ADAMEK v. FIREWORKS SOFTWARE, INC.

1
MEMORANDUM OPINION
INTRODUCTION
This is a consolidated putative class action1 brought by Plaintiffs, individually and on
behalf of all others similarly situated individuals against Defendant Fireworks Software, Inc.,
(“Defendant”), arising from a data breach of Personally Identifiable Information, (“PII” or “private
information”). Plaintiffs are students and consumers of Rowan College, who commenced separate
actions in this Court after Defendant reported that Plaintiffs’ PII, including, names, Social Security
numbers (“SSN”), birth dates, and Alien Registration Numbers (“ARN”), had potentially been
improperly accessed in June 2024, by an unknown actor. (ECF 1; ECF 22). Plaintiff’s PII had
been provided to Defendant, a Pennsylvania corporation specializing in Customer Relationship
Management (“CMR”), through Defendant’s ordinary course of business with Rowan College.
(ECF 22, at ¶¶ 3, 4, 43; ECF 24-2, at 2). On April 7, 2025, Plaintiffs filed an amended complaint
averring four causes of action, to wit: negligence and negligence per se (Count I); breach of third-
1 	By Order dated February 18, 2025, Plaintiffs’ actions filed as 24-CV-5185, and 24-CV-5397, were
consolidated under the lead case: 24-CV-5185. (ECF 20).
IN THE UNITED STATES DISTRICT COURT
FOR THE EASTERN DISTRICT OF PENNSYLVANIA
TARA ADAMEK AND GIOVANNI 	: 	CIVIL ACTION
PACHECO, individually and on behalf 	:
of all others similarly situated, 	: 	NO. 24-5185
Plaintiffs, 	:
:
v. 	:
:
FIREWORKS SOFTWARE, INC., 	:
Defendant. 	:
NITZA I. QUIÑONES ALEJANDRO 	OCTOBER 8, 2026
SE
Case 2:24-cv-05185-NIQA Document 33 Filed 10/08/26 Page 1 of 15

2
party beneficiary contract (Count II); unjust enrichment (Count III); and a violation of the New
Jersey Consumer Fraud Act, N.J. Stat. §§ 56:8-1 et seq., (“NJCFA”), (Count IV). (ECF 22). In
the operative complaint, Plaintiffs also seek class certification; an award of compensatory,
consequential, statutory, and treble damages; injunctive relief compelling Defendant to strengthen
its data security monitoring systems and submit to future audits of those systems; and an award of
attorneys’ fees, costs, and expenses, with pre-judgment interest. (Id.).
Before the Court is Defendant’s motion to dismiss all claims pursuant to Federal Rules of
Civil Procedure (“Rule”), 12(b)(6). (ECF 24). Therein, Defendant essentially argues that the
complaint fails to allege the necessary elements to establish Counts I-III under Pennsylvania law.
(Id.). As to Count IV, Defendant argues that Plaintiffs are not a part of any group protected by the
NJCFA, and that their allegations fail to meet its heightened pleading standard. (Id.). In opposing
the motion, Plaintiffs ask this Court to deny the motion and preserve each of their claims. (ECF
28). Defendant filed a timely reply. (ECF 29). Thereafter, Plaintiffs provided notice of additional
authority for this Court’s consideration, (ECF 30), to which Defendant responded, (ECF 31).
However, the notice is moot, and neither it nor the response will be considered, because the
authority therein relates to Article III standing analyses not relevant to the Rule 12(b)(6) motion.
The issues have been fully discussed and are ripe for disposition. For the reasons set forth,
the motion to dismiss is denied as to Count I, (negligence and negligence per se claims), Count II
(breach of contract), and Count III (unjust enrichment /quasi contract), and granted as to Count IV
(violation of New Jersey Consumer Fraud Act).
STANDARD OF REVIEW
When deciding a motion to dismiss under Rule 12(b)(6), the Court “must accept all of the
complaint’s well-pleaded facts as true, but may disregard any legal conclusions.” Fowler v. UPMC
Case 2:24-cv-05185-NIQA Document 33 Filed 10/08/26 Page 2 of 15

