. v.
Hague, 449 U.S. 302, 313 (1981)). But “before entangling itself in messy issues of conflict
17 The amended complaint includes what is captioned as a “Declaratory Judgment
Act” claim. Filing No. 63 at 105-107, ¶¶ 518-523. A declaratory judgment is a remedy.
The Declaratory Judgment Act does not provide a means for standing and it does not create
a claim for relief, see Mitchell v. Dakota Cnty. Soc. Servs., 959 F.3d 887, 897 n. 2 (8th Cir.
2020)), so the Court cannot enter a judgment pursuant to the Declaratory Judgment Act if
the plaintiff lacks standing to pursue the claim for which declaratory relief is sought. Since
Moser lacks standing for claims of future injury because she has failed to allege a certainly
impending or substantial risk, and she has failed to allege facts supporting standing to
obtain prospective relief, including declaratory relief, for her actual injury (loss of privacy),
she cannot assert a “claim” under the Declaratory Judgment Act.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 43 of 66 - Page ID #
<pageID>

44
of laws a court ought to satisfy itself that there actually is a difference between the relevant
laws of the different states.” Phillips v. Marist Soc. of Washington Province, 80 F.3d 274,
276 (8th Cir. 1996) (quoting Barron v. Ford Motor Co. of Can., Ltd., 965 F.2d 195, 197
(7th Cir.), cert. denied, 506 U.S. 1001 (1992)). Having reviewed the relevant laws of
Nebraska and Pennsylvania, the Court finds the legal principles involved in this case are
the same in both jurisdictions and the choice of state law will not determine the outcome.
The Court therefore need not decide which state’s law applies to Moser’s common-law
claims. Id.
1. 	Breach of Implied Contract
The amended complaint alleges that to receive healthcare services from Sav-Rx,
Moser was required to disclose her Private Information. She alleges that Sav-Rx’s privacy
policy states it is required by law to maintain the privacy and security of protected health
information and promises to provide prompt notice if a breach occurs that may have
compromised the privacy or security of Private Information. Filing No. 63 at 31 ¶ 153.
Moser alleges she and Sav-Rx had a mutual understanding that Sav-Rx would implement
and maintain adequate and reasonable data-security practices and procedures to protect her
Private Information, and a shared expectation and understanding that Sav-Rx would not
disclose, intentionally or unintentionally, the sensitive Private Information in its possession
and control. To that end, Plaintiff Moser expected Sav-Rx would:
• 	provide healthcare services to her;
• 	take measures to protect the security and confidentiality of her Private Information;
• 	take steps to ensure that access to the Private Information in the possession and
control of Sav-Rx was restricted and limited to achieving an authorized medical
purpose;
• 	restrict access to only qualified and trained agents and vendors;
• 	design 	and 	implement 	appropriate 	retention 	policies 	to 	protect 	the 	Private
Information from unauthorized access and disclosure;
• 	require proper encryption of the Private Information;
• 	require multi-factor authentication for access to the Private Information; and
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 44 of 66 - Page ID #
<pageID>

45
• 	otherwise protect her Private Information in compliance with the law and industry
standards.
79, ¶ 369. Moser alleges data security was a material term of her agreement with Sav-Rx.
She states she performed her obligations under the implied contract by disclosing Private
Information to Sav-Rx and paying for healthcare services, but Sav-Rx breached the implied
contract by failing to implement adequate data security. Moser claims that as a direct and
proximate 	result 	of 	this breach, she sustained damages, 	including foreseeable 	and
consequential damages, and she demands compensatory, consequential, and nominal
damages. Filing No. 63 at 80, ¶¶ 375-376.
To create a contract, there must be both an offer and an acceptance, and a meeting
of the minds or a binding mutual understanding between the parties. See Morris v. Dall, 26
N.W.3d 304, 312 (Neb. 2025); Tignor, 745 F. Supp. 3d at 204 (citing CoreStates Energy,
N.A. v. Cutillo, 723 A.2d 1053, 1058 (Pa. Super. 1999)). The parties’ agreement must be
definite and certain as to the terms and requirements, identify the subject matter, and spell
out the essential commitments and agreements. Generally, the parties must have mutual
obligations in consideration of the act or promise of the other. The party seeking to enforce
the contract has the burden of proof. See Morris, 26 N.W, 3d at 312; Ecore Int’l, Inc. v.
Downey, 343 F. Supp. 3d 459, 485-86 (E.D. Pa. 2018) (applying Pennsylvania law).
A contract may be express, implied, written, or oral. See Dolton Elec., L.L.C. v.
Ichtertz, No. A-23-885, 2024 WL 3948605, at *7 (Neb. Ct. App. Aug. 27, 2024), review
granted (Oct. 28, 2024); Ingrassia Constr. Co. v. Walsh, 486 A.2d 478 (Pa. Super. 1984).
No precise formality or express utterance from the parties is necessary to prove a meeting
of the minds. It may be implied from the parties’ conduct, course of dealing, and
circumstances showing a mutual intent to contract. An implied contract is just as
enforceable as an express contract. See Moore v. Neb. Accountability & Disclosure
Comm’n, 965 N.W.2d 564, 573 (Neb. 2021); Ecore Int’l, 343 F. Supp. 3d at 488.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 45 of 66 - Page ID #
<pageID>

46
Sav-Rx argues the amended complaint fails to allege facts supporting a mutual
assent to form of an implied contract, explaining the attenuated relationship between the
plaintiffs and Sav-Rx does not suggest a mutual intent to contract or meeting of the minds
regarding material terms. Filing No. 70 at 27. Sav-Rx argues its Privacy Notice does not
support a finding of mutual intent to contract, particularly where there are no allegations
that Moser read the Privacy Notice before disclosing her PII or that she decided to use
Sav-Rx’s services based on its representations. Filing No. 70 at 27-28; Filing No. 76 at 17.
Finally, Sav-Rx alleges Moser has failed to allege damages for any breach of an implied
contract.
For the reasons previously discussed on the standing issue, the Court finds Moser
has adequately alleged damage arising from the data breach. The question is whether those
damages arose from breach of contractual rights.
Moser has failed to allege the meeting of the minds requirement for forming a
contract. The amended complaint repeatedly states Sav-Rx solicited, collected, stored, and
maintained the plaintiffs’ Private Information, (Filing No. 63 at 5 34, 71, 78, 80-82 at
¶¶ 21-22, 167, 318, 360, 375, 380, 390), but it does not clearly state whether Sav-Rx
solicited and collected information from Moser’s health plan or from Moser herself. The
amended complaint vaguely states, “Plaintiffs . . . entrusted their sensitive Private
Information to Sav-Rx and/or their respective health insurance plans,” (Filing No. 63 at 4,
30 ¶¶ 14, 149), and Moser alleges that to provide medication-benefit-management services
to health plans, Sav-Rx receives Private Information from health plans and healthcare
providers, such as referring physicians, or other doctors. Filing No. 63 at 29-30, ¶¶
145-147. Yet, every named plaintiff alleges that “[a]s a condition of obtaining medication
benefit management services from [Sav-Rx],” they “were required to provide their PII and
PHI to [Sav-Rx], including their names, addresses, dates of birth, Social Security numbers,
phone numbers, email addresses, and insurance identification numbers.” Filing No. 63 at
15, ¶ 68. There is no allegation stating whether, as a condition of receiving Sav-Rx’s
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 46 of 66 - Page ID #
<pageID>

