Fay v. VeriSource Services, Inc.

UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF TEXAS
HOUSTON DIVISION
IN RE V ERISOURCE SERVICES,
I NC. D ATA BREACH L ITIGATION
CIVIL A CTION N O. 4:24-CV-03492
MEMORANDUM AND RECOMMENDATION
Before the Court are the Motions to Dismiss by Defendant VeriSource
Services, Inc. (ECF 76) and Defendants Southwest Water Company, LLC and
Planned Administrators, Inc. ECF 77.1 After reviewing the record, the parties’
submissions, and the law, the Court recommends the Motions be GRANTED IN
PART AND DENIED IN PART for the reasons discussed below.
I. 	Factual and Procedural Background.
VeriSource Services, Inc. (VSI) provides employee benefit plan services.
ECF 70 ¶ 3. Southwest Water Company, LLC (SWC), a utility company, contracted
with VSI for benefit administration services. Id. ¶ 64. Planned Administrators, Inc.
(PAI) is a third-party benefits administrator that utilizes VSI’s services. 	Id. ¶¶ 52,
65. Plaintiffs are, or were, employees or employee dependents of companies using
VSI’s services. Id. ¶¶ 4-5. On August 20, 2024, VSI sent Plaintiffs a Notice of Data
1 The District Judge referred this case to the undersigned Magistrate Judge pursuant to 28 U.S.C.
§ 636(b)(1)(A) and (B), the Cost and Delay Reduction Plan under the Civil Justice Reform Act,
and Federal Rule of Civil Procedure 72. ECF 14.
United States District Court
Southern District of Texas
ENTERED
February 06, 2026
Nathan Ochsner, Clerk
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 1 of 46

2
Security Incident informing them that their private health information (PHI) and
personally identifiable information (PII) (collectively “private information” or “PI”)
was stolen by cybercriminals in a February 2024 data breach (the Data Breach). Id.
¶¶ 1-3, 49.
Multiple parties sued VSI and the Court consolidated the actions into this lead
case. 	ECF 18. 	Plaintiffs added SWC as a Defendant in their First Amended
Complaint. 	ECF 37. 	On July 3, 2025, with leave of court, Plaintiffs filed their
Second Amended Complaint adding PAI as a Defendant. ECF 70. 	The Second
Amended Complaint asserts claims against VSI for negligence, breach of implied
contract, 	breach 	of 	third-party 	beneficiary 	contract, 	unjust 	enrichment, 	and
declaratory judgment based on VSI’s alleged failure to adequately protect Plaintiffs’
data.2 Id. 	¶¶ 91-98, 609, 626-54, 661-66, 671. 	The Second Amended Complaint
asserts claims against SWC and PAI for negligence, breach of implied contract,
unjust enrichment, declaratory judgment, and negligent hiring based on their failure
to “[take] special care in selecting and auditing VSI to ensure it had adequate data
security protocols in place.” 	Id. ¶¶ 67, 610, 626-40, 662-66, 671. Defendants VSI,
2 This is the lead case in a consolidated action in which there are 11 other member cases and 21
named Plaintiffs: Payson Clarke, Stacey Sanchez, Scott Wagner, Aaron Williams, Frank Fazio,
Sarah White, Nankumar Bacchus, Jassir Bueno, Alexander Farley, Kelvin Gill, Kimberly
Touchton, Marah West, Bruce Knights, Dmario Davis, Richard Almeda, Herbert Diggs, Annette
Falcon, Joyce Popoola, Tanya Holcomb, Shinika Hendricks, and Andrew Wheaton. 	ECF 70.
Although the Second Amended Complaint seeks certification of a class, id. at 150, there is no
motion for certification before the Court and for current purposes the Court addresses the claims
of the named Plaintiffs’ asserted in the Second Amended Complaint.
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 2 of 46

3
SWC, and PAI filed their Motions to Dismiss on August 4, 2025. ECF 76; ECF 77.
The Motions have been fully briefed and are ripe for determination. See ECF 78;
ECF 79; ECF 82; ECF 83.
SWC and PAI move to dismiss Plaintiffs’ claims pursuant to Federal Rule
12(b)(1) for lack of Article III standing and pursuant to Rule 12(b)(6) for failure to
state a claim. See generally ECF 77. VSI moves to dismiss only pursuant to Federal
Rule of Civil Procedure 12(b)(6). See generally ECF 76. The Court first addresses
SWC 	and 	PAI’s 	Rule 12(b)(1) challenge 	to 	jurisdiction 	and 	then 	addresses
Defendants’ Rule 12(b)(6) motions.
II. 	SWC and PAI’s Rule 12(b)(1) Motion to Dismiss for Lack of Standing
Should be Denied.3
A. Rule 12(b)(1) standards for dismissal based on lack of standing.
“Standing and ripeness are required elements of subject matter jurisdiction
and are therefore properly challenged on a Federal Rule of Civil Procedure 12(b)(1)
motion to dismiss.” 	Roman Cath. Diocese of Dallas v. Sebelius, 927 F. Supp. 2d
406, 415-16 (N.D. Tex. 2013) (citing Xerox Corp. v. Genmoora Corp., 888 F.2d
345, 350 (5th Cir. 1989) and Western Geco L.L.C. v. Ion Geophysical Corp., 776 F.
Supp. 2d 342, 350 (S.D. Tex. 2011)). When subject matter jurisdiction is challenged,
the court “is free to weigh the evidence and resolve factual disputes in order to satisfy
3 All parties agree to application of Texas law for purposes of the Motions to Dismiss. ECF 76 at
3-4; ECF 78 at 5-6; see generally ECF 77, ECF 83.
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 3 of 46

4
itself that it has power to hear the case.” Montez v. Dep’t of the Navy, 392 F.3d 147,
149 (5th Cir. 2004); Krim v. Pcorder.com, 402 F.3d 489, 494 (5th Cir. 2005). The
court may consider any of the following in resolving a Rule 12(b)(1) motion: “(1)
the complaint alone; (2) the complaint supplemented by the undisputed facts
evidenced in the record; or (3) the complaint supplemented by undisputed facts plus
the court's resolution of disputed facts.” Lane v. Halliburton, 529 F.3d 548, 557 (5th
Cir. 2008) (internal quotation marks omitted; see also Schaeffler v. United States,
889 F.3d 238, 242 (5th Cir. 2018). The plaintiff bears the burden of establishing
subject matter jurisdiction. Exelon Wind 1, L.L.C. v. Nelson, 766 F.3d 380, 388 (5th
Cir. 2014). If the plaintiff fails to meet his burden, the case must be dismissed. Id.
B. To avoid dismissal under Rule 12(b)(1) Plaintiffs must plead the
required elements for standing.
“The standing requirement has three elements: (1) an injury in fact; (2)
causation; and (3) redressability.” Cabezas v. Mr. Cooper Grp. Inc., No. 3:23-CV-
2453-N, 2025 WL 2053287, at *3 (N.D. Tex. July 22, 2025) (citing Bennett v. Spear,
520 U.S. 154, 167 (1997)); see also, Lujan v. Defs. of Wildlife, 504 U.S. 555, 560
(1992) (identifying the “irreducible constitutional minimum” elements of standing).
The first element, injury in fact, requires an injury that is “concrete, particularized,
and actual or imminent.” 	Clapper v. Amnesty Int'l USA, 568 U.S. 398, 409 (2013)
(internal quotation marks and citations omitted); see also, Deep S. Ctr. for Env't Just.
v. U.S. Env't Prot. Agency, 138 F.4th 310, 317 (5th Cir. 2025) (A plaintiff’s “claimed
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 4 of 46

5
injury must be ‘concrete and particularized’ and ‘actual or imminent, not conjectural
or hypothetical.’” (quoting Lujan, 504 U.S. at 561)). “[M]erely being subjected to a
risk of future harm” fails to meet the requirement that the harm be concrete,
particularized and actual or imminent because “if a risk hasn’t materialized, the
plaintiff hasn’t yet been injured.” Perez v. McCreary, Veselka, Bragg & Allen, P.C.,
45 F.4th 816, 824 (5th Cir. 2022).
The second element, causation, requires that the injury be “fairly traceable to
the challenged action.” Monsanto Co. v. Geertson Seed Farms, 561 U.S. 139, 149
(2010). For an injury to be fairly traceable to Defendant’s conduct, Plaintiffs must
show “a causal connection between [their] injury and [Defendants’] challenged
conduct, [but need not make] a showing of proximate cause.” Inclusive Communities
Project, Inc. v. Dep't of Treasury, 946 F.3d 649, 655 (5th Cir. 2019). 	The causal
connection cannot be based on a “speculative chain of possibilities.” 	Clapper, 568
U.S. at 414. When traceability relies on the actions of an independent third party,
plaintiffs can “meet [their] burden . . . [by showing] at the least that third parties will
likely react in predictable ways.” Book People, Inc. v. Wong, 91 F.4th 318, 332 (5th
Cir. 2024) (finding plaintiffs’ economic injuries traceable to state commissioner
tasked with enforcement of challenged law) (internal quotation marks and citations
omitted).
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 5 of 46