3
Shadyside, 578 F.3d 203, 210 (3d Cir. 2009). The Court must determine “whether the facts alleged
in the complaint are sufficient to show that the plaintiff has a ‘plausible claim for relief.’” Id. at
211 (quoting Ashcroft v. Iqbal, 556 U.S. 662, 679 (2009)). The complaint must do more than
merely allege the plaintiff’s entitlement to relief; it must “show such an entitlement with its facts.”
Id. (citations omitted). “[W]here the well-pleaded facts do not permit the court to infer more than
the mere possibility of misconduct the complaint has alleged — but it has not ‘show[n]’ — ‘that
the pleader is entitled to relief.’” Iqbal, 556 U.S. at 679 (quoting Fed. R. Civ. P. 8(a)) (alterations
in original). “A claim has facial plausibility when the plaintiff pleads factual content that allows
the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.”
Id. at 678 (citing Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007)).
As a federal court sitting in diversity, this Court applies Pennsylvania law — as the law of
our forum state — to Plaintiff’s substantive claims for punitive damages and the Federal Rules of
Civil Procedure with respect to the adequacy of the pleadings. See Chamberlain v. Giampapa,
210 F.3d 154, 158 (3d Cir. 2000) (quoting Erie R.R. v. Tompkins, 304 U.S. 64, 78 (1938)). This
Court also applies Pennsylvania’s choice of law rules. Klaxon Co. v. Stentor Elec. Mfg. Co., 313
U.S. 487, 496 (1941). To determine choice of law, Pennsylvania applies a “flexible rule which
permits analysis of the policies and interests underlying the particular issue before the court.”
Hammersmith v. TIG Ins. Co., 480 F.3d 220, 227 (3d Cir.2007) (quoting Griffith v. United Air
Lines, Inc., 203 A.2d 796, 805–06 (Pa. 1964). Because the inquiry runs issue by issue, more than
one state’s law may govern a single case. Berg Chilling Sys., Inc. v. Hull Corp., 435 F.3d 455,
462 (3d Cir. 2006) (explaining the principle of “depecage”). However, because a full choice of
law analysis is a fact intensive inquiry that may not be suited for a motion to dismiss, the Court
defers the choice-of-law question and evaluates each count separately as pleaded, without
Case 2:24-cv-05185-NIQA Document 33 Filed 10/08/26 Page 3 of 15

4
prejudice to Defendant renewing the argument on a fuller record. Powell v. Subaru of Am., Inc.,
502 F. Supp. 3d 856, 875 (D.N.J. Nov. 24, 2020) (determining that a full choice of law analysis is
premature in the absence of a fully developed factual record, and that the Court may defer the
question at the pleading stage). Accordingly, to the analysis of the statutory claim herein, the
Court applies the NJCFA as New Jersey’s highest court has construed it.
NEGLIGENCE
At Count I of the amended complaint, Plaintiffs aver that, but for Defendant’s negligent
data retention practice, Plaintiffs’ PII would not have been accessed by an unknown actor. To
prove negligence under Pennsylvania law, Plaintiffs must establish: (1) “a duty or obligation
recognized by the law, requiring the actor to conform to a certain standard required[;]” (2) “a
failure to conform to the standard required[;]” (3) “a causal connection between the conduct and
the resulting injury[;]” and (4) “actual loss or damage.” Robinson v. May Dep’t Stores Co., 246
F. Supp. 2d 440, 445 (E.D. Pa. Feb. 12, 2003). Here, Defendant argues that Plaintiffs’ negligence
claim fails, as a matter of law, for failing to allege the requisite elements. Defendant is mistaken.
For the first and second elements, Plaintiffs have alleged that Defendant had a duty of care
as the custodian of Plaintiffs’ PII and failed to conform to the requisite standard of care. Under
Pennsylvania law, “[c]ertain entities that collect data have a duty to protect that information.”
Santoro v. Tower Health, 2024 WL 1773371, at *5 (E.D. Pa. Apr. 24, 2024) (citing Dittman v.
UPMC, 196 A.3d 1036, 1047-48 (Pa. 2018)). Custodians of private information such as, the
“names, birth dates, social security information, addresses, tax forms, and bank account
information[,]” have a duty to “exercise reasonable care in collecting and storing” such
information. Id. (quoting Dittman, 196 A.3d at 1038, 1047-48); see also In re Wawa, Inc. Data
Sec. Litig., 2021 WL 1818494, at *5 (E.D. Pa. May 6, 2021). Specifically, Plaintiffs allege that
Case 2:24-cv-05185-NIQA Document 33 Filed 10/08/26 Page 4 of 15

