Retzolff v. Jacobs Entertainment, Inc.

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLORADO
Judge Philip A. Brimmer
Civil Action No. 24-cv-03538-PAB-KAS
STEPHANIE RETZOLFF, individually and on behalf of all others similarly situated,
Plaintiff,
v.
JACOBS ENTERTAINMENT, INC.,
Defendant.
ORDER
This matter comes before the Court on Defendant Jacobs Entertainment, Inc.’s
Motion to Dismiss Plaintiff’s Amended Class Action Complaint [Docket No. 54]. Plaintiff
Stephanie Retzolff filed a response. Docket No. 55. Defendant Jacobs Entertainment,
Inc. (“JEI”) filed a reply. The Court has jurisdiction pursuant to 28 U.S.C. § 1332.
I. 	FACTS 1
Defendant is a gaming, hospitality, and entertainment company. Docket No. 52
at 5, ¶ 26. Defendant collected, stored, and maintained private information 2 of plaintiff
and class members on its network. Id., ¶ 28. In order to receive services or
employment from defendant, plaintiff and class members were required by defendant to
1 The well-pleaded facts below are taken from plaintiff’s amended complaint,
Docket No. 52, and are presumed to be true for purposes of ruling on defendant’s
motions to dismiss. See Brown v. Montoya, 662 F.3d 1152, 1162 (10th Cir. 2011).
2 The amended complaint defines “personal information” to include names, dates
of birth, email addresses, physical addresses, Social Security numbers, and financial
account information. See Docket No. 52 at 2, ¶ 3.
Case No. 1:24-cv-03538-PAB-KAS Document 57 filed 09/21/26 USDC Colorado
pg 1 of 17

2
provide their private information. 	Id., ¶ 27. Plaintiff was employed by defendant
between June 2020 and June 2022. Id. at 26, ¶ 108. In order to receive employment,
plaintiff provided defendant with her private information including her name, date of
birth, Social Security number, email address, physical address, phone number, and
financial account information. Id., ¶ 109.
Plaintiff and class members entrusted their private information to defendant. Id.
at 7, ¶ 34. Plaintiff and class members relied on defendant to keep their private
information confidential and securely maintained, to use the information for business
purposes only, and to only make authorized disclosures of this information. Id. at 6,
¶ 31.
On September 23, 2024, defendant discovered that an unknown hacker gained
access to defendant’s systems and acquired certain files and information, including
plaintiff and class members’ private information. Id. at 7, ¶ 37. Unauthorized actors
gained access to defendant’s system as early as July 4, 2023 and began posting stolen
data for sale the next day. Id, ¶ 38. By September 2024, employee login credentials
from defendant were published on the dark web. Id.at 8, ¶ 39. These included
credentials from plaintiff’s former place of employment. Id., ¶ 40. Plaintiff’s and class
members’ personal information remains for sale on the dark web. Id. at 31, ¶ 131. On
April 29, 2025, two large samples of data were posted on the dark web, claiming to be
from “gaming companies.” Id., ¶ 135 (internal quotation omitted). Plaintiff’s private
information was in the data dump. Id. The data dump on the dark web also claimed to
be related to gaming employees in Nevada and Colorado. Id. at 26, 30, ¶¶ 111, 130.
Case No. 1:24-cv-03538-PAB-KAS Document 57 filed 09/21/26 USDC Colorado
pg 2 of 17