6
The third element requires that the injury be “redressable by a favorable
ruling.” Monsanto, 561 U.S. at 149. An injury is redressable if “‘a favorable decision
will relieve a discrete injury’” to the plaintiff, who “‘need not show that a favorable
decision will relieve his every injury.’” K.P. v. LeBlanc, 627 F.3d 115, 123 (5th Cir.
2010) (emphasis in original) (quoting Larson v. Valente, 456 U.S. 228, 243 n.15
(1982)); S. Christian Leadership Conf. v. Supreme Ct. of State of La., 252 F.3d 781,
788 (5th Cir. 2001) (explaining an injury is redressable when it is “likely, as opposed
to merely speculative, that a favorable decision will redress the plaintiff's injury.”).
The Supreme Court has instructed that standing “is not dispensed in gross”
and must be assessed as to each claim and form of relief asserted by the plaintiff.
Davis v. Fed. Election Comm'n, 554 U.S. 724, 734 (2008) (internal quotation marks
omitted); Solomon v. Deer Oaks Mental Health Assocs., P.C., No. SA-23-CV-1465-
FB, 2024 WL 4907072, at *3 (W.D. Tex. Sept. 30, 2024) (stating “[s]tanding is
assessed plaintiff by plaintiff and claim by claim” (citations omitted)).
C. Courts have reached differing decisions about whether injuries
from a data breach satisfy the elements required for standing.
The Supreme Court addressed Article III standing in the context of data
management claims in Transunion LLC v. Ramirez, 594 U.S. 413 (2021). 	In
Transunion, a class of 8,185 plaintiffs sued Transunion for maintaining inaccurate
information in credit files indicating that Plaintiffs’ names appeared on the U.S.
Treasury Department’s Office of Foreign Assets 	Control’s (OFAC’s) list 	of
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 6 of 46

7
“terrorists, drug traffickers, and other serious criminals.” Id. at 419, 433. Applying
well-established standing precedents, the Transunion Court held that the presence of
“misleading information in the internal credit files” did not constitute a concrete
harm. 	Id. at 434-435 (emphasis added). 	The Court further held that the “risk of
future harm [cannot] supply the basis for [plaintiffs’] standing.” 	Id. at 438.
Therefore, only those plaintiffs who alleged inaccurate information was actually
shared with third parties in a credit report had standing to sue Transunion. 	Id. at
439.
Since Transunion was decided by the Supreme Court, the Fifth Circuit has not
addressed the issue of standing in a data breach case. 	However, the Fifth Circuit
“touched on the issue” in Ellis v. Cargill Meat Sols., No. 24-10339, 2024 WL
4692024 (5th Cir. Nov. 6, 2024), 	cert. denied, 	145 S. Ct. 2901 (2025), an
unpublished, non-precedential decision. 	Cabezas, 2025 WL 2053287, at *3
(discussing Ellis). 	In Ellis, the Fifth Circuit affirmed the dismissal of plaintiff's
privacy claims against his employer based on lack of standing because absent the
“allegation that any hacker, identity thief, or third party accessed his data[,]”
plaintiff’s injury was speculative. 	2024 WL 4692024, at *3. 	Thus, Ellis supports
the proposition that standing in a data breach case requires an allegation that the
plaintiff’s data was actually accessed in the breach, not merely an allegation that the
attack created the potential for exposure. Id.
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 7 of 46

8
In the absence of clear instructions from the Fifth Circuit, district courts
considering whether injuries from data breaches support Article III standing have
reached varied results. See Williams v. Singing River Health Sys., No. 1:24-CV-24-
HSO-MTP, 2025 WL 2487792, at *5 (S.D. Miss. Aug. 28, 2025) (gathering cases
and recognizing that “Courts within the Fifth Circuit have applied standing doctrines
in the data-breach context, and have arrived at varying conclusions.”). In Cabezas
v. Mr. Cooper Grp. Inc., much like this case, Plaintiffs alleged they suffered concrete
injury through:
(1) 	misuse 	of 	their 	PII 	in 	the 	form 	of 	fraudulent 	charges 	and
transactions; (2) a post-breach increase in spam calls, texts, and emails;
(3) breach of contract; (4) loss of PII value; (5) disclosure of their PII
to third parties; (6) expenses associated with prevention, detection, and
recovery from exposure of PII and identity theft; (7) opportunity costs
associated with mitigating exposure of PII; (8) time, effort, and expense
of managing and monitoring accounts in response to the heightened risk
from the exposure; (9) anxiety and emotional distress; (10) loss of
privacy; (11) loss of benefit of the bargain; (12) imminent risk of harm
through fraud or identity theft.
2025 WL 2053287, at *3. Based on a review of several data breach cases from other
district courts, the Cabeza court held:
(1) “[s]pam communications do not constitute an injury in fact[;]”
(2) plaintiffs did not plead an injury in fact based on diminution of value
or loss of benefit of the bargain;
(3) plaintiffs did allege an injury in fact based on increased risk of future
harm because they alleged incidents of actual misuse;
(4) plaintiffs’ allegations of the sale or exposure of their PII to the dark
web constitute injury in fact;
(5) emotional distress and mitigation costs, “when coupled with the risk
of harm,” constitute injury in fact; and
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 8 of 46

9
(6) plaintiffs did not have standing for declarative and injunctive relief
because “future harm of a second cyberattack is too speculative and not
sufficiently imminent.”
Cabezas, 2025 WL 2053287, at *5-8 (internal quotation marks omitted). In contrast
to the plaintiffs’ allegations in Cabezas, no plaintiff in Williams v. Singing River
sufficiently alleged actual misuse of private information caused by the data breach.
See 2025 WL 2487792, at *7-10. Thus, the Williams court found that allegations of
emotional distress, mitigation efforts, diminution in value, intrusion on privacy,
presence of information on the dark web, and an unauthorized credit card charge did
not constitute concrete injuries sufficient to confer standing on plaintiffs for
substantive or declaratory judgment claims.4 Id.
Recently, in Ethridge-Delucca v. Sabre GLBL Inc., No. 3:24-CV-03262, slip
op. (N.D. Tex. December 2, 2025), a district court in the Northern District of Texas
analyzed standing in a data breach case. In Ethridge-Declucca, the court found that
anxiety was “the only concrete harm sufficient for standing” alleged by plaintiffs
and therefore was “the only basis on which the plaintiffs [could] pursue . . .
damages.” Id. at 5. The court rejected standing based on the alleged harm of risk of
4 In Williams, the plaintiffs alleged “(1) a loss of privacy due to the exfiltration of their Private
Information; (2) being placed at ‘an actual, imminent, and substantial risk of harm from fraud and
identify theft’; (3) being ‘forced to expend time dealing with the effects of the Data Breach’; (4) a
‘substantial and imminent risk of out-of-pocket fraud losses’; (5) the need to ‘incur out-of-pocket
costs for protective measures’; (6) the ‘substantial risk of being targeted for future phishing, data
intrusion, and other illegal schemes’; (7) the diminution in value of their Private Information; and
(8) being ‘forced to live with the anxiety that their Private Information ... may be disclosed to the
entire world[.]’” 2025 WL 2487792, at *1.
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 9 of 46

10
identity theft because the pleadings did not show the risk was imminent. Id. at 6-7.
The Court further ruled the following alleged injuries were not concrete harms that
supported standing: disclosure of PI; time (as opposed to money) spent on mitigation
efforts; increase in spam; and diminishment of PI value. 	Id. at 7-10. 	The court
rejected plaintiffs’ loss of benefit of the bargain injury as a source of standing
because plaintiffs failed to adequately plead that “data protection was part of the
bargain for their employment[.]” Id. at 11.
The precedents cited above demonstrate that Article III standing based on
injuries from a data breach is a heavily fact-based determination which depends on
the specific allegations in the plaintiffs’ well-pleaded complaint. See Morrow v. W.
Texas Gas, Inc., No. MO:23-CV-00174-DC, 2025 WL 2816760, at *2 (W.D. Tex.
Jan. 9, 2025) (noting that “much of the difference [in outcomes] can be explained by
factual distinctions in the cases”). 	Although informative, the cited cases did not
contain allegations that are entirely analogous to Plaintiffs’ allegations in this case.
D. Plaintiffs have alleged injuries that meet the requirements for
Article III standing.
As noted above, there are 21 named Plaintiffs in this consolidated case. All
Plaintiffs assert claims against SWC and PAI for negligence/negligence per se,
negligent hiring, breach of implied contract, unjust enrichment, and declaratory
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 10 of 46

11
judgment.5 See ECF 70. SWC and PAI argue Plaintiffs lack standing because they
allege only a hypothetical risk of future injury.6 ECF 77 at 6-7. 	Generally,
allegations of a heightened risk of future harm, standing alone, are insufficient to
support standing. 	See TransUnion, 594 U.S. at 415. 	However, SWC and PAI’s
briefing fails to address standing on a “plaintiff by plaintiff” or “claim by claim”
basis as required by Supreme Court precedent and ignores certain of Plaintiffs’
allegations.
Plaintiffs make numerous, generalized, non-Plaintiff specific allegations of
injury in the Second Amended Complaint. For example, Plaintiffs allege:
As a result of the Data Breach, Plaintiffs and Class Members suffered
concrete injuries in fact including, but not limited to (a) financial costs
incurred mitigating the materialized risk and imminent threat of identity
theft; (b) loss of time and loss of productivity incurred mitigating the
materialized risk and imminent threat of identity theft; (c) actual
identity theft and fraud; (d) financial costs incurred due to actual
identity theft; (e) loss of time incurred due to actual identity theft; (f)
deprivation of the value of their Private Information; (g) loss of privacy;
(h) emotional distress including anxiety and stress in with dealing with
the Data Breach; and (i) the continued risk to their sensitive Private
5 Plaintiffs’ request for declaratory judgment is a derivative claim that is dependent on Plaintiffs’
ability pursue their underlying substantive claims. Adegbenro v. Bank of Am., N.A., No. 4:22-CV-
00828, 2023 WL 4275507, at *15 (S.D. Tex. June 12, 2023) (stating “[r]equests for declaratory
judgment and injunctive relief are derivative, such that they depend on the existence of some other
cause of action), report and recommendation adopted, No. 4:22-CV-00828, 2023 WL 4275012
(S.D. Tex. June 27, 2023). Having determined that Plaintiffs have standing on their substantive
claims, the Court addresses Plaintiffs’ declaratory judgment claim only under Rule 12(b)(6).
6 SWC and PAI “specifically address only those Plaintiffs who plead any connection to SWC and
PAI, but these arguments apply equally, if not more so, to the other Plaintiffs.” 	ECF 77 at 2.
Because this Court has an “independent obligation to assure” that it has subject matter jurisdiction,
this Memorandum and Recommendation addresses the claims of all 21 Plaintiffs. 	Harold H.
Huggins Realty, Inc. v. FNC, Inc., 634 F.3d 787, 795 n.2 (5th Cir. 2011).
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 11 of 46