5
Defendant owed them a duty of reasonable care because Defendant “holds itself out as a trusted
provider of software solutions to higher education institutions” and “collect[s] the sensitive Private
Information of consumers who provide their Private Information to its clients,” such as Plaintiffs.
(ECF 22, ¶ 128). As such, Plaintiffs have plausibly alleged sufficient facts to show that Defendant,
as custodian of individuals’ PII, had a legally recognizable duty to Plaintiffs.
Additionally, in satisfaction of the second negligence element, Plaintiffs have sufficiently
pleaded facts to show that Defendant failed to conform to the requisite standard of care for proper
collection and storage of PII. “While the existence of a duty is a question of law, the issue of
whether a defendant’s conduct breached that duty is typically reserved for the factfinder.” Opris
v. Sincera Reproductive Med., 2022 WL 1639417, at *6 (E.D. Pa. May 24, 2022). For this reason,
a factual determination whether Defendant violated its duty to reasonably safeguard Plaintiffs’ PII
is premature. (Id.). At this motion to dismiss stage, however, Plaintiffs allege sufficient facts to
plausibly show that Defendant failed to take reasonable care by:
(a) mismanaging its system and failing to identify reasonably foreseeable
internal and external risks to the security, confidentiality, and integrity of
customer information that resulted in the unauthorized access and compromise
of Private Information; (b) mishandling its data security by failing to assess the
sufficiency of its safeguards in place to control these risks; (c) failing to design
and implement information safeguards to control these risks; (d) failing to
adequately test and monitor the effectiveness of the safeguards’ key controls,
systems, and procedures; (e) failing to evaluate and adjust its information
security program in light of the circumstances alleged herein; (f) failing to detect
the breach at the time it began or within a reasonable time thereafter; and (g)
failing to timely notify Plaintiff[s] and Class Members about the Data Breach.
(ECF 22 at ¶ 129). As such, Plaintiffs’ allegations are sufficient to establish the first and second
elements of negligence at the pleading stage. Opris, at 2022 WL 1639417, at *6 (finding similar
allegations to amount to a plausible failure to maintain the reasonable standard of care).
For the third and fourth elements, Plaintiffs have alleged that Defendant’s failure to
conform to the standard of care is the cause of various harms. Because some of the harms alleged
Case 2:24-cv-05185-NIQA Document 33 Filed 10/08/26 Page 5 of 15

6
satisfy these elements, this Court finds, at this stage of litigation, that Plaintiff has pleaded
sufficient facts to establish the negligence claim. For example, Plaintiffs characterize the
appearance of their PII on the dark web as a harm attributable to Defendant’s actions. Specifically,
Plaintiffs aver that, following the data breach, Plaintiff Adamek received credit reporting
notifications alerting her “that her [SSN] and email address have been found on the dark web.”
(ECF 22 ¶ 45). “Under Pennsylvania law, causation for negligence requires a showing that the
breach of the defendant’s duty was both the actual and proximate cause of the Plaintiff’s injury.”
Robert Volio, et al., v. Sugarhouse HSP Gaming, L.P. (d/b/a) Rivers Casino Philadelphia, et al.,
2026 WL 2280619, at *2 (E.D. Pa. Aug. 7, 2026) (slip opinion). “[T]o demonstrate actual or legal
causation, the plaintiff must show that the defendant’s act or omission was a ‘substantial factor’ in
bringing about the injury.” Roma v. Prospect Medical Holdings, Inc, 2024 WL 3678984, at *9
(E.D. Pa. Aug. 6, 2024) (citing Saelzler v. Advanced Grp. 400, 23 P.3d 1143, 1150 (Cal. 2001));
accord Hamil v. Bashline, 392 A.2d 1280, 1284 (Pa. 1978)). Proximate causation is satisfied for
negligence claims stemming from data breach where “because of the breach, [plaintiffs’]
information was available and thereafter placed on a ransomware website on the dark web[.]” Id.
(citing Opris, 2022 WL 1639417, at *6). Here, whether Defendant’s actions were the proximate
cause of Plaintiffs’ PII appearing on the dark web is reserved for the finder of fact. Summers v.
Certainteed Corp., 997 A.2d 1152, 1164 (Pa. 2010) (holding where reasonable minds may differ,
questions of proximate causation are typically reserved for the finder of fact).
Separately, Plaintiffs plead the following additional injuries and/or harms:
(a) financial costs incurred mitigating the materialized risk and imminent threat
of identity theft; (b) loss of time and loss of productivity incurred mitigating the
materialized risk and imminent threat of identity theft; (c) financial costs
incurred due to actual identity theft; (d) loss of time incurred due to actual
identity theft; (e) deprivation of value of their Private Information; and (f) the
Case 2:24-cv-05185-NIQA Document 33 Filed 10/08/26 Page 6 of 15