3
On October 7, 2024, defendant concluded its investigation of the data breach.
Id. at 9, ¶ 47. Defendant notified class members a month later. Id., ¶ 48. On or around
November 6, 2024, plaintiff received notice of the data breach. Id. at 26, ¶ 110. The
notice informed plaintiff that her name and Social Security number were exposed in the
data breach, along with other personal information that was not identified. Id.
Plaintiff began receiving suspicions calls asking for another person, attempting to
gain information from plaintiff. Id. at 26-27, ¶ 112. Plaintiff also received a text
message from Venmo with a login code for her Venmo account. Id. at 27, ¶ 113.
Plaintiff was not attempting to login to Venmo at that time. Id. Plaintiff experienced
three unauthorized charges on her Cash App account, each totaling approximately
$20.00. Id., ¶ 114. Plaintiff began receiving an extreme amount of spam emails, forcing
her to get a new email address. Id., ¶ 115. Plaintiff has spent over 20 hours dealing
with the consequences of the data breach, including verifying the legitimacy of the
notice of the data breach, reviewing credit reports, and mitigating fraud and identity
theft. Id. at 27-28, ¶ 117.
II. 	LEGAL STANDARD
A. 	Rule 12(b)(1)
Dismissal pursuant to Federal Rule of Civil Procedure 12(b)(1) is appropriate if
the Court lacks subject matter jurisdiction over claims for relief asserted in the
complaint. Rule 12(b)(1) challenges are generally presented in one of two forms: “[t]he
moving party may (1) facially attack the complaint’s allegations as to the existence of
subject matter jurisdiction, or (2) go beyond allegations contained in the complaint by
presenting evidence to challenge the factual basis upon which subject matter
jurisdiction rests.” Merrill Lynch Bus. Fin. Servs., Inc. v. Nudell, 363 F.3d 1072, 1074
Case No. 1:24-cv-03538-PAB-KAS Document 57 filed 09/21/26 USDC Colorado
pg 3 of 17

4
(10th Cir. 2004) (quoting Maestas v. Lujan, 351 F.3d 1001, 1013 (10th Cir. 2003)).
Ultimately, plaintiff has “[t]he burden of establishing subject matter jurisdiction” because
he is “the party asserting jurisdiction.” Port City Props. v. Union Pac. R.R. Co., 518 F.3d
1186, 1189 (10th Cir. 2008).
B. Rule 12(b)(6)
To survive a motion to dismiss under Rule 12(b)(6) of the Federal Rules of Civil
Procedure, a complaint must allege enough factual matter that, taken as true, makes
the plaintiff’s “claim to relief . . . plausible on its face.” Khalik v. United Air Lines, 671
F.3d 1188, 1190 (10th Cir. 2012) (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570
(2007)). “The ‘plausibility’ standard requires that relief must plausibly follow from the
facts alleged, not that the facts themselves be plausible.” RE/MAX, LLC v. Quicken
Loans Inc., 295 F. Supp. 3d 1163, 1168 (D. Colo. 2018) (citing Bryson v. Gonzales, 534
F.3d 1282, 1286 (10th Cir. 2008)). Generally, “[s]pecific facts are not necessary; the
statement need only ‘give the defendant fair notice of what the claim is and the grounds
upon which it rests.’” Erickson v. Pardus, 551 U.S. 89, 93 (2007) (per curiam) (quoting
Twombly, 550 U.S. at 555) (alterations omitted). A court, however, does not need to
accept conclusory allegations. See, e.g., Hackford v. Babbit, 14 F.3d 1457, 1465 (10th
Cir. 1994) (“we are not bound by conclusory allegations, unwarranted inferences, or
legal conclusions”).
“[W]here the well-pleaded facts do not permit the court to infer more than the
mere possibility of misconduct, the complaint has alleged – but it has not shown – that
the pleader is entitled to relief.” Ashcroft v. Iqbal, 556 U.S. 662, 679 (2009) (quotations
and alterations omitted); see also Khalik, 671 F.3d at 1190 (“A plaintiff must nudge [his]
Case No. 1:24-cv-03538-PAB-KAS Document 57 filed 09/21/26 USDC Colorado
pg 4 of 17