47
services, the health plan required Moser’s consent to share her PII with Sav-Rx, or whether
Sav-Rx received the information directly from Moser upon Sav-Rx’s demand.
While a contract may be implied, it nonetheless requires a meeting of the minds
which, in turn, requires some communication or interaction between the parties. See Stitch
Ranch, LLC v. Double B.J. Farms, Inc., 837 N.W.2d 870, 882 (Neb. App. 2013);
Kingsbury, Inc. v. GE Power Conversion UK, Ltd., 78 F. Supp. 3d 611, 619 (E.D. Pa.
2014); In re NCB Mgmt. Servs., Inc. Data Breach Litig., 748 F. Supp. 3d 262 (E.D. Pa.
2024) (applying Pennsylvania law) (finding no implied contract between a plaintiff and
debt collector where the plaintiff provided private information to the bank, and the bank
shared the information with the defendant to assist in collecting the plaintiff’s debt). The
existence of an industry data-security standard or federal regulation is not a statement or
promise by a defendant, let alone one by which it implicitly contracted to protect Private
Information in exchange for its receipt. See Roma, 2024 WL 3678984, at *12. The
obligation to hand over sensitive data in exchange for healthcare does not alone create a
contractual promise to safeguard that information. Id. “Pleading just the disclosure of
confidential information is not enough to create an implied contract to safeguard that data.”
NCB Mgmt. Servs., 748 F. Supp. 3d at 274.
Here, the amended complaint does not explain the actions, language used, or other
circumstances 	between 	Moser 	and 	Sav-Rx 	that 	prompted 	Moser’s 	disclosure 	of
information in exchange for Sav-Rx’s services. While the Court must consider all
allegations and inferences in favor of the plaintiff when deciding whether a complaint states
a claim for relief, the Court cannot assume a meeting of the minds, consideration, and an
agreement between Moser and Sav-Rx in the absence of some specific factual allegations
supporting those contract elements. See Johnson, 769 F. Supp. 3d at 956 (holding the
plaintiffs failed to plead breach of implied contract where they allegedly entrusted
information to the defendant expecting confidentiality, did not allege they read and relied
on the defendant’s privacy policy before receiving treatment; the defendant already had a
duty imposed by law to protect the plaintiffs’ information; no promises were made beyond
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 47 of 66 - Page ID #
<pageID>

48
those legal duties, and neither the privacy policy nor any other assurances promised an
impenetrable system).
Upon consideration of the allegations, the Court finds the amended complaint does
not state a claim for breach of an implied contract between Moser and Sav-Rx.
2. 	Breach of Third-Party-Beneficiary Contract
The amended complaint alleges Sav-Rx provided pharmacy-benefits-management
services pursuant to its contract with Moser’s health insurance plan and solely to provide
benefits to her. Sav-Rx’s Privacy Notice allegedly states, “When Sav-Rx provides
pharmacy benefit administration services for your health plan, the terms of the contract
between your health plan and Sav-Rx governs our handling of your health information.”
Filing No. 63 at 81, ¶ 379. Moser alleges the contract between Sav-Rx and the health plan
required 	compliance 	with 	the 	confidentiality 	requirements 	of 	HIPAA. 	From 	these
allegations, Moser argues she was clearly the intended beneficiary of the contract between
Sav-Rx and her health-insurance plan; Sav-Rx breached its contract with the health plan
when it failed to use reasonable data-security measures to adequately protect her Private
Information from unauthorized access and disclosure; the unauthorized disclosure of the
Private Information caused foreseeable harm; and she in entitled to compensatory and
consequential damages. Filing No. 63 at 81-82, ¶¶ 379-385.
Sav-Rx argues Moser has not alleged any facts indicating she was an intended third-
party beneficiary of a contract between her health-insurance plan and Sav-Rx, noting she
did not attach any contract to the amended complaint or cite any contractual language
affirmatively demonstrating an intent to confer third-party-beneficiary status. It argues that
Sav-Rx’s Privacy Notice is not a contract between Sav-Rx and the health plan, and it cannot
confer third-party-beneficiary status on Moser. Filing No. 70 at 29. See also, Filing No. 76
at 18.
Third-party-beneficiary status is strictly construed. Those who are not named parties
to a contract cannot recover as third-party beneficiaries unless they show the contract was
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 48 of 66 - Page ID #
<pageID>