7
continued risk to their [PII], which remains in the possession of Defendant, and
which is subject to further breaches . . . .
(Id. at ¶ 18). These harms are readily attributed to Defendant’s actions. As pled, it is because of
the alleged data breach that Plaintiffs appear to have incurred such costs and damages. Thus,
Plainmtiff has pled sufficient facts to plausibly establish causation and negligence.
To determine whether the above harms should be considered ‘actual damages’ in
satisfaction of the fourth negligence element, Defendant and Plaintiff center their arguments within
the context of Clemens v. ExecuPharm Inc., 48 F.4th 146 (3d Cir. 2022), and Reilly v. Ceridian
Corp., 664 F.3d 38 (3d Cir. 2011). Indeed, Clemens and Reilly provide the relevant bounds for
establishing an ‘injury-in-fact’ for Article III standing in data breach cases in the United States
Court of Appeals for the Third Circuit, (“Third Circuit”). In re Samsung Data Sec. Breach Litig.,
761 F.3d. 781, 791-93 (D.N.J. Jan 3, 2025) (gathering authorities). However, in relying on these
cases, the parties conflate the ‘injury-in-fact’ requirements of Article III standing with the ‘actual
loss or damage’ requirements of negligence under Pennsylvania law. Cf. Opris, 2022 WL
1639417, at *7 (identifying a similar discrepancy between the applicable law, and the law
presented by the parties).
Whether the additional harms pled amount to ‘actual damages’ has not been addressed
under Pennsylvania law in data breach cases. However, a review of decisions from other courts
reveals that mitigation damages, such as those allegedly incurred by Plaintiffs in purchasing credit
and identity theft monitoring services, are a sufficient form of damages for a negligence claim. Id.
(collecting cases). The following analysis informs our prediction of how the Pennsylvania
Supreme Court would decide such an inquiry. Jaworowski v. Ciasulli, 490 F.3d 331, 335 (3d Cir.
2007) (explaining that federal courts sitting in diversity, in the absence of ruling from the forum
state’s supreme court on the issue presented, must attempt to predict how the state’s supreme court
Case 2:24-cv-05185-NIQA Document 33 Filed 10/08/26 Page 7 of 15