5
claims across the line from conceivable to plausible in order to survive a motion to
dismiss.” (quoting Twombly, 550 U.S. at 570)). If a complaint’s allegations are “so
general that they encompass a wide swath of conduct, much of it innocent,” then
plaintiff has not stated a plausible claim. Khalik, 671 F.3d at 1191 (quotations omitted).
Thus, even though modern rules of pleading are somewhat forgiving, “a complaint still
must contain either direct or inferential allegations respecting all the material elements
necessary to sustain a recovery under some viable legal theory.” Bryson, 534 F.3d at
1286 (alterations omitted).
“To obtain dismissal at the Rule 12(b)(6) stage based on the statute of
limitations, the allegations on the face of the complaint surrounding the date of accrual
must ‘make clear that the right sued upon has been extinguished.’” Herrera v. City of
Espanola, 32 F.4th 980, 991 (10th Cir. 2022) (citation omitted).
III. 	ANALYSIS
Plaintiff asserts the following claims: (1) Negligence; (2) Breach of Implied
Contract; (3) Unjust Enrichment; and (4) Declaratory Judgment. Docket No. 52 at 48-
60. Defendant moves to dismiss plaintiff’s claims pursuant to Rule 12(b)(1) and Rule
12(b)(6). Docket No. 54.
A. Article III Standing
Pursuant to Rule 12(b)(1), defendant argues that plaintiff lacks Article III standing
because she has not plausibly alleged an injury in fact or that such injury in fact was
fairly traceable to defendant’s conduct. See id. at 3-10.
To establish Article III standing, a plaintiff must allege “that (1) he or she has
suffered an injury in fact; (2) there is a causal connection between the injury and the
Case No. 1:24-cv-03538-PAB-KAS Document 57 filed 09/21/26 USDC Colorado
pg 5 of 17

6
conduct complained of; and (3) it is likely that the injury will be redressed by a favorable
decision.” Ward v. Utah, 321 F.3d 1263, 1266 (10th Cir. 2003) (quoting Phelps v.
Hamilton, 122 F.3d 1309, 1326 (10th Cir. 1997)). In order to demonstrate the first
element of standing, a plaintiff must show that she has “suffered an injury in fact – an
invasion of a legally protected interest which is (a) concrete and particularized, and (b)
actual or imminent, not conjectural or hypothetical.” Lujan v. Defenders of Wildlife, 504
U.S. 555, 560-61 (1992) (internal quotations and citations omitted); see also Spokeo,
Inc. v. Robins, 578 U.S. 330, 339 (2016) (“Injury in fact is a constitutional requirement.”).
An injury is particularized if it affects the plaintiff in “a personal and individual way.”
Spokeo, 578 U.S. at 339 (citation omitted). “A ‘concrete’ injury must be ‘de facto’; that
is, it must actually exist;” it must be “real,” not “abstract.” Id. at 340. Furthermore, “[a]
federal court’s jurisdiction . . . can be invoked only when the plaintiff himself has
suffered ‘some threatened or actual injury.’” Warth v. Seldin, 422 U.S. 490, 499 (1975)
(quoting Linda R.S. v. Richard D., 410 U.S. 614, 617 (1973)).
“In a suit premised on the mere risk of future harm – that is, where the alleged
injury-in-fact is imminent rather than actual – we must also consider the type of relief
sought.” Owen-Brooks v. DISH Network Corp., No. 23-cv-01168-RMR-SBP, 2024 WL
4338133, at *5 (D. Colo. Aug. 23, 2024), report and recommendation adopted, 2024 WL
4333660 (D. Colo. Sept. 27, 2024) (citation omitted). In a suit for damages, a risk of
future harm alone does not confer standing. See TransUnion LLC v. Ramirez, 594 U.S.
413, 436 (2021) (finding “persuasive” TransUnion’s argument that, “in a suit for
damages, the mere risk of future harm, standing alone, cannot qualify as a concrete
harm – at least unless the exposure to the risk of future harm itself causes a separate
Case No. 1:24-cv-03538-PAB-KAS Document 57 filed 09/21/26 USDC Colorado
pg 6 of 17