49
contemplated to grant them rights, either expressly or by reasonable intendment. See
Podraza v. New Century Physicians of Neb., LLC, 789 N.W.2d 260, 267 (Neb. 2010);
Scarpitti v. Weborg, 609 A.2d 147, 150-51 (Pa. 1992) (holding a third-party beneficiary
exists only where both parties to the contract express an intention to benefit the third party
unless compelling circumstances indicate third-party-beneficiary rights are necessary to
effectuate the parties’ intent). Here, Moser points to language outside the health plan/Sav-
Rx contract—provisions within HIPAA and Sav-Rx’s Privacy Notice—as granting third-
party rights under the contract. The amended complaint does not allege that the health plan
and Sav-Rx incorporated HIPAA and Sav-Rx’s Privacy Notice as terms of their contract,
or that the contract includes any provision stating it should be construed for the benefit of
and enforcement by the health plan’s insureds. While Moser may have expected Sav-Rx’s
protection of her data as a beneficiary of Sav-Rx’s contractual services to the plan, the
Court must focus on the intent of the contracting parties, not the intent or expectation of
the third party, when deciding contract-beneficiary rights. NCB Mgmt. Servs. 748 F. Supp.
3d at 277.
The amended complaint fails to allege facts to support a claim that Moser was an
intended third-party beneficiary of the contract between Sav-Rx and her health plan. The
third-party-beneficiary claim must be dismissed.
3. 	Unjust Enrichment
Moser 	alleges 	she 	paid 	money 	for 	Sav-Rx’s 	pharmacy-benefits-management
services and disclosed her Private Information to Sav-Rx. She claims data security was an
integral part of the services she purchased and expected, but rather than investing in data
security, Sav-Rx knowingly and deliberately enriched itself by saving those costs, in an
amount known by Sav-Rx but not Moser. She alleges Sav-Rx profited from and used her
information for business purposes but failed to pay for data security, resulting in
unauthorized third-party access to her Private Information, and as a direct and proximate
result of Sav-Rx’s decision to prioritize its own profits over the requisite data security, she
was harmed. She argues that under principles of equity and good conscience, Sav-Rx
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 49 of 66 - Page ID #
<pageID>

50
should not be allowed to retain the money she paid for data-security measures that Sav-Rx
then chose not to implement, and since she has no adequate remedy at law, she requests an
order compelling Sav-Rx to disgorge to all gains it unjustly received. Filing No. 63 at 82-
84, ¶¶ 386-405.
To recover on a claim for unjust enrichment, the plaintiff must show that (1) the
defendant received money, (2) the defendant retained possession of the money, and (3) the
defendant in justice and fairness ought to pay the money to the plaintiff. See Boone River,
LLC v. Miles, 994 N.W.2d 35, 895, opinion modified on denial of reh’g, 996 N.W.2d 629
(Neb. 2023) (citing Zook v. Zook, 978 N.W.2d 156 (Neb. 2022)); Robins v. Robins, 2025
Pa. Super 108, 338 A.3d 184, 189 (2025), re-argument denied (July 29, 2025). Sav-Rx
argues Moser has failed to state a claim for unjust enrichment because she does not allege
Sav-Rx unjustly obtained or retained any money from her, that Sav-Rx failed to provide
pharmacy-benefits-management services or that the value of such services was less because
of the data breach, or that she bargained or paid for specific data-security measures. Filing
No. 70 at 30-31; Filing No. 76 at 18. Moser argues data security is integral to the health
plan services she purchased and expected Sav-Rx to adequately fund, Sav-Rx received part
of her payments to her health plan in exchange for the benefit of using her Private
Information, Sav-Rx did not provide adequate data security, (Filing No. 73 at 27-28), and
Sav-Rx therefore “‘received and retained [benefits] under such circumstances that it would
be inequitable and unconscionable to permit the party receiving them to avoid payment
therefore.‘” Filing No. 73 at 28 (quoting Stark v. Soteria Imaging Servs., Inc., 276 F. Supp.
2d 989, 993 (D. Neb. 2003)).
Moser does not allege that any specific portion of her health-plan premium was for
data protection or even designated by the health plan for payment of Sav-Rx’s services.
Assuming the truth of her allegations, Moser does not allege she conferred a benefit to
Sav-Rx in exchange for protection of her Private Information or facts to support a claim
that Sav-Rx inequitably retained the portion of her premiums paid to her health plan and
then allocated to Sav-Rx. See Carlsen v. GameStop, Inc., 833 F.3d 903, 912 (8th Cir. 2016);
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 50 of 66 - Page ID #
<pageID>

51
accord In re SuperValu, Inc., 925 F.3d 955, 966 (8th Cir. 2019) (SuperValu II) (rejecting
unjust-enrichment theory where the plaintiff’s complaint alleged he paid for groceries but
did not allege he purchased “a side order of data security and protection”); Johnson, 769
F. Supp. 3d at 956-57 (unjust enrichment claims denied where plaintiffs did not allege the
amount paid that would go towards security practices and his claim was based on
speculation that defendant recovers the costs by building them into the medical billing);
Harris v. Mercy Health Network, Inc., No. 4:23-CV-00195-SHL-SBJ, 2024 WL 5055556,
at *12 (S.D. Iowa June 26, 2024) (“Because Plaintiffs have not alleged that a specific
portion of their payments funded data security, they have not alleged the conferral of a
benefit on [the defendant] in exchange for protection of their Private Information, much
less stated how [the defendant’s] retention of any such ‘benefit’ would be inequitable.”).
“[A] traditional exchange of payment for goods and services is not a circumstance in which
it is “unjust” to allow the defendant to retain the benefit. Plaintiffs got what they paid for—
[healthcare] benefits . . . Because [Sav-Rx] was not unjustly enriched by Plaintiff[‘s] . . .
premiums, this claim is implausible on its face.” EyeMed, 2023 WL 6383467, at *1
(holding vision-care facility was not unjustly enriched where the plaintiff received vision
care, but the facility negligently maintained lax security protocols and failed to protect the
plaintiff’s PII from cybertheft).
Moser has failed to state a claim for unjust enrichment.
4. 	Breach of Fiduciary Duty/Breach of Confidence
Moser 	argues 	Sav-Rx’s 	solicitation, 	acceptance, 	and 	storage 	of 	her 	Private
Information in exchange for healthcare services created a fiduciary relationship with
Sav-Rx, and an obligation for Sav-Rx to act primarily for Moser in performing the fiduciary
duty of safeguarding her Private Information. The amended complaint alleges that to
receive Sav-Rx’s healthcare services, Moser was required to and did entrust her highly
sensitive Private Information to Sav-Rx in confidence, with the mutual understanding and
reasonable expectation that it would safeguard and protect that information from improper
access and disclosure to unauthorized third parties. She alleges she would not have done
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 51 of 66 - Page ID #
<pageID>