8
would rule if presented with the opportunity to do so). First, finding that such damages are not
compensable would discourage plaintiffs from mitigating future damages that would flow from
the data breach. Opris, 2022 WL 1639417, at *7 (citing Sackin v. TransPerfect Glob., Inc., 278
F. Supp. 3d 739, 749 (S.D.N.Y. Oct. 4, 2017)). Moreover, several courts have recognized the
property value of personal information. Id. (collecting cases). The Court finds both considerations
to be relevant to this case. Accordingly, in consideration of the benefits to public policy and
consistent with the findings of other Courts to consider the issue, it is likely that the Pennsylvania
Supreme Court would recognize the harms to be actual damages. Therefore, Plaintiffs have
alleged appropriate damages to support their negligence claim against Defendant. Accordingly,
Defendant’s motion to Dismiss Count I of the amended complaint is denied
NEGLIGENCE PER SE
At Count I of the amended complaint, Plaintiffs also allege a claim of negligence per se
based on Defendant’s failure to protect Plaintiffs’ personal information, thus, violating the Federal
Trade Commission Act (“FTC Act”), which prohibits “unfair . . . practices in or affecting
commerce.” 15 U.S.C. § 45(a)(1). Plaintiffs argue that Defendant violated the FTC Act by failing
to take reasonable measures to protect their information, which amounted to an unfair practice.
(ECF 22, at 32). Defendant moves to dismiss this part of the negligence per se claim for multiple
reasons, arguing that: (1) the FTC Act does not provide a private right of action, (2) that Plaintiffs
are not a part of the specific group of individuals that the FTC Act is intended to protect, and (3)
Plaintiffs have not alleged any facts to demonstrate a violation of the FTC Act by Defendant. (ECF
24, at 14-15). For the reasons set forth below, each argument is unavailing, and the motion to
dismiss Plaintiffs’ negligence per se claim from Count I is denied.
Case 2:24-cv-05185-NIQA Document 33 Filed 10/08/26 Page 8 of 15

9
“A claim of negligence per se arises out of a violation of a statue or regulation that
establishes a duty.” Opris, 2022 WL 1639417, at *7 (quoting Jordan v. City of Philadelphia, 66
F. Supp. 2d 638, 644 (E.D. Pa. Sept. 14, 1999). Under a theory of negligence per se, an alternative
theory of liability, a statutory violation satisfies the first and second elements of negligence. Id.
(citing Smith v. Wells, 212 A.3d 554, 560 (Pa. Super. 2019); Simmons v. Simpson House, Inc., 224
F. Supp. 3d 406, 417 (E.D. Pa. Dec. 12, 2016). This Court has already determined that the elements
of negligence under Pennsylvania law have been sufficiently pled. Thus, the Court is tasked to
determine whether the FTC Act may be used to establish the duty of care sufficient to support a
claim of negligence per se when breached. Similarly situated courts have determined that, when
dismissal of the negligence per se claim would not dispose of the related negligence claim, the
issue is better addressed at the summary judgment stage or through pre-trial motion practice.
Opris, 2022 WL 1639417, at *9-10. The same is true here, and Plaintiffs’ negligence per se claim
is preserved alongside the negligence claim at Count I and survives dismissal.
BREACH OF CONTRACT (THIRD-PARTY BENEFICIARY)
Defendant argues that Plaintiffs have failed to establish the existence and breach of a
contract that intends Plaintiffs or the proposed class members, to be third-party beneficiaries.
Under Pennsylvania law, a breach of contract requires: “(1) the existence of a contract, including
its essential terms, (2) a breach of the contract; and, (3) resultant damages.” Meyer, Darragh,
Buckler, Bebenek & Eck, P.L.L.C v. Law Firm of Malone Middleman, P.C., 137 A.3d 1247, 1258
(Pa. 2016) (citing J.F. Walker Co., Inc. v. Excalibur Oil Grp., Inc., 792 A.2d 1269, 1272 (Pa.
Super. 2002)).
A third-party beneficiary is one who is given rights under a contract to
which that person is not a party. Obligations under such a contract, including
any obligations to third parties, are created by agreement between the signatories
Case 2:24-cv-05185-NIQA Document 33 Filed 10/08/26 Page 9 of 15