7
concrete harm”); Owen-Brooks, 2024 WL 4338133, at *5 (“for damages based only on a
risk of future harm, the plaintiff must allege some additional, currently felt concrete
harms for standing”) (internal quotation omitted). On the other hand, “a person exposed
to a risk of future harm may pursue forward-looking, injunctive relief to prevent the harm
from occurring, at least so long as the risk of harm is sufficiently imminent and
substantial.” See TransUnion, 594 U.S. at 435. “[A] plaintiff must demonstrate standing
separately for each form of relief sought.” Friends of the Earth, Inc. v. Laidlaw Env’t
Servs. (TOC), Inc., 528 U.S. 167, 185 (2000). Here, plaintiff seeks damages and
injunctive relief. See Docket No. 52 at 60-62.
The Court begins by analyzing whether plaintiff has alleged that she suffered a
concrete injury that provides standing for plaintiff to seek damages. In order for
plaintiff’s harm to be concrete, it must have “a close relationship to a harm traditionally
recognized as providing a basis for a lawsuit in American courts.” See TransUnion, 594
U.S. at 417 (internal quotations and citation omitted). This inquiry “asks whether
plaintiffs have identified a close historical or common-law analogue for their asserted
injury.” Id. at 414.
“[D]isclosure of private information” is a traditionally recognized harm in common
law. See id. at 425. However, “only sensitive personal information falls within the
scope” of this tort. Holmes v. Elephant Ins. Co., 156 F.4th 413, 424 (4th Cir. 2025).
Furthermore, this tort “is only implicated when the sharing is so broad that it reaches, or
is sure to reach, the public.” Id. (internal quotation and citation omitted). In the context
of personal information that is the target of a data breach, Holmes held that “the public
disclosure of private information tort makes concrete the intangible harm suffered when
Case No. 1:24-cv-03538-PAB-KAS Document 57 filed 09/21/26 USDC Colorado
pg 7 of 17

8
information that the plaintiff would justifiably prefer to tightly control is released into the
open.” Id. at 425. “Though the information need not be embarrassing or salacious, the
plaintiff must have good reason to keep it close to the vest. And though the information
need not be broadcast to the whole world, it must be accessible to many.” Id.
The Court finds that plaintiff’s personal information, which includes at least her
name and Social Security number, constitutes private information that implicates the
tort. This sensitive personal information was publicly disclosed when it was published
on the dark web for sale. See Docket No. 52 at 31, ¶ 131. As held by Holmes,
The dark web, an anonymous online network for unregulated content and
markets, is not a traditional method of communicating information like a
newspaper or radio broadcast. But, not dissimilar to the internet more generally,
it is a forum accessible to all – or at least to those with some degree of
proficiency with computers. Information listed on it thus either “reaches, or is
sure to reach, the public,” or is close to doing so.
156 F.4th at 426 (citation omitted). The Court agrees with the reasoning of Holmes and
finds that, by alleging that her personal sensitive information was published on the dark
web, plaintiff has plausibly alleged “a concrete injury in the eyes of Article III.” Id.
Therefore, plaintiff has alleged a concrete harm that provides a basis for damages. Id.
(“[Plaintiffs] have had their driver’s license numbers listed on the dark web against their
justifiable wishes. Under TransUnion, they have suffered a concrete injury. And
because that injury has already come to pass, it gives them standing to seek
damages.”).
The Court also finds that the publication of plaintiff’s private sensitive information
on the dark web is fairly traceable to the data breach. Plaintiff alleges that the data
breach occurred as early as July 4, 2023 and, the next day, cybercriminals began
publishing information obtained from the data breach on the dark web. Docket No. 52
Case No. 1:24-cv-03538-PAB-KAS Document 57 filed 09/21/26 USDC Colorado
pg 8 of 17