52
so had she known her data would not be adequately protected; that she relied entirely on
Sav-Rx, which solely controlled it data systems and networks, to protect her Private
Information, and she had no ability to assess, verify, or influence its data-security practices.
Filing No. 63 at 15, 85, ¶¶ 71, 408-413.
Moser argues Sav-Rx, in the course of providing healthcare-related services,
required her to provide private, sensitive medical and personal information, thereby
creating a fiduciary relationship, and its collection of sensitive medical data, places it in
professional relationship akin to a doctor. Filing No. 73 at 29-30. She claims that by failing
to implement and maintain adequate data-security measures, Sav-Rx breached its fiduciary
duties to keep her data confidential and violated the duty of good faith and the implied
covenant of trust and confidence that is inherent in the physician-patient relationship. As a
direct and proximate result of this breach of fiduciary duty, she claims she has and will
suffer harm and the risk of future harm for which she requests actual, consequential, and
nominal damages. Filing No. 63 at 86-87, ¶¶ 415-419.
Sav-Rx argues Moser, a member of a health plan, did not have a relationship of trust
and confidence 	in 	Sav-Rx giving 	rise 	to 	fiduciary 	duties, 	or 	a 	close 	professional
relationship sufficient to support a breach of confidence action. Filing No. 70 at 32, 34.
To state a claim for breach of fiduciary duty, Moser must allege facts showing:
(1) Sav-Rx owed her a fiduciary duty; (2) it breached that duty; (3) the breach caused injury
to Moser; and (4) she was damaged. See McFadden Ranch, Inc. v. McFadden, 807 N.W.2d
785, 790 (Neb. Ct. App. 2011); Meyers v. Sudfeld, No. 05-CV-2970, 2007 WL 419182, at
*10 (E.D. Pa. Feb. 2, 2007). The existence of a fiduciary duty and the scope of that duty
are questions of law for a court to decide. See McFadden Ranch, 807 N.W. 2d at 790. A
fiduciary duty arises out of a confidential relationship which exists when one party gains
the confidence of the other and purports to act or advise with the other’s interest in mind.
See Basile v. H & R Block, Inc., 52 A.3d 1202, 1204 (Pa. Sup. 2012); Wolf v. Walt, 247
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 52 of 66 - Page ID #
<pageID>

53
Neb. 858, 530 N.W.2d 890 (1995); Bloomfield v. Neb. State Bank, 465 N.W.2d 144 (Neb.
1991).
Based on the factual allegations within the amended complaint, Moser had no direct
relationship with Sav-Rx. Rather, Sav-Rx contracted with Moser’s health-insurance plan
and agreed to work on its behalf when providing pharmaceutical-management services to
insureds. An insurances policy does not presumptively create a fiduciary relationship
between the insurer and the insured. See Weisenberger v. Ameritas Mut. Holding Co., 597
F. Supp. 3d 1351, 1367 (D. Neb. 2022) (“[T]here is no presumption of a fiduciary
relationship between an insured and insurer merely because they entered into a contract for
insurance coverage.”) (applying Nebraska law); Slapikas v. First Am. Title Ins. Co., 298
F.R.D. 285, 293 (W.D. Pa. 2014) (applying Pennsylvania law). The relationship between
an insurer and insured arises from an arms-length transaction creating an insurance contract
with competing interests, often generating litigation between the parties. These disparate
interests are incompatible with a fiduciary relationship. See Slapikas, 298 F.R.D. at 293;
Am. Driver Serv., Inc. v. Truck Ins. Exch., 631 N.W.2d 140, 148 (Neb. Ct. App. 2001).
While Moser argues that in her case, she trusted Sav-Rx as a fiduciary to care for her PII,
her amended complaint fails to state a claim for breach of fiduciary duties.
[T]he plaintiff alleged nothing that would distinguish her engagement with
the defendant as something outside of a normal insurer/insured relationship.
True that the plaintiff trusted the defendant to keep her PII secure, but the
same is true with nearly every insurer/insured relationship . . . There is a
common law duty for the insurer or vendor to use due care, but not a special
confidential relationship giving rise to a fiduciary duty.
Weisenberger, 597 F. Supp. 3d at 1368 (applying Nebraska law); see also Zimmerman v.
Highmark, Inc., 780 F. Supp. 3d 588, 604 (W.D. Pa. 2025) (applying Pennsylvania law)
(“Plaintiffs have not alleged the requisite confidential relationship. The amended complaint
alleges an insurer-insured relationship. That is not enough.”).
Moser captions her claim as including “Breach of Confidence.” “[A] breach of
confidence involves ‘the unconsented, unprivileged disclosure to a third party of nonpublic
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 53 of 66 - Page ID #
<pageID>

54
information that the defendant has learned within a confidential relationship.’” Kamal v. J.
Crew Grp., Inc., 918 F.3d 102, 114 (3d Cir. 2019) (quoting Alan B. Vickery, Breach of
Confidence: An Emerging Tort, 82 Colum. L. Rev. 1426, 1455 (1982)). To state a claim
for breach of confidence, the plaintiff must allege facts showing: “(1) the plaintiff conveyed
‘confidential and novel information’ to the defendant; (2) the defendant had knowledge
that the information was being disclosed in confidence; (3) there was an understanding
between the defendant and the plaintiff that the confidence be maintained; and (4) there
was a disclosure or use in violation of the understanding.” Burns v. Erving, 810 F. Supp.
2d 1167, 1172 (D. Nev. 2011) (quoting Berkla v. Corel Corp., 302 F.3d 909, 917 (9th Cir.
2002)).
While breach of confidence is an accepted tort under English common law, the “law
of breach of confidence in the United States, at least with respect to personal information,
has not enjoyed a similar development. The action for breach of confidence appears to have
died out in its infancy.” Breach of Confidence: An Emerging Tort, 82 Colum. L. Rev. at
1453-54.
To the extent they have survived in the United States, breach-of-confidence claims
traditionally arise in the context of close professional relationships, such as those involving
“physicians, therapists, financial institutions, and the like.” Clemens v. ExecuPharm, Inc.,
No. CV 20-3383, 2024 WL 199554, at *4 (E.D. Pa. Jan. 18, 2024). To state a breach-of-
confidence claim, a plaintiff must allege that the defendant affirmatively shared private
information or performed some act that made the plaintiff’s information known. See
Farmer v. Humana, Inc., 582 F. Supp. 3d 1176, 1189 (M.D. Fla. 2022). A breach-of-
confidence claim cannot succeed if the information was stolen by a third party and was not
affirmatively disclosed by the defendant. Id. (collecting cases) (noting a breach-of-
confidence claim does not lie against a health insurer and its vendor where the defendant’s
inadequate security facilitated the theft of information by third-parties; such allegations
sound in negligence, not breach of confidence); Zimmerman, 780 F. Supp. 3d at 605;
Gaddy v. Long & Foster Cos., Inc., No. CV 21-2396 (RBK/SAK), 2022 WL 22894854, at
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 54 of 66 - Page ID #
<pageID>