12
Information, which remains in Defendants’ possession and is subject to
further breaches, so long as Defendants fail to undertake appropriate
and adequate measures to protect the PII they collect and maintain.
ECF 70 ¶ 24. And:
[A]ll Plaintiffs . . . have suffered and will continue to suffer the
following actual injuries and damages, without limitation: (a) invasion
of privacy; (b) financial costs incurred mitigating the materialized risk
and imminent threat of identity theft; (c) loss of time and loss of
productivity incurred mitigating the materialized risk and imminent
threat of identity theft, and related lost opportunity costs; (d) financial
costs incurred due to actual identity theft; (e) loss of time incurred due
to actual identity theft; (f) deprivation of value of their Private
Information; (g) loss of the benefit of their bargain; (h) emotional
distress including anxiety and stress in dealing with the Data Breach’s
aftermath; 	and 	(i) 	the 	continued 	risk 	to 	their 	sensitive 	Private
Information, which remains in VSI’s possession and is subject to
further unauthorized disclosures so long as PAI and SWC continue to
use VSI’s services.
Id. ¶ 197.
The Second Amended Complaint also includes generalized allegations of
injury in connection with particular causes of action. Plaintiffs allege the following
generalized injuries in connection with their negligence/negligence per se claims:
(a) invasion of privacy; (b) lost or diminished value of their Private
Information; (c) actual identity theft and fraud; (d) lost opportunity
costs associated with attempting to mitigate the actual consequences of
the Data Breach, including but not limited to lost time; (e) loss of
benefit of their bargain; and (f) the continued and certainly increased
risk to their Private Information, which remains (i) unencrypted and
available for unauthorized third parties to access and abuse; and (ii) in
VSI’s possession and subject to further unauthorized disclosures so
long as VSI fails to undertake appropriate and adequate measures to
protect it.
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 12 of 46

13
Id. ¶ 614. Plaintiffs allege the following injuries resulted from Defendants’ negligent
hiring:
damages, including, without limitation, loss of the benefit of the
bargain, exposure to heightened future risk of identity theft, loss of
privacy, diminution in value of their Private Information, and actual
misuse of their Private Information.
Id. ¶ 688. 	Plaintiffs allege the following injuries resulting from SWC and PAI’s
breach of implied contract:
Plaintiffs and Class Members did not receive the full benefit of their
bargains with Defendants and instead received services of a diminished
value compared to that described in the implied contracts. Plaintiffs and
Class Members were therefore damaged in an amount at least equal to
the difference in the value of the services with data security protection
they were promised and that which they received.
Id. ¶ 635. 	Further, Plaintiffs allege that Defendants enriched themselves by
prioritizing profits over security and therefore Plaintiffs:
are entitled to full refunds, restitution, and/or damages from Defendants
and/or an order proportionally disgorging all profits, benefits, and other
compensation obtained by Defendants from their wrongful conduct.
This can be accomplished by establishing a constructive trust from
which the Plaintiffs and Class Members may seek restitution or
compensation.
Id. ¶ 666.
The Second Amended Complaint also includes allegations of Plaintiff-
specific injuries. 	See id. ¶¶ 254-570. 	A chart in the Second Amended Complaint
identifies each Plaintiff’s injury allegations by paragraph. 	ECF 78 at 4-6. 	Eleven
Plaintiffs have supported the allegations of “actual identity theft and fraud,” and
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 13 of 46

14
“actual misuse of their Private Information” with specific facts. In short, Plaintiffs
Almeda, Diggs, Falcon, and White allege fraudulent attempts to use or open credit
cards, open a bank account, or submit a loan application. Id. ¶¶ 297, 368, 385, 522.
Plaintiff Popoola alleges she received unsolicited messages from PayPal and Netflix
about her account information. Id. ¶ 472. Popoola, along with Wagner, Fazio, and
West, allege they have been notified that their information is on the “dark web.”7 Id.
¶¶280, 419, 471, 505. 	Plaintiffs Davis, Knights, and Williams allege fraudulent
charges, account openings, or tax filings. Id. ¶¶ 348-51, 453-54, 539. Finally, each
and every Plaintiff in this case alleges current, persistent, and acute, emotional
distress. Id. ¶¶ 263, 273, 283, 293, 311, 327, 344, 364, 381,399, 415, 433, 449, 467,
485, 501, 518, 535, 550, 560, 570.
1. Plaintiffs allege concrete, particularized, and actual injuries.
For purposes of opposing Defendants’ challenge to their standing, Plaintiffs
rely on their alleged communal injuries of (i) increased risk of future harm; (ii) loss
of privacy; (iii) mitigation efforts; and (iv) emotional distress. ECF 78 at 8. As set
forth above, 11 Plaintiffs have alleged facts demonstrating not only the potential for
future misuse of PI, but actual incidents of misuse. Several district courts within the
7 “The dark web is an area of the internet accessible only by using an encryption tool . . . [that]
provides anonymity and privacy online, and perhaps consequently, frequently attracts those with
criminal intentions.” United States v. Schultz, 88 F.4th 1141, 1143 n.1 (5th Cir. 2023) (citing
Gareth Owen & Nick Savage, The Tor Dark Net, Global Commission on Internet Governance,
Paper Series No. 20, 1 (2015)).
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 14 of 46

15
Fifth Circuit have found standing based on one or more the injuries alleged by
Plaintiffs here. 	See Cabezas, 2025 WL 2053287, *5-8 (summarized above);
Morrow, 2025 WL 2816760, at *3 (rejecting loss of privacy as concrete harm but
stating “[t]he consequences of identity theft, via lost time, money, or emotional
distress, present injuries that have actually occurred and that are real and concrete”);
Williams v. Bienville Orthopaedic Specialists, LLC, 737 F. Supp. 3d 411, 421 (S.D.
Miss. 2024) (finding unauthorized charges and notification that PI was on “dark
web” constituted Article III injuries).
In support of their Rule 12(b)(1) motion to dismiss, Defendants cite to district
court cases finding injuries like those alleged by Plaintiffs insufficient to confer
standing. See Logan v. Marker Grp., Inc., No. 4:22-CV-00174, 2024 WL 3489208,
at *5 (S.D. Tex. July 18, 2024) (rejecting standing based on receipt of phishing
emails and diminution in value); Peters v. St. Joseph Servs. Corp., 74 F. Supp. 3d
847, 852 (S.D. Tex. 2015) (dismissing FCRA claim for lack of Article III standing
where plaintiff’s allegations did not show any quantifiable damages); Perlaki v. J.B.
Poindexter & Co., No. 4:24-CV-01649, 2025 WL 754503, at *5 (S.D. Tex. Mar. 10,
2025) (holding heightened risk, lost time, and diminished value were not concrete
injuries). 	However, the cases cited by Defendants precede Judge Godbey’s well-
reasoned decision in Cabezas. Moreover, the Logan and Peters cases did not include
allegations of emotional distress, and the Perlaki and Ethridge-Delucca cases found
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 15 of 46

16
allegations of emotional distress supported standing. Perlaki, 2025 WL 754503, at
*6; Ethridge-Delucca, slip op. at 5.
In Transunion, the Supreme Court recognized but declined to determine
whether plaintiffs may be able to show standing by alleging “some other injury (such
as an emotional injury) from the mere risk that their credit reports would be provided
to third-party businesses.” TransUnion LLC, 594 U.S. at 437. Meanwhile, the Fifth
Circuit has recognized that “[a] plaintiff can sue for damages if the risk materializes
or causes a separate injury-in-fact, such as emotional distress.” 	Perez, 45 F.4th at
824. In Cabezas, the district court held that mitigation costs and emotional distress
from fear of future harm, combined with actual incidents of misuse of some victims’
stolen PI, can constitute concrete injuries. 	2025 WL 2053287, at *7; see also
Hawkins v. Scout Energy Mgmt., LLC, No. 3:24-CV-01545-N, 2025 WL 2244327,
at *3, *5 (N.D. Tex. Aug. 5, 2025) (following Cabezas). Here, the Second Amended
Complaint contains allegations by multiple Plaintiffs that their information is on the
dark web and of fraudulent credit card charges as well as attempts to open fraudulent
bank accounts in their names have been made. These allegations are combined with
plausible allegations of emotional distress.
In addition, and in contrast to the Cabezas and Ethridge-Delucca plaintiffs,
Plaintiffs 	here 	allege 	facts 	to 	support 	lost 	benefit 	of 	the 	bargain 	damages.
Essentially, Plaintiffs allege they did not get the data protection for which they
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 16 of 46