9
at 7, ¶ 38. By September 2024, employee credentials from defendants were published
on the dark web. Id. at 8, ¶ 39. These included credentials from plaintiff’s former place
of employment. Id., ¶ 40. By April 29, 2025, two large samples of data, claiming to
come from “gaming” companies, were published and included plaintiff’s personal
information. Id. at 31, ¶ 135. Defendant does not argue that the publication of plaintiff’s
personal information was not fairly traceable to the data breach. See Docket No. 54 at
7-10.
Accordingly, the Court finds that plaintiff has alleged a concrete harm based on
the publication of her personal information on the dark web that supports her relief for
damages.
The Court turns to plaintiff’s claim for injunctive relief based on a risk of future
harm, which requires plaintiff to plausibly allege that the risk is sufficiently imminent and
substantial as to constitute a concrete harm. Plaintiff contends that she faces a
concrete risk of future harm because she is at risk of being a future target of identity
theft and fraud. See Docket No. 55 at 14-15. She argues that the fact her personal
information has been published on the dark web demonstrates that risk is imminent and
substantial. See id. However, this alone is insufficient to establish standing. In
Holmes, the court rejected plaintiffs’ argument that, solely because their information was
published on the dark web, they “are at risk of having their identity further misused as
part of a fraudulent impersonation attempt.” See Holmes, 156 F.4th at 428-32. Given
that “hackers have posted [her] information on the dark web,” plaintiff’s future harm
would “presumably come from the intervening actions of independent malicious actors
who might buy or otherwise obtain [her] compromised numbers.” See id. at 430 (citing
Case No. 1:24-cv-03538-PAB-KAS Document 57 filed 09/21/26 USDC Colorado
pg 9 of 17

10
Clapper v. Amnesty Int’l USA, 568 U.S. 398, 413 (2013)). Plaintiff, however, provides
no other basis, beside the publication of her personal information on the dark web, to
conclude that she faces a concrete risk of identity theft and fraud. See Docket No. 55 at
14-15. Plaintiff’s failure to “allege[] facts that show that those intervening independent
decisionmakers will likely react in predictable ways that will ultimately result in
fraudulent impersonation” or other forms of identity theft means that she offers no more
than a “speculative chain of possibilities.” Holmes, 156 F.4th at 430-31 (internal
quotations omitted) (citing Murthy v. Missouri, 603 U.S. 43, 70 (2024)). This is
insufficient to establish a concrete risk of future harm. As Holmes explained,
[P]laintiffs do not allege anything that suggests that their specific driver’s license
numbers will be acquired by identity thieves off the dark web. To be sure,
hackers list personal information on the dark web in the hope that someone will
buy it. But no particular piece of personal information is guaranteed to be seen
or sold, just as no particular item on Craigslist or eBay is guaranteed to be seen
or sold. Without more, it is unrealistic to assume that identity thieves will
imminently acquire the driver’s license number of any given plaintiff.
156 F.4th at 431 (footnote omitted). Thus, plaintiff’s allegations that her personal
information was misused, as evidenced by spam calls, emails, and unauthorized use of
her Venmo and Cash App, are insufficient to establish a concrete harm where there are
no plausible allegations connecting these events to the data breach.
The Court also rejects plaintiff’s attempts to manufacture standing by alleging
that she spent time mitigating the risk of identity theft and suffered emotional distress
based on such risk. See Docket No. 55 at 15-16; see also Holmes, 156 F.4th at 428
(“And the lack of imminent injury prevents the plaintiffs from bootstrapping their way into
standing for damages solely by expending time or alleging emotional distress.”).
Case No. 1:24-cv-03538-PAB-KAS Document 57 filed 09/21/26 USDC Colorado
pg 10 of 17