55
*11 (D.N.J. Mar. 16, 2022) (collecting cases); In re Brinker Data Incident Litig., No. 18-
686, 2020 WL 691848, at *22 (M.D. Fla. Jan. 27, 2020) (collecting cases). A claim of
negligence is the proper theory of recovery when plaintiffs allege a third party was able to
steal their confidential information because the defendant failed to adequately protect it.
See Gaddy, 2022 WL 22894854, at *11.
There is a common-law duty for the insurer or its vendor to use due care but not a
special confidential relationship giving rise to a fiduciary duty or the close professional
relationship required for a breach-of-confidence claim. Moser’s breach of fiduciary
duty/breach of confidence claim will be dismissed.
5. 	Negligence
The amended complaint alleges Sav-Rx had a duty to: (a) design, maintain, and test
its security protocols to ensure that Private Information was adequately secured and
protected; (b) remove or delete sensitive patient data when no longer needed for authorized
purposes; and (c) implement and maintain procedures to detect and prevent improper
access to and misuse of Private Information. Filing No. 63 at 65-66, ¶ 286. It alleges
Sav-Rx knew or should have known that the electronic and patient records in its possession
would likely be targeted by cybercriminals and given the sensitivity of the information
collected from and entrusted to Sav-Rx, it had a heightened duty to protect the records from
a cybercriminal attack. Moser alleges the data breach could have been prevented had
Sav-Rx heeded industry warnings and implemented preventive measures recommended by
the United States Government, the FTC, and HIPAA, as extensively outlined in the
amended complaint. Filing No. 63 at 38-40, ¶¶ 181-182. To summarize, the amended
complaint alleges Sav-Rx failed to:
• 	adopt, implement, and maintain adequate 	and industry-standard 	data-security
protocols to protect and safeguard Moser’s Private Information;
• 	adequately monitor the security of its networks and systems;
• 	detect and prevent unauthorized access to Moser’s Private Information;
• 	remove or delete Private Information when allowed to under the law; and
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 55 of 66 - Page ID #
<pageID>

56
• 	timely and adequately notify Moser about the occurrence and scope of the data
breach.
Filing No. 63 at 65-71, ¶¶ 283-316. As a result of Sav-Rx’s alleged negligence, Moser
claims the following harm:
• 	actual fraud and identity theft;
• 	the loss of the opportunity to control how her Private Information is used;
• 	the compromise, publication, or theft of her Private Information;
• 	out-of-pocket expenses associated with the prevention, detection, and recovery from
identity theft, fraud, or unauthorized use of their Private Information;
• 	loss of productivity and lost opportunity costs associated with addressing and
attempting to mitigate the present and continuing consequences of the data breach,
including but not limited to efforts spent researching how to prevent, detect, contest,
and recover from fraud and identity theft;
• 	costs associated with placing freezes on credit reports;
• 	the continued risk and substantially increased risk to her Private Information, which
remains in Sav-Rx’s possession and is subject to further unauthorized disclosures
so long as it fails to undertake appropriate and adequate measures to protect her
Private Information;
• 	present and continuing costs in terms of time, effort, and money that has been and
will be expended to prevent, detect, contest, and repair the impact of the data breach
for the rest of her life;
• 	the diminution in value of her Private Information; and
• 	overpayment for the services that were received without adequate data security.
Filing No. 63 at 6-7, 70, ¶¶ 25, 313; see also Filing No. 63 at 73-74, ¶ 334 (Negligence Per
Se). Moser requests actual, consequential, and nominal damages. In addition, the amended
complaint seeks recovery for other forms of injury or harm due to Sav-Rx’s negligence,
including for economic losses, loss of privacy, and emotional distress. Filing No. 63 at 70,
¶ 314.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 56 of 66 - Page ID #
<pageID>

57
Although Sav-Rx argues the amended complaint fails to allege negligence with
sufficient specificity, when considered with paragraphs 181 and 182, incorporated by
reference into the claim entitled “Negligence,” the amended complaint sufficiently states
Sav-Rx breached duties to safeguard Moser’s Private Information in its possession.
Sav-Rx argues the economic loss doctrine bars Moser’s negligence claim. Filing
No. 76 at 14. The doctrine bars negligence claims seeking only economic damages for
violating a duty imposed by contract. See Lesiak v. Cent. Valley Ag Co-op., Inc., 808
N.W.2d 67, 83 (Neb. 2012); Dittman v. UPMC, 196 A.3d 1036, 1054 (Pa. Sup. Ct. 2018).
Moser argues that since her negligence action demands damages for not only economic
losses, but also for emotional distress and loss of privacy, it is not subject to the economic
loss doctrine. Filing No. 73 at 19-21. But in response, Sav-Rx argues Moser cannot sidestep
the economic-loss doctrine by simply alleging she sustained noneconomic damages from
her actual or threatened economic injuries.
Moser alleges she experiences fear, anxiety, and emotional distress because her PII,
and that of her children, may be used to commit identity theft or engage in fraudulent
transactions in her/their name. Both Nebraska and Pennsylvania have consistently denied
recovery of emotional-distress damages in a negligence case without a showing that the
distress arose from an actual personal injury, a threatened personal injury while in a zone
of danger, or bystander injury from witnessing the serious physical injury or death of a
loved one. See Catron v. Lewis, 712 N.W.2d 245, 248 (Neb. 2006); James v. Lieb, 375
N.W.2d 109 (Neb. 1985); Shumosky v. Lutheran Welfare Servs. of Ne. PA, Inc., 784 A.2d
196, 199 (Pa. Super. Ct. 2001); Rolla v. Westmoreland Health Sys., 651 A.2d 160, 163 (Pa.
Super. 1994). There is no reason to believe either state is now poised to extend emotional
distress recovery to negligence actions alleging harm to only property—in this case, a
plaintiff’s Private Information—particularly in the absence of actual fraudulent use of that
information or factual allegations supporting a finding of severe emotional distress.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 57 of 66 - Page ID #
<pageID>