17
bargained and paid. 	See ECF 70 ¶ 6. 	In Cabezas, the court rejected plaintiffs’
argument that benefit of the bargain damages conferred standing because plaintiffs
“failed to adequately plead that they bargained for and paid for the protection of their
private information.” 2025 WL 2053287, at *6. 	Plaintiffs here allege they were
required to provide their private information in order to receive services from
Defendants and they paid, directly or indirectly, for those services, including data
security. 	See, e.g., ECF 70 ¶ 252. 	The Court finds Cabezas persuasive and finds
that under these facts Plaintiffs have sufficiently alleged the concrete injuries of
emotional distress, lost benefit of the bargain, and, for those Plaintiffs alleging actual
misuse, imminent risk of harm to satisfy the concrete injury element for Article III
standing.
2. Plaintiffs allege injuries that are traceable to SWC’s and PAI’s
conduct.
“[W]here a causal relation between injury and challenged action depends
upon the decision of an independent third party . . . , standing is not precluded, but
it is ordinarily substantially more difficult to establish.” 	California v. Texas, 593
U.S. 659, 675 (2021) (internal quotation marks and citations omitted). 	However,
traceability in the context of standing is not the equivalent of proximate cause. K.P.,
627 F.3d at 123 (citing Bennett, 520 U.S. at 168-69). Plaintiffs demonstrate standing
if they plead that their injury is “connected” to Defendants’ wrongful conduct. Hulse
v. Acadian Ambulance Serv. Inc., No. 6:24-CV-01011, 2025 WL 1453847, at *10
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 17 of 46

18
(W.D. La. May 19, 2025) (stating “[t]raceability entails a connectedness—less than
proximate 	cause—of the 	plaintiff’s 	injury 	to 	the defendant’s 	conduct” 	. 	. 	.
“[p]roximate cause . . . is a determination for trial.”). Traceability may be established
where a defendant’s actions had a “determinative or coercive effect upon the action
of someone else.” 	Bennett, 520 U.S. at 169. 	This means “the defendant's actions
[need not be] the very last step in the chain of causation.” Id.
Here, 	Plaintiffs 	allege 	their 	injuries, 	including 	emotional 	distress, 	are
“traceable to the Data Breach,” were “caused by the Data Breach,” and occurred
“because of the Data Breach.” ECF 70 e.g., ¶¶ 211, 263, 272. 344. Specifically,
Plaintiffs have pleaded that, but for SWC’s and PAI’s failures, the Data Breach
would not have occurred, and due to the prevalence of cybercrime, the Data Breach
was a foreseeable result of SWC’s and PAI’s failure to properly vet VSI.8 	Id. ¶¶
610-15, 681, 686. 	Thus, two separate third-party actions occurred between SWC
and PAI’s decision to hire VSI and Plaintiffs’ alleged injuries. 	Moving upstream
from the injury, Plaintiffs allege that VSI failed to implement proper data security
measures, which in turn allowed third-party cybercriminals to acquire their PI. See
8 Plaintiffs include multiple general allegations that VSI obtained their data through SWC and PAI,
but only five Plaintiffs (Clarke, Sanchez, Holcomb, Hendricks, and Wheaton) allege facts
specifically linked to SWC and PAI. Compare, e.g., ECF 70 ¶¶ 11, 114, 197 (“As a result of PAI
and SWC failing to ensure VSI implemented adequate data security practices . . . all Plaintiffs and
Class Members have suffered and will continue to suffer the following actual injuries and
damages”), 610, 627, 638 (“Plaintiffs . . . would not have provided and entrusted their [PI] to
Defendants . . .” [emphasis added]), 662, and id. ¶¶ 255, 265, 544, 552, 562. However inartfully
drafted, the Second Amended Complaint’s allegations are sufficient at the pleading stage.
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 18 of 46

19
ECF 70 ¶¶ 12-13. 	Next, Plaintiffs claim SWC and PAI failed to properly vet and
monitor VSI’s security measures, actions they claim would have prevented the data
breach, and therefore make VSI’s security failures traceable to SWC and PAI. Id.
Despite the actions of third-party cybercriminals, Plaintiffs’ injuries are
traceable to VSI, at least for purposes of the standing analysis. 	See Cabezas, 2025
WL 2053287, at *8 (explaining “the pleading standard for [traceability] can be met
where plaintiffs” pleaded “(1) the defendant failed to secure his private information;
(2) its network was subsequently hacked; (3) the plaintiff's private information was
stolen by hackers; and (4) the plaintiff became the victim of the pled injury in fact.”
[internal quotation marks and brackets removed]); Smith v. Am. Pain & Wellness,
PLLC, 747 F. Supp. 3d 989, 1003 (E.D. Tex. 2024) (finding traceability where
plaintiff 	alleged 	defendant’s 	“actions 	led 	to 	the 	disclosure 	of 	their 	private
information” in a data breach); Hulse, 2025 WL 1453847, at *10 (finding traceability
where plaintiffs alleged the data breach “would not have happened but for
[defendant’s] alleged security failures”); Galaria v. Nationwide Mut. Ins. Co., 663
F. App'x 384, 390 (6th Cir. 2016) (finding traceability because “[a]lthough hackers
are the direct cause of Plaintiffs’ injuries, the hackers were able to access Plaintiffs’
data only because Nationwide allegedly failed to secure the sensitive personal
information entrusted to its custody,” also noting the “conclusion is consistent with”
decisions by the Seventh, Ninth, and Eleventh Circuits).
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 19 of 46

20
These traceable injuries can extend to defendants who contracted with but
failed to monitor, the defendant who suffered the data breach. In the case of In re
Fortra File Transfer, defendant “NationsBenefits contracted with [defendant] Fortra
for use of Fortra's managed file transfer[;]” Fortra later suffered a data breach
allegedly caused by its negligence. 	In re Fortra File Transfer Software Data Sec.
Breach Litig., 749 F. Supp. 3d 1240, 1254 (S.D. Fla. 2024). 	The court found that
even though Fortra’s system was impacted, plaintiffs’ injuries were traceable to
NationsBenefits because plaintiffs alleged it failed “to protect, maintain, and
monitor” the software it purchased from Fortra. 	Id. at 1261–62 (“Indeed, the
allegations here are much like an individual purchasing a home alarm system and
failing to change the default password.”). Plaintiffs here similarly pleaded that SWC
and PAI knew about the risk of cybercrime and yet failed to ensure VSI, the vendor
to whom they entrusted employee PI, took adequate security measures. See ECF 70
¶¶ 11-15. Because it was predictable to SWC and PAI that VSI might not employ
industry 	security 	standards, 	VSI’s 	intervening 	actions 	do 	not 	preclude 	the
traceability of Plaintiffs’ injuries to SWC and PAI.
3. Plaintiffs allege injuries that are redressable.
In addition, Plaintiffs’ injuries are redressable by money damages. Smith, 747
F.Supp. 3d at 1003 (holding injury redressable where “[n]amed Plaintiffs have
alleged that monetary relief would compensate them”); Perlaki, 2025 WL 754503,
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 20 of 46

21
at *6 (finding that damages could redress the emotional distress of fear for financial
security as a result of a data breach).
As a matter of pleading, Plaintiffs have alleged the constitutional minimum of
a concrete injury, traceable to Defendants’ conduct, and redressable by the Court.9
The Court recommends that SWC and PAI’s Motion to Dismiss for lack of standing
be denied. The Court next addresses whether Plaintiffs have stated a plausible claim
for relief on any of its causes of action against SWC and PAI.
III. 	SWC and PAI’s Rule 12(b)(6) Motion to Dismiss Should Be Granted
in Part, Denied in Part.
A. Legal standard for dismissal under Rule 12(b)(6).
To survive a Rule 12(b)(6) motion to dismiss, the plaintiff must plead “enough
facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly,
550 U.S. 544, 570 (2007). “A claim has facial plausibility when the plaintiff pleads
factual content that allows the court to draw the reasonable inference that the
defendant is liable for the conduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678
(2009); Gonzalez v. Kay, 577 F.3d 600, 603 (5th Cir. 2009). In reviewing a motion
to dismiss under Federal Rule of Civil Procedure 12(b)(6), this Court “‘accepts all
well-pleaded facts as true, viewing them in the light most favorable to the plaintiff.’”
9 Having found that Plaintiffs have standing to pursue their substantive claims, the Court addresses
Plaintiffs’ derivative claims for declaratory judgment and injunctive relief in connection with its
12(b)(6) analysis below. See Adegbenro, 2023 WL 4275507, at *15.
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 21 of 46

22
Alexander v. AmeriPro Funding, Inc., 848 F.3d 698, 701 (5th Cir. 2017) (citing
Martin K. Eby Constr. Co. v. Dallas Area Rapid Transit, 369 F.3d 464, 467 (5th Cir.
2004)). However, the court does not apply the same presumption to conclusory
statements or legal conclusions. Iqbal, 556 U.S. at 678-79.
Generally, the court may consider only the allegations in the complaint and
any attachments thereto in ruling on a Rule 12(b)(6) motion. If a motion to dismiss
refers to matters outside the pleading it is more properly considered as a motion for
summary judgment. See FED. R. CIV. P. 12(d). However, the court may take judicial
notice of public documents, and may also consider documents a defendant attaches
to its motion to dismiss under 12(b)(6) if the documents are referenced in the
plaintiff’s complaint and central to the plaintiffs’ claims. See Norris v. Hearst
Trust, 500 F.3d 454, 461 n.9 (5th Cir. 2007); Collins v. Morgan Stanley Dean Witter,
224 F.3d 496, 498-99 (5th Cir. 2000); King v. Life Sch., 809 F. Supp. 2d 572, 579
n.1 (N.D. Tex. 2011).
B. SWC and PAI’s Motion to Dismiss Plaintiffs’ negligence/negligence
per se claims should be granted.
Under Texas law, the elements of a negligence claim are: (1) a legal duty, (2)
breach of that duty, and (3) damages proximately resulting from the breach. Elephant
Ins. Co., LLC v. Kenyon, 644 S.W.3d 137, 144 (Tex. 2022). 	Negligence per se is
not a separate cause of action but rather a method of proving a breach by defining
the standard of care by statute instead of a common law test. See Thomas v. Uzoka,
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 22 of 46