11
Accordingly, the Court will dismiss plaintiff’s claim for injunctive relief that is based upon
the risk of future harm, namely, the risk of future identity theft.
B. Whether Plaintiff Fails to State a Claim
Defendant moves to dismiss plaintiff’s claims under Rule 12(b)(6). See Docket
No. 54 at 10.
1. 	Negligence
Defendant argues that plaintiff’s negligence claim fails because defendant did not
owe plaintiff a common law or statutory duty of care. Id. at 10-12. Defendant argues
that there is “no cognizable duty under Colorado common law to safeguard personal
information” and that defendant’s alleged failure to comply with Section 5 of the FTC Act
is insufficient to create a duty. Id. at 11.
Plaintiff responds that the “circumstances of this case support the imposition of a
duty on Defendant to take reasonable steps to safeguard Plaintiff’s Private Information.”
Docket No. 55 at 19. Plaintiff argues that the fact defendant chose to use, store, and
maintain plaintiff’s and class members’ private information, while understanding the
“risks associated with storing such valuable information,” weighs in favor of finding a
duty of care. See id. Plaintiff also argues that the burden placed on defendant to
safeguard plaintiff and class members’ personal information was low and notes that
“Defendant requires Plainitf[f]s to provide the Private Information as a condition of
entering a relationship with Defendant as a customer or employee.” Id.
“[T]he initial question in any negligence action is whether the defendant owed a
legal duty to protect the plaintiff against injury.” HealthONE v. Rodriguez ex rel.
Rodriguez, 50 P.3d 879, 888 (Colo. 2002). “A negligence claim must fail if based on
Case No. 1:24-cv-03538-PAB-KAS Document 57 filed 09/21/26 USDC Colorado
pg 11 of 17

12
circumstances for which the law imposes no duty of care upon the defendant for the
benefit of the plaintiff.” Univ. of Denver v. Whitlock, 744 P.2d 54, 56 (Colo. 1987).
Defendant cites Bellwether Cmty. Credit Union v. Chipotle Mexican Grill, Inc.,
353 F. Supp. 3d 1070 (D. Colo. 2018), where a credit union brought suit against
Chipotle after the credit union’s members’ data was compromised in a Chipotle data
breach. See Docket No. 54 at 11. Bellwether found that, “[b]ecause the source of the
duty is contained in the contract and there is no basis in Colorado statutory or common
law for imposing a duty of care related to data security, Plaintiffs’ claims are barred by
the economic loss doctrine.” 353 F.3d at 1084. Bellwether is distinguishable from this
case because, here, employees of defendant were affected by the data breach. See
Owen-Brooks, 2024 WL 4338133, at *14 (rejecting defendant’s argument that there is
no duty under Colorado common law to protect plaintiffs’ personal information based on
Bellwether because in Bellwether “employees were not involved”).
The Colorado Supreme Court has held that, in cases based on defendant’s
failure to act (i.e., nonfeasance), “the existence of a duty has been recognized only
during the last century in situations involving a limited group of special relationships
between parties,” which includes an employer/employee relationship. N.M. by and
through Lopez v. Trujillo, 397 P.3d 370, 374 (Colo. 2017) (citation omitted). As noted by
Owen-Brooks, however, the “special relationship doctrine” has not been applied in a
case such as this to determine whether an employer has a duty to safeguard an
employee’s personal information. See 2024 WL 4338133, at *14. It is also unclear
whether Colorado law otherwise recognizes this duty outside of a special relationship.
See id. Given that plaintiff is pursuing an implied contract claim, which the Court will not
Case No. 1:24-cv-03538-PAB-KAS Document 57 filed 09/21/26 USDC Colorado
pg 12 of 17