10
. . . . If the signatories so intend, a third-party can enforce the contract against
the signatory so obligated.
Konyk v. Pennsylvania State Police of Commonwealth of Pennsylvania, 183 A.3d 981, 988 (Pa.
2018) (quoting Motorsport Eng’g, Inc. v. Maserati SPA, 316 F.3d 26, 29 (1st Cir. 2002)).
Here, the inquiry is whether Plaintiffs were intended third-party beneficiaries of a contract
between Rowan College and Defendant and, if so, whether Defendant breached the contract
causing Plaintiffs damages. To determine whether a contract designates an intended beneficiary,
in Scarpitti, the Pennsylvania Supreme Court adopted § 302 of the Restatement (Second) of
Contracts, which provides in pertinent part:
(1) Unless otherwise agreed between promisor and promisee, a
beneficiary of a promise is an intended beneficiary if recognition of
a right to performance in the beneficiary is appropriate to effectuate
the intentions of the parties and either
(a) the performance of the promise will satisfy an obligation of the
promisee to pay money to the beneficiary; or
(b) the circumstances indicate that the promisee intends to give the
beneficiary the benefit of the promised performance.
Scarpitti v. Weborg, 609 A.2d 147, 150 (Pa.1992).
Plaintiffs allege that Defendant entered into agreements with Rowan College for “services
that included data security practices, procedures, and protocols sufficient to safeguard the [PII]
that was entrusted to it.” (ECF 22 ¶ 139). Furthermore, Plaintiffs allege that such contracts were
made expressly for the benefit of Plaintiffs and Class Members, as it was their Private Information
that Defendant agreed to receive and protect through its services. Thus, the benefit of the collection
and protection of the [PII] belonging to Plaintiffs and the Class was the direct and primary
objective of the contracting parties, and Plaintiffs and Class Members were direct and express
beneficiaries of such contracts. (Id., at ¶ 140).
Case 2:24-cv-05185-NIQA Document 33 Filed 10/08/26 Page 10 of 15

11
Because the parties agree that Defendant received Plaintiffs’ PII through its ordinary course
of business with Rowan College as a CMR servicer, and because the allegations allude to
provisions of a business agreement governing the transfer and retention of Plaintiffs’ PII for their
collective benefit, it is plausible the Plaintiffs were owed ‘a right to performance appropriate to
effectuate the intentions of the parties.’ Scarpetti, 609 A.2d, at 150. Thus, it is very plausible that
the Plaintiffs were intended beneficiaries of an agreement between Defendants and Rowan
College.
Turning to the issue of whether the contract was breached, Plaintiffs allege that because
the data was leaked, Defendants necessarily failed to uphold the provisions of the implied contract.
(ECF ¶¶ 139-45). Accepting all well-pled factual allegations as true, as this Court must at this
stage of litigation, Plaintiffs have sufficiently pled facts to show the plausible existence of a
contract they can enforce as third-party beneficiaries. Accordingly, the motion to dismiss
Plaintiffs’ Count II claims for breach of third-party beneficiary contract of Plaintiff’s is denied.
UNJUST ENRICHMENT/QUASI-CONTRACT
Plaintiffs also raise a state law claim for unjust enrichment under a theory that, by providing
Defendant with their PII for safekeeping, Plaintiffs conferred a benefit upon Defendant without
receiving in exchange proper compensation. (ECF 22, at 36-37). To state a claim for unjust
enrichment in Pennsylvania, Plaintiff must allege: “(1) . . . benefits conferred on defendant by
plaintiff; (2) appreciation of such benefits by defendant; and (3) acceptance and retention of such
benefits under such circumstances that it would be inequitable for defendant to retain the benefit
without payment of value.” Shafer Elec. & Const. v. Mantia, 96 A.3d 989, 993 (Pa. 2014) (quoting
Durst v. Milroy General Contracting, Inc., 52 A.3d 357, 360 (Pa. Super. 2012). “In the data breach
context, ‘[c]ourts have found PII valuable to a business that commoditizes it or receives an
Case 2:24-cv-05185-NIQA Document 33 Filed 10/08/26 Page 11 of 15