23
290 S.W.3d 437, 444-45 (Tex. App.—Houston [14th Dist.] 2009) (pet denied.). “To
establish negligence per se, a plaintiff must prove: (1) the defendant's act or omission
is in violation of a statute or ordinance; (2) the injured person was within the class
of persons which the ordinance was designed to protect; and (3) the defendant's act
or omission proximately caused the injury.” Ambrosio v. Carter's Shooting Ctr., Inc.,
20 S.W.3d 262, 265 (Tex. App. 2000).
SWC and PAI argue they do not owe a common law or statutory duty to
Plaintiffs. ECF 77. Plaintiffs argue that SWC and PAI owed a duty of care to “use
reasonable means to secure and safeguard” Plaintiffs’ private information. ECF 70
¶ 594. They assert that Defendants breached this duty under a negligence per se or
common law test by failing to ensure VSI provided reasonable data security
practices. Id. ¶¶ 603, 610. Plaintiffs claim that but for Defendants’ breach of duty,
the data breach causing their damages would not have occurred. Id. ¶¶ 610, 614-15.
Generally, Texas common law does not impose a duty to control the conduct
of a third party. Greater Houston Transp. Co. v. Phillips, 801 S.W.2d 523, 525 (Tex.
1990). 	Texas law recognizes certain relationships that, in limited circumstances,
provide exceptions to this general rule, including “the relationship between . . .
independent contractor and contractee under special circumstances.” 	Id. 	Plaintiffs
allege VSI is an independent contractor for SWC and PAI. 	ECF 70 ¶ 679. 	SWC
and PAI can be liable for the negligent acts of VSI only if they “retain[ed] the right
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 23 of 46

24
to control” VSI’s work. Id.; see also Dow Chem. Co. v. Bright, 89 S.W.3d 602, 606
(Tex. 2002) (holding a defendant can only “be liable for [their] independent
contractor’s acts . . . [if they have] the right to control the means, methods, or details
of the independent contractor's work” [internal quotation marks omitted]).
The Second Amended Complaint fails to allege any facts showing that SWC
or PAI maintained control over VSI’s work—management of Plaintiffs’ data. The
parties cite no Texas authority holding that a party’s putative duty to safeguard
private data extends to safeguarding private data in the possession of an independent
contractor. This case presents no justification for expanding the Texas common law
to create such a duty. 	See Massage Heights Franchising, LLC v. Hagman, 712
S.W.3d 615, 623 (Tex. 2025) (refusing to expand Phillips to find a duty different
than the existing common law duty involving independent contractor liability).
Plaintiffs’ arguments in their Response blur the line between their general
negligence claim and their negligent hiring claim. 	See ECF 78 at 16. 	Texas law
recognizes a cause of action for the negligent hiring of independent contractors.
Adhikari v. KBR Inc., No. 4:16-CV-2478, 2017 WL 4237923, at *10 (S.D. Tex. Sept.
25, 2017) (citing Mireles v. Ashely, 201 S.W.3d 779, 782 (Tex. App.—Amarillo
2006) (no pet.)). 	Yet, where SWC and PAI did not supervise or control VSI’s work,
no separate duty required them to ensure that VSI employed proper data security.
See Castro v. Hermanos Morales Ranch, No. 01-40733, 2001 WL 1692465 (5th Cir.
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 24 of 46

25
Nov. 26, 2001) (explaining that employers of independent contractors do not have a
duty to supervise except where they retain some control over the work). 	Plaintiffs
have not pleaded a cognizable breach of a legal duty owed by SWC and PAI and
their Motion to Dismiss Plaintiffs’ negligence/negligence per se claims should be
granted.10 See Elephant Ins. Co., 644 S.W.3d at 144.
C. SWC and PAI’s Motion to Dismiss Plaintiffs’ negligent hiring
claims should be denied.
Texas law requires the employing party to use ordinary care in hiring a
contractor. Freyer v. Lyft, Inc., 639 S.W.3d 772, 784 (Tex. App.—Dallas 2021) (no
pet.). 	The elements of a negligent hiring claim under Texas law are: “(1) the
employer knew or should have known that the contractor was incompetent, and (2)
a third person was injured because of the contractor's incompetence.” Id. As with
other negligence claims, a plaintiff must show cognizable damages from the
negligent hiring which were proximately caused by the breach of the duty of care.
See Phillips v. Super Servs. Holdings, LLC, 189 F. Supp. 3d 640, 648 (S.D. Tex.
2016).
According 	to 	Plaintiffs, 	SWC 	and 	PAI 	should 	have 	known 	VSI 	was
incompetent because VSI did not follow industry standards such as encrypting or
10 Having not found a duty, the Court does not address negligence per se as to SWC and PAI.
Negligence per se is a means of satisfying the element of breach; it does not create a duty. See
Thomas, 290 S.W.3d at 445.
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 25 of 46

26
redacting stored data. 	ECF 70 ¶¶ 12-15, 680. 	Plaintiffs allege SWC and PAI did
not vet VSI or investigate its data security protocols. 	Id. ¶ 679. 	Plaintiffs further
allege that VSI’s incompetence injured them. Id. ¶ 688.
Plaintiffs’ Second Amended Complaint states a claim against SWC and PAI
for negligent hiring. Plaintiffs allege SWC and PAI breached their duty of ordinary
care by not inquiring about VSI’s data security protocols given the foreseeable risk
of a data breach. 	They allege that VSI’s data security failures allowed hackers to
exfiltrate Plaintiffs private information, an allegation which satisfies the element of
proximate cause at the pleading stage. See Cabezas, 2025 WL 2053287, at *11
(finding proximate cause where the complaint “alleged deficiencies made the data
breach possible.”). Plaintiffs pleaded economic and emotional distress damages, at
least some of which are cognizable. See ECF 70 ¶ 688 (alleging in connection with
negligent hiring claim that plaintiffs have suffered “damages, including, without
limitation, loss of the benefit of the bargain, exposure to heightened future risk of
identity theft, loss of privacy, diminution in value of their Private Information, and
actual misuse of their Private Information.”).
D. SWC and PAI’s Motion to Dismiss Plaintiffs’ unjust enrichment
claims should be granted.
Under Texas law, unjust enrichment is an equitable theory of recovery that
permits a plaintiff to recover a benefit conferred on another if that party “obtained a
benefit from another by fraud, duress, or the taking of an undue advantage.” Digital
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 26 of 46

27
Drilling Data Sys., L.L.C. v. Petrolink Servs., Inc., 965 F.3d 365, 379–80 (5th Cir.
2020) (internal quotation marks omitted) (citing Heldenfels Bros., Inc. v. City of
Corpus Christi, 832 S.W.2d 39, 41 (Tex. 1992)). It is not enough to show merely
“that a party to a contract has made a profit.” 	Burlington N. R. Co. v. Sw. Elec.
Power Co., 925 S.W.2d 92, 97 (Tex. App.—Texarkana 1996) (pet. granted), aff'd
sub nom. Sw. Elec. Power Co. v. Burlington N. R.R. Co., 966 S.W.2d 467 (Tex.
1998). 	Further, the remedy of unjust enrichment “is unavailable when a valid,
express contract governing the subject matter of the dispute exists.” Id.
Plaintiffs allege they conferred a monetary benefit on SWC and PAI in the
form of their private information. 	ECF 70 ¶ 657. 	They claim SWC and PAI
“enriched themselves by saving the costs they reasonably should have expended on
a vendor . . . with adequate security measures,” and that they acquired the
information “through inequitable means” because they failed to investigate VSI’s
practices. Id. ¶¶ 662, 660.
Plaintiffs fail to state an unjust enrichment claim because they do not allege
“fraud, duress, or undue advantage.” Instead, Plaintiffs allege negligence and breach
of an implied contract. Further, district courts within the Fifth Circuit have held that
obtaining PI is not the type of “benefit” that supports and unjust enrichment claim.11
11 Two Plaintiffs, Sanchez and Clarke, pleaded that SWC obtained their PI through their own or a
relative’s employment with SWC. 	ECF 70 ¶¶ 255, 265. The law is unsettled on the issue of
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 27 of 46

28
See Logan, 2024 WL 3489208, at *10–11; Cabezas, 2025 WL 2053287, at *12.
Therefore, SWC and PAI’s Motion to Dismiss Plaintiffs’ unjust enrichment claim
against them should be granted.
E. SWC and PAI’s’ Motion to Dismiss Plaintiffs’ breach of implied
contract claims should be granted.
Under Texas law, the elements of contract formation and breach remain the
same whether the contract is express or implied. See Electrostim Med. Servs., Inc. v.
Health Care Serv. Corp., 614 F. App'x 731, 744 (5th Cir. 2015) (citing Plotkin v.
Joekel, 304 S.W.3d 455, 476 (Tex. App.—Houston [1st Dist.] 2009) (pet. denied)).
The formation of a valid contract requires that: “(1) an offer was made; (2) the other
party accepted; (3) the parties had a meeting of the minds; (4) each party consented;
and (5) the parties executed and delivered the contract with the intent that it be
mutual and binding.” 	Box v. PetroTel, Inc., 33 F.4th 195, 202 (5th Cir. 2022)
(cleaned up) (citing USAA Texas Lloyds Co. v. Menchaca, 545 S.W.3d 479, 502
(Tex. 2018)). The elements for a breach of contract are: “(1) the existence of a valid
whether providing PI to facilitate employment is a “benefit” for purposes of unjust enrichment
Compare Perlaki, 2025 WL 754503, at *9 (rejecting the argument that plaintiff conferred a benefit
on defendant by providing his information to facilitate employment which in turn supported
defendant’s business), with Morrow, 2025 WL 2816760, at *15 (calling the argument “weak, [but]
. . . not so weak as to face dismissal at this stage”), and Hays v. Frost & Sullivan, Inc., No. SA-23-
CV-01490-FB, 2024 WL 4052741, at *13 	(W.D. Tex. Aug. 16, 2024) (allowing the claim to
proceed past pleading stage because “Defendant has not provided the Court with any [contrary]
authority”), report 	and 	recommendation 	adopted, No. 	CV 	SA-23-CA-1490-FB, 	2024 	WL
4047166 (W.D. Tex. Sept. 4, 2024). The Court need not decide this issue because the claim fails
for lack of pleading fraud, duress, or undue advantage.
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 28 of 46