58
Moser also demands recovery for loss of privacy as a noneconomic element of
damages. She does not cite to, and this Court has not found, any legal authority stating a
plaintiff can recover for loss of privacy as an element of damages in a negligence action.
Canon, 2022 WL 22248656, at *8. Moreover, if alleged as an independent tort, “loss of
privacy” requires proof of intent. See Kaiser v. W. R/C Flyers, Inc., 477 N.W.2d 557, 562
(Neb. 1991); Harris by Harris v. Easton Pub. Co., 483 A.2d 1377, 1383 (Pa. Super. 1984).
It is unlikely the Nebraska and Pennsylvania courts would permit recovery for loss of
privacy as an element of damages in a negligence action where proof of intent is necessary
to recover the same damages if filed as a separate tort claim.
The economic-loss rule applies when the defendant’s duty arises in contract and the
plaintiff’s damages arise from economic loss. In either Nebraska or Pennsylvania,
emotional harm and loss of privacy are not elements of damages recoverable in a
negligence action for economic losses unaccompanied by physical harm. Permitting a
plaintiff to simply plead these damages in an economic injury action as a means of avoiding
the economic-loss rule would effectively swallow the rule. See Mohsen v. Veridian Credit
Union, 733 F. Supp. 3d 754, 767 (N.D. Iowa 2024). After removing the emotional-distress
and loss-of-privacy damage requests from Moser’s negligence claim, what remains is a
claim seeking damages for economic loss only. But under the facts alleged, the amended
complaint does not state an implied contract claim against Sav-Rx. So, any duties breached
by Sav-Rx did not arise in contract and the economic-loss doctrine is inapplicable.
Moreover, even if Moser is granted leave and can amend the complaint to state an implied-
contract claim, she is allowed to plead in the alternative at this early stage of litigation.
Regardless of the theory of recovery, “the Court has little difficulty in concluding
that having gathered the plaintiff’s PII, the defendant had a legal duty . . . to take reasonable
care to secure it.” Weisenberger, 597 F. Supp. 3d at 1361. The amended complaint
sufficiently states a negligence claim, that claim is not precluded by Nebraska’s economic-
loss doctrine, and the motion to dismiss the negligence claim will be denied.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 58 of 66 - Page ID #
<pageID>

59
6. 	Negligence Per Se
In support of the claim entitled “Negligence Per Se,” the amended complaint alleges
Sav-Rx breached its duty to secure and safeguard Moser’s Private Information by violating
Section 5 of the FTC Act; the guidelines within the FTC publication, “Protecting Personal
Information: A Guide for Business,” which established cyber-security standards for
businesses; the HIPAA Privacy and Security Rules; and state consumer-protection statutes.
It alleges that as result of this negligence, Moser has and will suffer harm and the risk of
future harm described in her negligence claim, for which she seeks actual, consequential,
and nominal damages. Filing No. 63 at 70-75, ¶¶ 317-337.
“[T]he violation of a regulation or statute is not negligence per se but may be
evidence of negligence to be considered with all the other evidence in the case.” Scheele v.
Rains, 874 N.W.2d 867, 873 (Neb. 2016); In re Rutter’s Inc. Data Sec. Breach Litig., 511
F. Supp. 3d 514, 531 (M.D. Pa. 2021) (explaining that under Pennsylvania law, negligence
per se is not an independent basis of tort liability, but statutory references may evidence
the standard of care appropriate to the underlying tort). A violation of the FTC Act and
HIPAA is evidence of a violation of the standard of care, but it cannot serve as bases for
negligence-per-se claims. See Weisenberger, 597 F. Supp. 3d at 1362-63; Zimmerman, 780
F. Supp. 3d at 603 (holding Pennsylvania does not recognize a claim for negligence per se
based on statutes without a private right of action, and neither the FTC nor HIPAA provides
for private causes of action).
Moser has failed to state a claim for recovery under a theory of negligence per se.
7. 	Invasion of Privacy/Intrusion upon Seclusion
In support of the claim for Invasion of Privacy/Intrusion of Seclusion, the amended
complaint states Moser has a legitimate expectation of privacy in her Private Information,
and reasonably expected Sav-Rx would not disclose it without authorization. Moser alleges
Sav-Rx “acted with a knowing state of mind when it permitted the Data Breach to occur
because it knew or should have known that its data security practices were inadequate,”
(Filing No. 63 at 76, ¶ 348), such that Sav-Rx’s inadequate data-security practices, polices,
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 59 of 66 - Page ID #
<pageID>

60
and procedures, and the resulting data breach constitute “intentional interference” with her
interest in solitude or seclusion, either as to her person or as to her private affairs or
concerns. (Filing No. 63 at 76, ¶ 347). Moser claims Sav-Rx intentionally misused or
disclosed Private Information without informed, voluntary, affirmative, and clear consent,
Filing No. 63 at 75, ¶ 344, as follows:
• 	intentionally and substantially intruding into private affairs in a manner that
identifies Moser and that would be highly offensive and objectionable to an ordinary
person;
• 	intentionally publicizing private facts, which is highly offensive and objectionable
to an ordinary person; and
• 	intentionally causing anguish or suffering.
Filing No. 63 at 77, ¶ 351. The amended complaint seeks damages and/or injunctive relief
for mental distress, and interference with reasonable expectations of privacy. Filing No. 63
at 77, 354-355.
Under Nebraska law, “[a]ny person, firm, or corporation that trespasses or intrudes
upon any natural person in his or her place of solitude or seclusion, if the intrusion would
be highly offensive to a reasonable person, shall be liable for invasion of privacy.” Neb.
Rev. Stat. Ann. § 20-203. Invasion of privacy under § 20-203 is narrowly construed as
applying solely to intentional interference with the plaintiff’s “interest in solitude or
seclusion, either as to [her] person or as to [her] private affairs or concerns, of a kind that
would be highly offensive to a reasonable [person].” Kaiser, 477 N.W.2d at 562 (quoting
Restatement (Second) of Torts § 652 at 378 cmt. a); see also Easton Pub. Co., 483 A.2d at
1383 (relying on Restatement (Second) of Torts § 652 and stating it is “well established in
Pennsylvania that a violation of the right of privacy is an actionable tort”)
The amended complaint alleges Sav-Rx failed to provide adequate data security
when it knew or should have known that its practices were inadequate, and that Sav-Rx
acted or failed to act intentionally, paraphrasing the elements of the invasion-of-privacy
tort and parroting language in Kaiser. While Federal Rule of Civil Procedure Rule 9(b)
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 60 of 66 - Page ID #
<pageID>