12
independent pecuniary benefit from holding the PII.’” Hood v. Educational Computer Systems,
Inc., 2025 WL 1284737, at *10 (W.D. Pa. May 2, 2025) (alteration in original) (quoting In re NCB
Mgmt. Servs., Inc. Data Breach Litig., 748 F. Supp. 3d 262, 279 (E.D. Pa. Sept. 11, 2024). But
“where the complaint lacks factual allegations showing how a defendant ‘reaped monetary benefits
or otherwise profited’ from holding plaintiffs’ PII, ‘vague allegations that [the defendant] collected
information for commercial gain’ are not sufficient to state a claim for unjust enrichment.” In re
NCB, 748 F. Supp. 3d at 279 (quoting In re Am. Med. Collection Agency, Inc. Customer Data Sec.
Breach Litig., 2021 WL 5937742, at *18 (D.N.J. Dec. 16, 2021)) (alteration in original).
Here, Defendant argues that Plaintiffs have failed to allege facts satisfying the first and
second element of their unjust enrichment claim because the amended complaint does not identify
what benefit, if any, Defendant received from its possession of Plaintiffs’ PII. (ECF 29, at 8-10).
Defendant further argues that Plaintiffs have not satisfied the third element of their unjust
enrichment claim because nothing about Defendant’s retention of their PII was unjust. (Id. at 9-
10). In response, Plaintiffs argue that they conferred a benefit on Defendant by providing their
valuable PII to Defendant, and that collecting and maintaining Plaintiffs’ PII was an integral part
of Defendant’s business. (ECF 28, at 18-20). Plaintiffs further argue that Defendant’s failure to
adequately safeguard their PII was unjust under the circumstances. (Id.).
Plaintiffs’ allegations plausibly establish a claim for unjust enrichment at the pleading stage
of litigation. The fact that Plaintiffs only indirectly provided their PII to Defendant through Rowan
College does not defeat their claim. See In re NCB Mgmt. Servs., 748 F. Supp. 3d at 278–79 (“The
plaintiffs are correct they are not required to plead that they directly conferred a benefit on NCB.”).
Furthermore, the amended complaint sufficiently alleges facts to show that Plaintiffs conferred a
benefit on Defendant by way of Defendant’s business relationship with Rowan College premised
Case 2:24-cv-05185-NIQA Document 33 Filed 10/08/26 Page 12 of 15

13
on the retention and management of Plaintiffs’ PII. (ECF 22 ¶¶ 43, 50). “These allegations are
sufficient, at this pleading stage, to show that [Defendant] derived a monetary benefit specifically
from the retention and use of Plaintiffs’ PII.” Hood, 2025 WL 1284737, at *11. The amended
complaint also plausibly alleges that it would be unjust for Defendant to “‘retain the benefit of the
PII (and any benefits received therefrom), while leaving Plaintiffs to live with the consequences’
of not safeguarding that PII.” Id. (quoting In re Cap. One. Consumer Data Sec. Breach Litig., 488
F.Supp.3d at 412) (modifications in original). Accordingly, Defendant’s motion to dismiss
Plaintiff’s unjust enrichment claim is denied.
NEW JERSEY CONSUMER FRAUD ACT (“NJCFA”) VIOLATION
Defendant argues that Plaintiffs’ NJCFA claim on behalf of the nationwide class should be
dismissed for failure to allege ascertainable loss and unlawful conduct with particularity, (ECF 24,
at 13-15), and because Plaintiffs are not “consumers” under the NJCFA. (ECF 29, at 10). The
Court agrees in part.
A successful NJCFA claim will allege “(1) unlawful conduct; (2) an ascertainable loss; and
(3) a causal relationship between the defendants’ unlawful conduct and the plaintiff’s ascertainable
loss.” Int’l Union of Operating Eng’rs Loc. No. 68 Welfare Fund v. Merck & Co., 929 A.2d 1076
(N.J. 2007) (quoting New Jersey Citizen Action v. Schering-Plough Corp., 842 A.2d 174, 176 (N.J.
Super. Ct. App. Div. 2003)) (citation modified). Additionally, “[t]he stringent pleading restrictions
of Rule 9(b) . . . apply to such a claim . . . [requiring plaintiffs to] state the circumstances of the
alleged [unlawful conduct] with sufficient particularity to place the defendant on notice of the
“precise misconduct with which [it is] charged.” Frederico v. Home Depot, 507 F.3d 188, 200 (3d
Cir. 2007). As an initial matter, and as discussed previously, Plaintiffs have established cognizable
harms in the form of mitigation damages. As plead, these harms satisfy the second element
Case 2:24-cv-05185-NIQA Document 33 Filed 10/08/26 Page 13 of 15