29
contract; (2) performance or tendered performance by the plaintiff; (3) breach of the
contract by the defendant; and (4) damages sustained by the plaintiff as a result of
the breach.” Mullins v. TestAmerica, Inc., 564 F.3d 386, 418 (5th Cir. 2009) (citing
Aguiar v. Segal, 167 S.W.3d 443, 450 (Tex. App.—Houston [14th Dist.] 2005) (pet.
denied)).
In support of their breach of implied contract claims against SWC and PAI,
Plaintiffs assert that SWC and PAI “required Plaintiffs . . . to provide and entrust
their Private Information to Defendants as a condition of obtaining services, benefits,
and/or employment.” ECF 70 ¶ 618. 	Plaintiffs contend that a valid contract was
formed when they agreed to provide their personal information and Defendants
agreed to collect, maintain, and profit from that information. 	Id. ¶¶ 620, 629.
Plaintiffs allege that, as part of the agreement, Defendants promised to protect their
information against unauthorized disclosure. Id. ¶¶ 621-23. 	Plaintiffs also allege
they reasonably expected SWC and PAI to vet VSI per the terms of the contract. Id.
¶¶ 626-28. Plaintiffs claim SWC and PAI materially breached the contract by failing
to ensure VSI maintained proper security protocols. Id. ¶¶631-34. Plaintiffs contend
that due to the breach, they were damaged “in an amount at least equal to the
difference in the value of the services . . . promised and that which they received.”
Id. ¶ 365.
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 29 of 46

30
Even if the Court were to accept the allegations in the Second Amended
Complaint as sufficiently pleading an offer and acceptance, the Second Amended
Complaint still fails to allege facts demonstrating the existence of a valid implied
contract between Plaintiffs and SWC or PAI. No allegations in the Second Amended
Complaint plausibly suggest a meeting of the minds. 	In Logan, the district court
held that “plaintiffs alleging existence of an implied contract must provide some
evidence 	from 	which 	one 	could 	plausibly 	infer 	that 	defendant 	intended 	to
contractually bind itself to a general standard of reasonable care or any particular
cybersecurity standard or protocol by accepting receipt of plaintiff's personal
information.” 2024 WL 3489208, at *9 (internal quotation marks and citations
omitted).
Further, Plaintiffs’ assertion that SWC and PAI “promised to protect their
information” as part of a contractual relationship is wholly conclusory. 	Plaintiffs
allege facts showing only that they assumed SWC and PAI would protect their PI.
Indeed, most Plaintiffs do not allege any relationship with SWC or PAI that would
support the inference that Plaintiffs and SWC/PAI had a meeting of the minds
regarding an implied contract for data protection. 	The few who mention SWC or
PAI in their individual allegations, (Clark, Sanchez, Holcomb, Hendricks, and
Wheaton), provide no details about the circumstances under which they provided PI
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 30 of 46

31
to SWC or PAI.12 	Other district courts have held in the data-breach context that
employees’ breach of implied contract claims fail against their employers “where a
plaintiff's pleadings do not identify any company-specific documents or policies
from which one could infer an implied contractual duty to protect the plaintiff's
personal information.” Hays, 2024 WL 4052741, at *10. See also Morrow, 2025 WL
2816760, at *16 (dismissing claim where plaintiff “provides no language from any
contractual agreement nor any other factual circumstances that suggest that either
party contemplated data security before entering either a service or employment
agreement” and noting that “[t]his flaw is remarkable as several courts have denied
motions to dismiss, particularly in the employer-employee context, when plaintiffs
could point to documents addressing the employer's policies as to data retention and
protection.”).
Plaintiffs vague, conclusory allegations here do not state a claim for breach of
an implied contract. 	See Gorman v. Ethos Grp. Inc., No. 3:22-CV-02573-M, 2024
WL 1257493, at *4 (N.D. Tex. Mar. 25, 2024) (granting a motion to dismiss where
“[t]he Complaint contains only vague and unspecific descriptions of the relationship
and interactions between Plaintiffs and Defendant, and thus lacks the sufficiency
necessary to state a claim for implied contract or unjust enrichment.”). Therefore,
12 Clarke alleges his wife is a former SWC employee (ECF 70 ¶ 255); Sanchez alleged she is a
former SWC employee (id. ¶ 265); Holcomb, Hendricks, and Wheaton allege “upon information
and belief” that VSI obtained their PI through PAI, giving no further details. Id. ¶¶ 544, 552, 562.
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 31 of 46

32
SWC and PAI’s Motion to Dismiss Plaintiffs’ breach of implied contract claim
should be granted.
F. SWC 	and 	PAI’s 	Motion 	to 	Dismiss 	Plaintiffs’ 	declaratory
judgment/injunctive relief claims should be granted.
Plaintiffs assert a claim under the Declaratory Judgment Act, 28 U.S.C. §
2201(a). As to SWC and PAI, Plaintiffs seek declarations that (1) “PAI and SWC
owed—and continue to owe—a legal duty to ensure any vendors and/or contractors
they hire use reasonable data security to secure the Private Information entrusted to
them;” and (2) “PAI and SWC breached, and continue to breach, their duties by
failing to ensure the vendors and/or contractors it utilizes deploy adequate data
security and/or by willingly using vendors and/or contractors who fail to use
reasonable measures to protect the Private Information[.]” ECF 70 ¶ 671. Plaintiffs
also seek an injunction requiring “PAI and SWC to use vendors and/or independent
contractors with adequate security consistent with industry standards.” Id. ¶ 672.
“Courts in the Fifth Circuit . . . regularly reject claims for declaratory
judgment that seek nothing more than resolution of issues already stated in the
lawsuit.” Nextera Energy Mktg. LLC v. Shell Energy N. Am. (US) LP, No. 4:21-CV-
02280, 2023 WL 2541964, at *3 (S.D. Tex. Mar. 16, 2023) (citing Am. Equip. Co.
v. Turner Bros. Crane & Rigging, LLC, No. 4:13-CV-2011, 2014 WL 3543720, *4
(S.D. Tex. July 14, 2014) (collecting cases)). Here, Plaintiffs seek declarations that
will necessarily be included in the legal conclusions and factual findings in
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 32 of 46

33
connection with Plaintiffs’ remaining claim against SWC and PAI, the claim for
negligent hiring. Therefore, Plaintiffs’ requests for declaratory judgment regarding
SWC’s and PAI’s alleged breach of duties should be dismissed.
“[A] person exposed to a risk of future harm may pursue forward-looking,
injunctive relief to prevent the harm from occurring, at least so long as the risk of
harm is sufficiently imminent and substantial.” 	Logan, 2024 WL 3489208, at *8
(quoting TransUnion, 594 U.S. at 435). See also Aransas Project v. Shaw, 775 F.3d
641, 648 (5th Cir. 2014) (“To seek injunctive relief, the plaintiff must show a real
and immediate threat of future or continuing injury apart from any past injury.”).
Plaintiffs allege that Defendants remain in possession of their PI and that they face
harm from future data breaches. ECF 70 ¶¶ 24, 196-97, 672-75 (“Plaintiffs . . . will
suffer irreparable injuries . . . if a second data breach occurs . . . [and] [a]n injunction
would benefit the public by preventing another data breach” [emphasis added]).
Plaintiffs failed to plead facts demonstrating entitlement to injunctive relief,
whether under a 12(b)(1) or 12(b)(6) standard. See Frame v. City of Arlington, 657
F.3d 215, 235–36 (5th Cir. 2011) (indicating district court should apply Article III
standing doctrine in discussion of injunctive relief where defendant contested
imminence via 12(b)(6) motion). None of the pleaded facts indicate that a second
data breach is imminent, so any future harm is speculative. See In re ESO Sols., Inc.
Breach Litig., No. 1:23-CV-1557-RP, 2024 WL 4456703, at *8 (W.D. Tex. July 30,
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 33 of 46