61
allows intent and knowledge to be alleged generally, it merely excuses pleading intent
under an elevated pleading standard applicable to Rule 9(a); e.g., fraud cases. Rule 9(b)
does not give a plaintiff license to evade the less rigid—though still operative—pleading
requirements of Rule 8. OmegaGenesis Corp. v. Mayo Found. for Med. Educ. & Rsch., 851
F.3d 800, 804 (8th Cir. 2017) (citing Iqbal, 556 U.S. at 686-87). Moser must allege facts
to support an allegation of intent.
Alleging the defendant knew better than to configure its security the way it did, or
“intentionally failed to keep Plaintiff’s PII safe,” falls short of a plausible allegation that
Sav-Rx intentionally intruded upon Moser’s privacy. See In re MOVEit Customer Data
Sec. Breach Litig., No. 23-MD-3083-ADB-PGL, 2025 WL 2179475, at *14 (D. Mass.
July 31, 2025) (citing Andersen v. Oak View Grp., LLC, No. 24-cv-00719, 2024 WL
5426654, at *5 (C.D. Cal. Nov. 22, 2024)). The amended complaint alleges no facts to
support Moser’s conclusory claim that Sav-Rx intentionally intruded into her private
affairs, intentionally publicized her Private Information, or intentionally caused her harm.
Where the plaintiff alleges data exposure was due to the conduct of third-party hackers, the
plaintiff has failed to state a claim for intentional public disclosure of private information
by the defendant. See id. at *13.
The amended complaint therefore fails to state a claim for invasion of privacy.
8. 	Pennsylvania Unfair Trade Practices and Consumer Protection
Law
In support of her claim under the UTPCPL, Moser alleges Sav-Rx conducts trade
and commerce in Pennsylvania by selling and performing services therein, and it makes
explicit statements and promises that Private Information in its possession will remain
secure. She claims Sav-Rx violated the UTPCPL by failing to implement and maintain
reasonable data-security measures, resulting in the unauthorized disclosure and disclosure
of 	her 	Private 	Information. 	Moser 	claims 	Sav-Rx 	misrepresented 	the 	protective
characteristics, and the standard, quality, or grade of its data security, advertised its services
with the intent not to sell them as advertised, and engaged in other fraudulent or deceptive
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 61 of 66 - Page ID #
<pageID>

62
conduct that created a likelihood of confusion. She alleges Sav-Rx’s failure to adopt
reasonable practices in protecting and safeguarding Private Information places her at a
higher risk of identity theft and other crimes, requiring her to spend time and/or money on
threat-mitigation efforts. Moser claims the harm to her outweighs any justifications or
motives for Sav-Rx’s practice of collecting and storing Private Information without
reasonable data security.
As a result of Sav-Rx’s violations of the UTPCPL, Moser alleges she has and will
suffer injury, including, but not limited to: (i) a substantially increased or imminent risk of
identity theft, and associated expenditures of time and money for protective and remedial
services; (ii) improper disclosure of Private Information; (iii) breach of the confidentiality
of Private Information; (iv) deprivation of the value of his Private Information; (v) lost
time and money incurred to mitigate and remediate the effects of the data breach, including
the 	cost 	of 	future 	credit 	monitoring 	and 	identity 	theft 	protection 	products; 	and
(vii) overpayment for the inadequate data security. Pursuant to 73 P.S. § 201-9.2(a), Moser
seeks actual damages, $100, or three times their actual damages, whichever is greatest, plus
costs and attorney fees. Filing No. 63 at 93-96, ¶¶ 453-466.
Sav-Rx argues Moser’s information was provided to Sav-Rx by her health plan, not
her, she cannot claim justifiable reliance, and she has not alleged an ascertainable loss.
Filing No. 70 at 38-40. Plaintiff argues she “need only allege facts that plausibly support
an inference of reliance,” which she did by alleging that, “[a]s a condition of obtaining
medication benefit management services from [Sav-Rx], Plaintiff Moser and her minor
children were required to provide their PII and PHI to [Sav-Rx],” and she “would not have
entrusted her or her children’s PII or PHI to [Sav-Rx] had she known of [its] lax data
security practices.” Filing No. 73 at 35 (quoting Filing No. 63 at 15, ¶¶ 68, 71). She further
disputes Sav-Rx’s argument that she alleges “only a potential prospective monetary loss,”
explaining she also alleges lost or diminished value of her PII and PHI, and lost benefit of
her bargain, both of which are ascertainable damages under the UTPCPL. Filing No. 73 at
36-37.
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 62 of 66 - Page ID #
<pageID>

63
The UTPCPL provides a private cause of action to “[a]ny person who purchases or
leases goods or services primarily for personal, family or household purposes and thereby
suffers any ascertainable loss of money or property, real or personal, as a result of the use
or employment by any person of a method, act or practice declared unlawful” by the statute.
3 Pa. Stat. Ann. § 201-9.2. To maintain a private right of action under the UTPCPL, Moser
must allege facts showing she justifiably relied on the defendant’s wrongful conduct or
representation and suffered harm because of that reliance. See In re Blackbaud, Inc.,
Customer Data Breach Litig., No. 3:20-MN-02972-JMC, 2021 WL 3568394, at *14
(D.S.C. Aug. 12, 2021) (citing Yocca v. Pittsburgh Steelers Sports, Inc., 854 A.2d 425, 438
(Pa. 2004); Rutter’s, 511 F. Supp. 3d at 542 (citing Pennsylvania law).
As in this case, the plaintiff in Blackbaud claimed she “was required to provide her
PHI to her health care provider as a predicate to receiving health care services[,]” her PHI
“was in turn provided to Blackbaud to be held for safekeeping[,]” and she suffered injuries
as a result of her ‘reliance’ on Blackbaud’s misrepresentations and omissions.” Blackbaud,
2021 WL 3568394, at *14. The court found the complaint was “bereft of allegations
suggesting that [the plaintiff] knew that Blackbaud maintained her data or was exposed to
representations Blackbaud made to her or her health care provider,” and it dismissed her
UTPCPL claim. Id. Similarly, Rutter’s explained “a single, conclusory allegation that
‘Plaintiffs relied on [a defendant’s] misrepresentations and omissions relating to its data
privacy and security,’ and that the plaintiff disclosed private information ‘with the
reasonable expectation that [the defendant] would comply with its obligations to keep the
[private] information confidential and would secure it from unauthorized access’” is too
conclusory to state a UTPCPL claim. Rutter’s, 511 F. Supp. 3d at 542. Where there is no
allegation that the plaintiff actually viewed the defendant’s privacy policy, or that she relied
on it before deciding to disclose her Private Information, she has failed to allege justifiable
reliance. See MOVEit, 2025 WL 2179475, at *47.
“It is the plaintiff’s burden to prove justifiable reliance in the complaint.” Riviello v.
Chase Bank USA, N.A., No. 3:19-CV-0510, 2020 WL 1129956, at *4 (M.D. Pa. Mar. 4,
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 63 of 66 - Page ID #
<pageID>