13
dismiss as discussed below, the Court agrees with Owen-Brooks that, at the motion to
dismiss stage, “while Plaintiffs are pursuing both negligence and implied contract claims
concerning the same subject, and no discovery has yet been done to provide a fuller
factual context, this court finds it premature to decide whether Colorado’s law of special
relationship applies and imposes the duty that Plaintiffs assert it does, or whether
Colorado otherwise recognizes such a tort duty.” See id. at *15. Defendant does not
argue that plaintiff has failed to plausibly allege the remaining elements of her
negligence claim, and the Court finds that plaintiff has “sufficiently pled the elements of
negligence to put the Defendants on notice of a negligence claim, which is all that is
needed at this stage.” See Owen-Brooks, 2024 WL 4333660, at *2.
Accordingly, the Court will deny defendant’s motion to dismiss plaintiff’s
negligence claim. 3
2. 	Breach of Implied Contract
Defendant argues that plaintiff’s breach of implied contract claim fails because
she fails to plausibly allege the existence of an implied contract. Docket No. 54 at 12.
Defendant argues that plaintiff “simply alleges an implied contract formed between the
parties ‘when Plaintiff and Class Member provided their Private Information to
Defendant,’ under which ‘Defendant agreed to safeguard and protect’ this information.”
Id. at 13 (quoting Docket No. 52 at 54-55, ¶¶ 226-27). Plaintiff responds that an implied
contract exists given that she “agreed to work for Defendant and agreed to provide
3 Plaintiff does not respond to defendant’s argument that, to the extent that she
asserts a negligence per se claim based on Section 5 of the FTC Act, she fails to
plausibly state a claim for relief. See Docket No. 54 at 11-12. Accordingly, to the extent
plaintiff asserts a negligence per se claim, the Court will dismiss it.
Case No. 1:24-cv-03538-PAB-KAS Document 57 filed 09/21/26 USDC Colorado
pg 13 of 17

14
Defendant with her Private Information for Defendant to store, maintain, and use, based
on Defendant’s promises to keep this information ‘secure’ and protected from
‘unauthorized access, use, disclosure, alteration, or destruction.’” Docket No. 55 at 13
(citing Docket No. 52 at 5-7, ¶¶ 27-34).
The elements of a breach of contract claim are “(1) the existence of a contract,
(2) the plaintiff’s performance of the contract or justification for nonperformance, (3) the
defendant's failure to perform the contract, and (4) the plaintiff's damages as a result of
the defendant’s failure to perform the contract.” Univ. of Denver v. Doe, 547 P.3d 1129,
1139 (Colo. 2024). A contract can be either express – manifested by either written or
oral words – or implied – manifested by conduct. Fair v. Red Lion Inn, 920 F.2d 820,
825 (Colo. App. 1995); see also Osband v. United Airlines, Inc., 981 P.2d 616, 621
(Colo. App. 1998) (“there is no difference in legal effect between an express contract
and a contract implied in fact”). “The essential elements of a contract are ‘competent
parties, subject matter, a legal consideration, mutuality of agreement, and mutuality of
obligation.’” Autotech Techs., LP v. Palmer Drives Controls & Sys., Inc., No. 19-cv-
00718-PAB-NRN, 2020 WL 1974759, at *3 (D. Colo. Apr. 24, 2020) (quoting Peterson
v. Trailways, Inc., 555 F. Supp. 827, 830 (D. Colo. 1983) (citing Denver Truck Exch. v.
Perryman, 307 P.2d 805, 810 (Colo. 1957))).
Plaintiff alleges that, in order to receive services or employment from defendant,
plaintiff and class members were required by defendant to provide their private
information. 	Docket No. 52 at 5, ¶ 27. Plaintiff provided defendant with her name, date
of birth, Social Security number, email address, physical address, phone number, and
financial account information. Id. at 26, ¶ 109. She further alleges that plaintiff and
Case No. 1:24-cv-03538-PAB-KAS Document 57 filed 09/21/26 USDC Colorado
pg 14 of 17

15
class members entrusted their private information to defendant with the understanding
that defendant would adequately safeguard the information. Id. at 6, ¶ 31. The Court
finds that plaintiff has plausibly alleged the existence of an implied contract. See Owen-
Brooks, 2024 WL 4338133, at *13 (finding that plaintiffs plausibly alleged the existence
of a contract where “Plaintiffs allege they agreed to entrust their personal information to
Defendant, and their intent and understanding that Defendant would adequately protect
that information on its network. Plaintiffs allege Defendant did not do so, i.e., that it
breached the implied agreement to protect Plaintiffs’ information.”). Defendant does not
argue that plaintiff has failed to plausibly allege any other elements of her claim.
Accordingly, the Court will deny defendant’s motion to dismiss plaintiff’s breach of
implied contract claim.
3. 	Unjust Enrichment
Defendant argues that plaintiff’s unjust enrichment claim fails because she does
not plausibly allege that defendant received a benefit at plaintiff’s expense. See Docket
No. 54 at 14. Plaintiff responds that, “in carrying out its business, Defendant derived a
benefit from the Private Information of Plaintiff and the Class Members.” Docket No. 55
at 21.
An unjust enrichment claim requires a showing of three elements: “(1) at
plaintiff’s expense; (2) defendant received a benefit; (3) under circumstances that would
make it unjust for defendant to retain the benefit without paying.” See Dudding v.
Norton Frickey & Assocs., 11 P.3d 441, 445 (Colo. 2000). Plaintiff does not identify the
“benefit” that defendant retained through its use of plaintiff’s private information.
Case No. 1:24-cv-03538-PAB-KAS Document 57 filed 09/21/26 USDC Colorado
pg 15 of 17