34
2024) (finding conclusory statements that plaintiffs were at risk of future breaches
insufficient to seek injunctive relief). 	Plaintiffs’ allegations of future risk because
“PAI and SWC have not ceased using VSI’s services” (ECF 70 ¶ 195, see also id. ¶
689 (same allegation)) are undermined by the data breach notice Plaintiffs’ allege
they received from VSI, which states:
Upon discovery [of the data breach], VSI immediately took steps
to secure its network and engaged a leading, independent digital
forensics and incident response firm to investigate what happened and
whether any sensitive data may have been impacted. . . . VSI undertook
a comprehensive review of the potentially impacted data to identify the
individuals and information involved . . .
Id. ¶ 92. 	See also Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365,
378 (1st Cir. 2023) (“[A]ny available inference that [defendant’s] prior data breach
might make a future data breach more likely is undercut by the plaintiffs' own
allegation 	that 	‘following 	the 	data 	breach, 	IWP 	implemented 	new 	security
safeguards to prevent and mitigate data breaches -- measures that should have been
in place before the data breach.’” [cleaned up, underlining in original]). Therefore,
the claim for injunctive relief must also be dismissed. 	See, e.g., 	Bienville
Orthopaedic, 737 F. Supp. 3d at 426 (dismissing declaratory and injunctive relief
because plaintiffs failed to allege facts tending to show a second data breach was
impending or there was a substantial risk of one); Hulse, 2025 WL 1453847, at *9
(“[T]his Court finds that Plaintiffs lack standing to seek injunctive relief based on
the prospect of future cyberattacks.”); Hemphill v. Horne, LLP, No. 3:24-CV-178-
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 34 of 46

35
KHJ-ASH, 2025 WL 837007, at *3 (S.D. Miss. Mar. 10, 2025) (“[Plaintiffs] also
lack standing to bring their injunctive claims because they have not shown an
immediate threat of another data breach.”).
IV. 	VSI’s Rule 12(b)(6) Motion to Dismiss Should Be Granted in Part,
Denied in Part.
A. VSI’s Motion to Dismiss Plaintiffs’ negligence claims should be
denied and the Motion to Dismiss Plaintiff’s negligence per se
claims should be granted.
To repeat, the elements of a negligence claim are: (1) a legal duty, (2) breach
of that duty, and (3) damages proximately resulting from the breach. Elephant Ins.
Co., 644 S.W.3d at 144. 	Negligence per se is not a separate cause of action but a
method of proving breach by defining the standard of conduct by statute instead of
by a common law test. See Thomas, 290 S.W.3d at 444-45.
Plaintiffs allege VSI possessed their private information, eliminating their
ability to protect the information themselves. ECF 70 ¶ 589, 591-96. Plaintiffs claim
they were the foreseeable victims of cybercrime caused by VSI’s inadequate security
measures. Id. ¶¶ 591-96. Plaintiffs assert that VSI owed them a duty of reasonable
care to safeguard and store their private information and prevent its exposure to
unauthorized persons. Id. They contend VSI breached its duty “by failing to encrypt
or timely delete the Private Information from its networks, . . . failing to timely or
adequately notify or warn Plaintiffs,” failing to properly train its employees, monitor
its networks, or periodically check its security. 	ECF 70 ¶ 602, 609. Plaintiffs also
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 35 of 46

36
assert a negligence per se claim based on HIPAA and FTC Act. 	Id. ¶¶ 604-6. See
15 U.S.C. § 45; 42 U.S.C. §§ 1302d et seq.
1. Plaintiffs have sufficiently alleged that VSI owed a duty to
protect Plaintiffs’ PI.
Plaintiffs have pleaded facts demonstrating that, under Texas common law
principles, VSI owed them a duty to take reasonable care in safeguarding Plaintiffs’
PI. 	See Phillips, 801 S.W.2d at 525 (“In determining whether the defendant was
under a duty, the court will consider several interrelated factors, including the risk,
foreseeability, and likelihood of injury weighed against the social utility of the
actor's conduct, the magnitude of the burden of guarding against the injury, and the
consequences of placing the burden on the defendant.”); see also Hawkins, 2025 WL
2244327, at *8 (noting Plaintiffs’ allegations regarding statutory and industry
standards for security measures to prevent data breaches); In re ESO, 2024 WL
4456703, *9–10 (explaining that plaintiffs plausibly alleged a duty where defendant
held personal information, the risk of breach was foreseeable because healthcare data
companies are known targets of hacking, and defendant was best suited to ensure
reasonable and effective data security); Cabezas, 2025 WL 2053287, at *10–11
(applying Texas common law and finding in a case brought by customers that “a
corporation has a duty to safeguard [private information] it chooses to retain”
because the “foreseeable risk [of data breaches] could be avoided by the exercise of
ordinary care”).
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 36 of 46

37
2. Plaintiffs have sufficiently alleged VSI breached its common law
duty of care, but have not sufficiently alleged negligence per se.
Plaintiffs allege VSI failed to encrypt or delete Plaintiffs’ information, failed
to adequately train its employees, and failed to properly notify or warn Plaintiffs.
ECF 70 ¶¶ 602, 609. At this stage, these allegations of cyber security failures and
violations of alleged industry best practices are enough to survive the motion to
dismiss. 	Id. ¶ 608. 	See Cabezas, 2025 WL 2053287, at *11 (finding the same
“sufficient to meet the pleading standard for breach”). Furthermore, although a duty
of care does not ordinarily extend to a third-party criminal action, “Texas law
recognizes that ‘if a criminal’s conduct is a foreseeable result of [a party’s prior
negligence] the criminal act may not excuse that party’s liability.’” In re Eso, 2024
WL 4456703 at *10 (citing Barton v. Whataburger, Inc., 276 S.W.3d 456, 462 (Tex.
App. – Houston [1 st . Dist.] 2008) (pet. denied)).
However, Plaintiffs’ negligence per se theory based on HIPAA and FTC Act
violations cannot survive VSI’s Motion to Dismiss. ECF 70 ¶¶ 604-6. 	The Texas
Supreme Court held in Smith v. Merritt, 940 S.W.2d 602, 608 (Tex. 1997) that a
statute does not establish negligence per se where the legislature has not created a
private right of action. See Fulton v. Hecht, 580 F.2d 1243, 1248 n.2 (5th Cir. 1978)
(holding “there is no private cause of action for violation of the FTC Act.”); Acara
v. Banks, 470 F.3d 569, 571 (5th Cir. 2006) (holding HIPAA “does not support a
private right of action.”); Smith, 747 F. Supp. 3d at 1004–05 (finding in a data breach
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 37 of 46

38
case that “neither the FTC Act nor HIPAA is an appropriate basis for a negligence
per se claim”); Lowman v. Enter. Fin. Grp., Inc., No. 3:24-CV-2752-L (BK), 2025
WL 2994737, at *6 (N.D. Tex. Aug. 12, 2025) (same for FTC Act), report and
recommendation adopted, No. 3:24-CV-02752-L, 2025 WL 2778380 (N.D. Tex.
Sept. 30, 2025). 	“[W]hile . . . violations of HIPPAA or the FTC Act may speak to
the relevant standard of care, they cannot show an automatic breach of duty to
establish negligence per se.” In re Eso, 2024 WL 4456703, at *11.
3. Plaintiffs have sufficiently alleged causation.
Plaintiffs claim the data breach would not have occurred but for VSI’s
negligent breach of its duty of care, and therefore, Plaintiffs would not have been
injured absent that breach. 	ECF 70 ¶ 611. 	Plaintiffs assert their injuries were a
foreseeable result of a cyberattack substantially caused by VSI’s negligent failure to
adhere to proper data security protocols. 	Id. ¶¶ 612-14. 	Plaintiffs allege their
injuries were the direct and proximate result of VSI’s negligence. Id. ¶¶ 614-15.
At this stage, Plaintiffs’ allegations are sufficient to survive a motion to
dismiss on the issue of causation. See Cabezas, 2025 WL 2053287, at *11 (finding
allegation that cyber security failures allowed for data breach and plaintiffs’ injuries
sufficient for causation at the pleading stage); In re ESO, 2024 WL 4456703, at *10;
Gutierrez v. Excel Corp., 106 F.3d 683, 687 (5th Cir. 1997) (“Causation is a question
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 38 of 46

39
of fact for the jury, and the jury has broad latitude to infer proximate cause from the
evidence and circumstances surrounding an event.”).
4. Plaintiffs have sufficiently alleged damages.
As described above, some Plaintiffs allege they suffered actual identity theft
or fraud, and all Plaintiffs allege risk of harm, loss of benefit of the bargain,
mitigation costs, and emotional distress. 	Texas law does not recognize a cause of
action for negligent infliction of mental anguish. 	See Valenzuela v. Aquino, 853
S.W.2d 512, 513 (Tex. 1993) (“No action for negligent infliction of emotional
distress exists in Texas[,]” citing Boyles v. Kerr, 855 S.W.2d 593 (Tex. 1993)).
However, negligently inflicted mental anguish may be an element of recoverable
damages when the defendant violates some other duty to the plaintiff, depending on
the nature of the duty breached and the quality of proof offered by the plaintiff. 	City
of Tyler v. Likes, 962 S.W.2d 489, 494 (Tex. 1997). Because Plaintiffs have asserted
multiple theories of damage, the Court declines to recommend dismissal of the
mental anguish claims before knowing the damages Plaintiffs may ultimately prove.
See Cabezas, 2025 WL 2053287, at *7, 11; see also Hawkins, 2025 WL 2244327,
at *8 (finding damages sufficiently alleged where plaintiffs asserted data was sold
or exposed on dark web and they suffered increased risk of future harm).
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 39 of 46