64
2020) (citing Weinberg v. Sun Co., Inc., 777 A.2d 442, 446 (Pa. 2001)). Moser must
specifically plead her reliance on alleged misrepresentations by Sav-Rx. She has failed to
allege that before disclosing her information, she read or heard any Sav-Rx statements
regarding its data-security policies, or that prior to the breach, she even knew the
information was in Sav-Rx’s possession. She has therefore failed to state a claim that she
relied, to her detriment, on Sav-Rx representations regarding its commitment to safeguard
her Private Information.
Moser may be attempting to argue that rather than an affirmative misrepresentation
of Sav-Rx data-security policies, she assumed by Sav-Rx’s silence that it would keep the
data secure; that Sav-Rx’s silence when it had a duty to speak was a misrepresentation by
omission. This interpretation of the UTPCP has been soundly rejected because it assumes
a duty to speak. “[H]olders of customer data, without more, do not owe a duty to disclose
alleged shortcomings in their cybersecurity programs.” MOVEit, 2025 WL 2179475, at *48
(citing Rutter’s, 511 F. Supp. 3d at 544 n. 12). While a defendant owes a legal duty to
safeguard personal data, “it does not follow that ‘the duty necessarily extends to alerting
customers as to the potential activities of future third-party hackers’ or the defendant’s
potential vulnerability thereto.” Id.; see also Blackbaud, 2021 WL 3568394, at *15.
Moser has also failed to allege damages as required under the UTPCPL. “An actual
loss of money or property must have occurred to state a cognizable UTPCPL claim.”
Allen v. Wells Fargo, N.A., No. CV 14-5283, 2015 WL 5137953, at *8 (E.D. Pa. Aug. 28,
2015). Costs associated with a data breach must constitute an “ascertainable loss,” and
merely alleging the plaintiff spent time to mitigate any losses, without alleging actual
money was spent, is not sufficient to state a UTPCPL claim. Opris v. Sincera Reprod. Med.,
No. CV 21-3072, 2022 WL 1639417, at *13 (E.D. Pa. May 24, 2022) (citing Rutter’s, 511
F. Supp. 3d at 541).
The global allegations of the amended complaint state, “Plaintiffs . . . have already
incurred—and will continue to incur—out-of-pocket costs for, inter alia, purchasing credit
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 64 of 66 - Page ID #
<pageID>

65
monitoring services, credit freezes, credit reports, or other protective measures to deter and
detect identity theft,” (Filing No. 63 at 7, ¶ 29), but Moser’s plaintiff-specific allegations
contain no such representations, and certainly no dollar amounts indicating what, if
anything, was spent. Filing No. 63 at 14-17 ¶¶ 66-83. See SuperValu II, 925 F.3d at 964-65
(dismissing Illinois consumer-protection claim where the plaintiff failed to allege any
actual monetary loss from the fraudulent use of his stolen credit-card data).
Moser’s briefing compounds the uncertainty. She does not deny Sav-Rx’s claim that
Moser “has not alleged any ascertainable loss, only a potential prospective monetary loss.”
Filing No. 70 at 40. Instead, she argues Sav-Rx “ignores” the plaintiffs’ “other allegations,
including that their injuries included ‘lost or diminished value of their PII and PHI.’” Filing
No. 73 at 36. Due to the lack of specificity in the amended complaint, and the mixed
messages between the amended complaint and Moser’s briefing, the Court cannot tell if
Moser spent anything on mitigation efforts. That fact alone evidences her failure to
adequately allege ascertainable losses as required under UTPCPL. And while she attempts
to pivot by asking the Court to consider the lost value of her Private Information and her
lost benefit of the bargain as actual damages compensable under the UTPCPL, this Court‘s
prior discussion (see infra at 17-20), has rejected these theories for damage recovery. See
also Rutter’s, 511 F. Supp. 3d at 541 n. 11 (rejecting lost “benefit of the bargain” as
damages under the UTPCPL).
Having failed to allege damages or reliance on any misrepresentations as required
to allege a UTPCPL claim, Moser has failed to state a claim for recovery under that statute.
The UTPCPL claim will be dismissed.
IV. 	CONCLUSION
All claims by Prestby, Summerville, Geerhart, Krueger, Schrieo, Sutherlin, on
behalf of herself and her minor children, and Moser’s minor children will be dismissed
under Rule 12(b)(1) for lack of standing. Any requests for injunctive and declaratory relief
by Moser will be dismissed for lack of standing. Moser’s negligence claim for damages
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 65 of 66 - Page ID #
<pageID>

66
will not be dismissed. All other claims by Moser will be dismissed under Rule 12(b)(6) for
failure to state a claim.
Accordingly,
IT IS ORDERED:
1. 	Defendant A&A Services, LLC’s motion to dismiss (Filing No. 69) is
granted in part and denied in part as set forth in this Memorandum and Order.
2. 	The 	claims 	of 	plaintiffs 	David 	Prestby; 	Derek 	Summerville; 	Connor
Geerhart; Heather Krueger; Sean Schrieo; Tiffany Sutherlin, on behalf of
herself and her minor children; and Samantha Moser’s minor children are
dismissed under Federal Rule of Civil Procedure 12(b)(1) for lack of
standing.
3. 	Moser’s requests for injunctive and declaratory relief are likewise dismissed
under Rule 12(b)(1) for lack of standing.
4. 	The Rule 12(b)(6) motion to dismiss Moser’s negligence claim for damages
is denied, but all other claims by Moser are dismissed under Rule 12(b)(6)
for failure to state a claim upon which relief may be granted.
Dated this 5th day of January 2026.
BY THE COURT:
Robert F. Rossiter, Jr.
Chief United States District Judge
8:24-cv-00204-RFR-RCC Doc # 77 Filed: 01/05/26 Page 66 of 66 - Page ID #
<pageID>