16
Moreover, the fact that plaintiff was employed by defendant does not demonstrate that
defendant received a benefit at plaintiff’s expense. As held in Owens-Brooks,
Plaintiffs do not plausibly allege that providing their personal information to
Defendant conferred a benefit on Defendant that would be unjust to retain.
Certainly, the work that Plaintiffs have done for Defendant is a benefit and has
value, but that is not what is at issue here. They do not allege that Defendant
failed to pay them their salaries or wages. Nor do they allege that Defendant
gained a benefit by, for instance, selling their PII and PHI to third-persons without
Plaintiffs’ authorization. To the contrary, Plaintiffs acknowledge throughout the
[complaint] that the Data Breach was a ransomware attack.
Owen-Brooks, 2024 WL 4338133, at *18 (footnote omitted). Accordingly, the Court will
grant defendant’s motion to dismiss plaintiff’s unjust enrichment claim.
4. 	Declaratory Judgment
Plaintiff’s claim is brought pursuant to the Declaratory Judgment Act, 28 U.S.C.
§ 2201. Docket No. 52 at 58-60. However, the “Declaratory Judgment Act is not an
independent cause of action,” but rather a remedy. See Horace v. Cincinnati Ins. Co.,
No. 24-cv-00461-SBP, 2026 WL 1541241, at *18 (D. Colo. June 1, 2026) (citations
omitted). Thus, the Court will dismiss this “claim.” Moreover, much of plaintiff’s request
for declaratory relief is premised on the risk of future harm, see Docket No. 52 at 58-60,
which as discussed above, is not an injury pursuant to which plaintiff has standing.
However, to the extent that plaintiff seeks declaratory relief for those harms that support
her claim for damages (i.e., the publication of her private information to the dark web),
she may seek that relief. Accordingly, the Court will dismiss plaintiff’s claim under the
Declaratory Judgment Act.
IV. 	CONCLUSION
Therefore, it is
Case No. 1:24-cv-03538-PAB-KAS Document 57 filed 09/21/26 USDC Colorado
pg 16 of 17

17
ORDERED that Defendant Jacobs Entertainment, Inc.’s Motion to Dismiss
Plaintiff’s Amended Class Action Complaint [Docket No. 54] is GRANTED in part and
DENIED in part. It is further
ORDERED that Claim Three is DISMISSED with prejudice. 4 It is further
ORDERED that Claim Four is DISMISSED without prejudice.
DATED September 21, 2026.
BY THE COURT:
___________________________
PHILIP A. BRIMMER
United States District Judge
4“A dismissal with prejudice is appropriate where a complaint fails to state a claim
. . . and granting leave to amend would be futile.” See Brereton v. Bountiful City Corp.,
434 F.3d 1213, 1219 (10th Cir. 2006). The Court finds that plaintiff fails to state an
unjust enrichment claim and that amendment would be futile because plaintiff cannot
identify a benefit that defendant received from her or the class.
_______________________________________________________________________________________________	__	__	__	__	__________________________	__	___	_____________	___
Case No. 1:24-cv-03538-PAB-KAS Document 57 filed 09/21/26 USDC Colorado
pg 17 of 17