40
B. VSI’s Motion to Dismiss Plaintiffs’ breach of implied contract
claim should be granted.
Plaintiffs allege VSI required them to provide their private information to
obtain services and that implied contracts were formed when they agreed to provide
their data and VSI agreed to collect it. Id. ¶¶ 618-20. Plaintiffs allege VSI promised
to protect their information as part of these contracts, as outlined in VSI’s “privacy
policy.” Id. ¶¶ 63, 622, 630. 	Plaintiffs further contend that by not fulfilling its data
security obligations, VSI breached the contract and injured Plaintiffs. Id. ¶ 635.
Plaintiffs’ breach of implied contract claim against VSI fails for the same
reasons the breach of implied contract claims against SWC and PAI fail: no
allegations support a finding that Plaintiffs and VSI came to meeting of the minds.
See Logan, 2024 WL 3489208, at *8. 	In addition, as to VSI, it is impossible to
assume the existence of offer and acceptance because no Plaintiff alleges any facts
showing a relationship, contractual or otherwise, with VSI. Compare Hawkins, 2025
WL 2244327, at *7 (denying a motion to dismiss because “an implied contract is
sufficiently alleged where the plaintiffs plead that an implied contract was created
in the implied promise to protect [private information] when customers are required
to provide [private information] as a condition of receiving defendant’s services”
[emphasis added]), with ECF 70 ¶ 48 (“Plaintiffs are current or former employees,
or dependents of current or former employees, of companies that contracted with
VSI for third-party benefit administration and data management services prior to
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 40 of 46

41
February 27, 2024; thus, Plaintiffs were and are VSI’s 	ultimate 	customers.”
[emphasis added]). Absent allegations that Plaintiffs were actual customers of VSI,
no contractual relationship has been alleged.
C. VSI’s Motion to Dismiss Plaintiffs’ claim that they were third-
party beneficiaries to VSI’s contracts should be granted.
As an alternative to the implied contract claim, Plaintiffs assert a third-party
beneficiary claim against VSI, but that claim fares no better. Texas law presumes
“that a party contracts only for its own benefit and . . . maintain[s] a presumption
against third-party beneficiary agreements.” Maddox v. Vantage Energy, LLC, 361
S.W.3d 752, 757 (Tex. App.—Fort Worth 2012) (pet. denied). “To establish its
third-party-beneficiary status, the [third party] must demonstrate that the contracting
parties intended to secure a benefit to it and contracted directly for its benefit.” Wal-
Mart Stores, Inc. v. Xerox State & Loc. Sols., Inc., 663 S.W.3d 569, 583 (Tex. 2023).
Receiving an “incidental benefit from a contract . . . does not give . . . a right of
action to enforce the contract.” MCI Telecommunications Corp. v. Texas Utilities
Elec. Co., 995 S.W.2d 647, 651 (Tex. 1999). The intention of the contracting parties
controls. Id.
Plaintiffs allege VSI and VSI’s clients (including SWC and PAI), signed
written 	contracts 	to 	provide 	“third-party 	benefit 	administration 	and 	data
management 	services.” 	ECF 	70 	¶ 	643. 	VSI’s 	clients 	provided 	VSI 	with
compensation and Plaintiffs’ private information, and VSI agreed to safeguard
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 41 of 46

42
Plaintiffs’ information. 	Id. ¶¶ 644-46, 649. 	Plaintiffs further allege that the FTC
Act, HIPAA, and state consumer privacy laws required VSI’s contracts to include
requirements of reasonable security protocols. 	Id. ¶ 647. 	Plaintiffs claim these
statutory requirements “create a class of intended beneficiaries whose members are
implied into such agreements by operation of law.” Id. ¶ 648. Plaintiffs additionally
claim these contracts “were expressly made for the benefit of Plaintiffs . . . as the
intended third-party beneficiaries.” 	Id. ¶¶ 650-51. 	Plaintiffs assert they were
harmed when VSI breached its obligation to provide adequate data security. Id. ¶¶
652-54.
The 	Second 	Amended 	Complaint 	Plaintiffs 	fails 	to 	allege 	more 	than
conclusory facts demonstrating VSI and its clients intended Plaintiffs to be third-
party beneficiaries to the alleged contracts. While Plaintiffs claim the contracts were
“expressly” and “specifically” made for their benefit, they do not reference a contract
provision specifically expressing this purpose. See id. ¶ 650. 	Plaintiffs’ argument
that they are implied third-party beneficiaries based on statutory requirements fails
because Texas courts refuse to “create a third-party beneficiary contract by
implication.” MCI, 995 S.W.2d at 651. 	Even taking as true the allegation in the
Second Amended Complaint that Plaintiffs’ employers contracted with VSI to
manage Plaintiffs’ benefit plans, that allegation cannot convert Plaintiffs into direct,
rather than incidental, beneficiaries. 	See In re ESO, 2024 WL 4456703, at *11
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 42 of 46

43
(dismissing third-party beneficiary claim because plaintiffs, as patients, benefitted
from contract between healthcare providers and defendant patient data storage
company, but failed to allege they were direct beneficiaries). 	Without more, such
as specific contractual language or additional factual allegations, the Second
Amended Complaint fails to state a claim for breach of a third-party beneficiary
contract. See Bruno v. Donohoe as Tr. of Texas Med. Liab. Tr., 754 F. Supp. 3d 737,
749 (W.D. Tex. 2024) (“A parties’ intention is gleaned from the words of their
contract, and not from what they allegedly meant.” [internal citation omitted]).
D. VSI’s Motion to Dismiss Plaintiffs’ unjust enrichment claim should
be granted.
As discussed above in connection with SWC and PAI’s Motion, Plaintiffs’
unjust enrichment claim against VSI fails because Plaintiffs did not confer a benefit
on VSI. 	Plaintiffs allege they conferred “a monetary benefit on Defendants . . .
[s]pecifically, . . . their Private Information,” without which Defendants would not
be able to provide services and earn revenue ECF 70 ¶ 657. Plaintiffs further allege
Defendants accepted the data and then failed to properly secure it. 	Id. ¶¶ 658-59.
Plaintiffs claim VSI “enriched itself by saving the costs it reasonably should have
expended on data security measures to secure” their data. Id. ¶ 661.
The pleaded facts do not support the idea that Plaintiffs conferred a benefit on
VSI. Courts have rejected the idea that a plaintiff’s private information has inherent
value. 	See Logan, 2024 WL 3489208, at *10–11 (dismissing plaintiff’s unjust
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 43 of 46

44
enrichment claim because private information did not constitute conferred benefit
without other consideration, particularly because no consideration was paid for data
security 	services). 	Plaintiffs’ 	enrichment-by-savings 	theory 	is 	similarly
unconvincing. See Cabezas, 2025 WL 2053287, at *12 (discounting argument that
defendant gained undue benefit in the form of money it should have paid for data
security services where plaintiff did not specifically confer monetary benefit for data
protection).
Even assuming, arguendo, that Plaintiffs conferred a benefit on VSI, no
pleaded facts show fraud, duress, or undue advantage. Even if VSI was negligent in
safeguarding Plaintiffs’ data, mere negligence or improper data storage does not
suggest undue advantage. See In re ESO, 2024 WL 4456703, at *11. 	See also
Lowman, 2025 WL 2994737, at *7–8 (explaining that specific facts are required to
show fraud, duress, or undue advantage).
E. VSI’s 	Motion 	to 	Dismiss 	Plaintiffs’ 	declaratory
judgment/injunctive relief claims should be granted.
As to VSI, Plaintiffs seek declarations that:
a. VSI owed—and continues to owe—a legal duty to use reasonable
data security to secure the Private Information entrusted to it;
* 	* 	*
d. VSI breached, and continues to breach, its duties by failing to use
reasonable measures to protect the Private Information entrusted to it
from unauthorized access, use, and disclosure;
* 	* 	*
f. 	Defendants’ 	breaches 	of their duties 	caused—and 	continue 	to
cause—injuries to Plaintiffs and Class Members.
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 44 of 46

45
ECF 70 ¶ 671. Plaintiffs also seek an injunction “requiring VSI to use adequate data
security consistent with industry standards.” Id. ¶ 672.
The Court has recommended dismissal of Plaintiffs claims against VSI other
than their claim for negligence. 	As with SWC and PAI, Plaintiffs’ requests for
declaratory relief simply mirror the elements of Plaintiffs’ negligence claim.
Therefore, the claim for declaratory judgment should be dismissed. In addition, for
the reasons discussed above in connection with SWC and PAI, Plaintiffs’ request for
injunctive relief should also be dismissed.
V. 	Conclusion and Recommendation.
For the reasons stated above, the Court RECOMMENDS that Defendant
VSI’s Motion to Dismiss (ECF 76) be GRANTED IN PART, DENIED IN PART.
Specifically, the Motion should be GRANTED as to Plaintiffs’ claims for negligence
per se, breach of implied contract, breach of third-party beneficiary contract, unjust
enrichment, and declaratory judgment and injunctive relief. The Motion should be
DENIED as to Plaintiffs’ negligence claim against VSI.
The Court further RECOMMENDS that SWC and PAI’s Motion to Dismiss
(ECF 77) be GRANTED IN PART, DENIED IN PART. Defendants’ motion under
12(b)(1) should be DENIED. 	Defendants’ motion under 12(b)(6) should be
GRANTED as to Plaintiffs’ claims for negligence (including under a per se theory),
unjust enrichment, breach of implied contract, and declaratory judgment and
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 45 of 46

46
injunctive relief. 	The motion under 12(b)(6) should be DENIED as to Plaintiffs’
claims against SWC and PAI for negligent hiring.
The 	Clerk 	of 	the 	Court 	shall 	send 	copies 	of 	the 	memorandum 	and
recommendation to the respective parties, who will then have fourteen days to file
written objections, pursuant to 28 U.S.C. § 636(b)(1)(C). 	Failure to file written
objections within the time period provided will bar an aggrieved party from attacking
the factual findings and legal conclusions on appeal. Douglass v. United Servs. Auto.
Ass’n, 79 F.3d 1415, 1428-29 (5th Cir. 1996) (en banc), superseded by statute on
other grounds.
Christina A. Bryan
United States Magistrate Judge
Signed on February 06, 2026, at Houston, Texas.
Case 4:24-cv-03492 Document 93 Filed 02/06/26 in TXSD Page 46 of 46