14
necessary to establish a claim under the NJCFA. In re Am. Fin. Res., Inc. Data Breach Litig., 2023
WL 3963804, at *9 (D.N.J. Mar. 29, 2023) (“Because the Defendant is unable to provide any
authority for a prohibition of against intangible harms under the NJCFA, the Court is satisfied that
these present injuries are sufficient to allege damages that represent ascertainable rather than
theoretical loss.”).
However, as to the first necessary element, “[t]he NJCFA creates three categories of
unlawful practices; to wit: affirmative acts, knowing omissions, and violations of state
regulations.” Vukovich v. Haifa, 2007 WL 655597, at *9 (D.N.J. Feb. 27, 2007). As mentioned,
pursuant to Rule 9(b), this standard requires plaintiffs to “state the circumstances of the alleged
fraud with sufficient particularity to place the defendant on notice of the ‘precise misconduct with
which [it is] charged.’” Frederico, 507 F.3d at 200 (quoting Lum v. Bank of America, 361 F.3d
217, 223–24 (3d Cir.2004)) (alteration in original). Under the NJCFA, the alleged unlawful
conduct must be pled “(1) ‘in connection’ with the sale or advertisement of a product or service, .
. . and (2) ‘misleading and . . . outside the norm of reasonable business practice in that it will
victimize the average consumer.’” In re Am. Fin., 2023 WL 3963804, at *10 (quoting 46 Arcand
v. Brother Int’l Corp., 673 F. Supp. 2d 282, 296-97 (D.N.J. Nov. 30, 2009); Katz v. Ambit Ne.
LLC, 2021 WL 2680184, at *8 (D.N.J. June 29, 2021)). As to a claim of omission, Plaintiffs must
allege that Defendant “(1) knowingly concealed (2) a material fact (3) with the intention that the
consumer rely upon the concealment.” 46 Arcand, 673 F.Supp.2d at 297 (citation omitted).
Plaintiffs must also establish that Defendant had a duty to disclose the omission. Id.
Defendant argues that Plaintiffs have not pled an affirmative misrepresentation or a
knowing omission pursuant to the NJCFA with the requisite particularity of Rule 9(b)’s heightened
pleading standard. (ECF 24, Ex. 2, at 14) (citing Frederico, 507 F.3d at 200 (stating that the
Case 2:24-cv-05185-NIQA Document 33 Filed 10/08/26 Page 14 of 15

15
NJCFA is subject to Rule 9(b)’s heightened pleading standard)). In response, Plaintiffs argue that
by “failing to implement and maintain reasonable security measures to protect and secure
Plaintiffs’ and New Jersey Subclass Members’ Private Information in a manner that complied with
applicable laws, regulations, and industry standards[,]” Defendant’s conduct violated the NJCFA.
(ECF 22, ¶ 164). Plaintiffs further allege that “Defendant committed deceptive omissions in
violation of the NJCFA by failing to inform Plaintiffs and New Jersey Subclass Members that they
would not adequately secure Plaintiffs’ and New Jersey Subclass Members’ Private Information.”
(Id., at ¶ 163). Accepted as true, these allegations are, nonetheless, too broad to find a knowing
misrepresentation and/or omission by Defendant because no particular facts of such misconduct
are pled. There is also no basis established to suggest that Defendant owed Plaintiffs a duty to
disclose any information on the security measures implemented to protect and secure Plaintiffs’
PII. Because Plaintiffs have not sufficiently pleaded their claims of Defendant’s breach of the
NJCFA with particularity, Defendant’s motion to dismiss Plaintiffs’ NJCFA claim is granted.
CONCLUSION
For the foregoing reasons, the motion to dismiss is denied as to Count I, (negligence and
negligence per se claims), Count II (breach of contract), and Count III (unjust enrichment /quasi
contract), and granted as to Count IV (violation of New Jersey Consumer Fraud Act).
An Order consistent with this opinion follows.
NITZA I. QUIÑONES ALEJANDRO, J.
Case 2:24-cv-05185-NIQA Document 33 Filed 10/08/26 Page 15 of 15