Fay v. VeriSource Services, Inc.

UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF TEXAS
HOUSTON DIVISION
IN RE: VERISOURCE
SERVICES, INC. DATA
BREACH LITIGATION
§
§
§
§
§
§
§
§
§
CIVIL ACTION NUMBER
4:24-cv-03492
JUDGE CHARLES ESKRIDGE
ORDER ADOPTING
MEMORANDUM AND RECOMMENDATION
This case concerns an alleged data breach of confi-
dential information. Defendant VeriSource Services, Inc,
provides employee benefit plan services. Dkt 70 at ¶3
(second amended complaint). Defendant Southwest Water
Company, LLC, is a customer of VSI, and Defendant
Planned Administrators, Inc, is a benefits administrator
that utilizes VSI services. Dkt 70 at ¶¶4, 52, 64–65.
Plaintiffs, who are current or former employees of
companies who use VSI services, or their dependents,
allege that Defendants failed to properly protect their
confidential information, resulting in its theft by
cybercriminals in February of 2024. Id at ¶¶1–2, 4–5.
VSI moved to dismiss under Rule 12(b)(6) for failure to
plausibly allege that any purported damages are “causally
linked to the cyber incident or VSI.” Dkt 76. Southwest
Water and Planned Administrators together moved to
dismiss under Rule 12(b)(1) for lack of standing and Rule
12(b)(6) for failure to state a claim. Dkt 77.
The matter was referred for disposition to Magistrate
Judge Christina A. Bryan. Dkt 14. She issued a
Memorandum and Recommendation recommending that
VSI’s motion be granted in part and denied in part. Dkt 93.
United States District Court
Southern District of Texas
ENTERED
March 16, 2026
Nathan Ochsner, Clerk
Case 4:24-cv-03492 Document 98 Filed 03/16/26 in TXSD Page 1 of 4

2
She further recommends that the motion by SWC and PAI
under Rule 12(b)(1) be denied, and that the motion under
Rule 12(b)(6) be granted in part and denied in part.
Defendants filed objections. Dkts 94 & 95. VSI argues
that (i) the negligence claims of sixteen Plaintiffs should be
dismissed for failure to sufficiently allege damages, and
(ii) due to the nature of their claims, Plaintiffs cannot
pursue emotional distress damages. Dkt 94. SWC and PAI
argue that (i) Plaintiffs lack standing, and (ii) Plaintiffs
failed to plausibly allege facts to support a negligent hiring
claim. Dkt 95.
The district court reviews de novo those conclusions of
a magistrate judge to which a party has specifically
objected. See FRCP 72(b)(3) & 28 USC § 636(b)(1)(C); see
also United States v Wilson, 864 F2d 1219, 1221 (5th Cir
1989, per curiam). The district court may accept any other
portions to which there’s no objection if satisfied that no
clear error appears on the face of the record. See Guillory v
PPG Industries Inc, 434 F3d 303, 308 (5th Cir 2005), citing
Douglass v United Services Automobile Association, 79 F3d
1415, 1430 (5th Cir 1996, en banc); see also FRCP 72(b)
advisory committee note (1983).
Upon de novo review and determination, Defendants’
objections lack merit.
As to VSI’s objections, they fail because Plaintiffs have
sufficiently alleged damages to support their negligence
claims. Dkt 94. Upon close review, the Memorandum and
Recommendation is well-reasoned and supported in that
regard. See Dkt 93 at 39. All Plaintiffs allege a risk of
harm, loss of benefit of the bargain, mitigation costs, and
emotional distress, which is sufficient to survive dismissal
at this juncture. Dkt 70 at ¶¶614–15. Arguments regarding
emotional distress damages may be renewed at summary
judgment, after discovery and upon an undisputed factual
record, if appropriate and supportable.
As to SWC and PAI’s objections, they are similarly
unavailing. Dkt 95.
Case 4:24-cv-03492 Document 98 Filed 03/16/26 in TXSD Page 2 of 4

3
With respect to standing, SWC and PAI argue that the
Memorandum and Recommendation improperly “conflates
the Plaintiffs who plead injuries but no connection to SWC
or PAI with those Plaintiffs who plead some connection to
SWC or PAI but no injuries and includes the remaining
Plaintiffs who plead neither (no injury and no connection
to SWC or PAI), to find blanket standing.” Dkt 95 at 6. Not
so. The Memorandum and Recommendation thoroughly
analyzed the nuanced case law in this context and
appropriately concluded that all Plaintiffs alleged
cognizable injuries in fact. See Dkt 93 at 10–17. As to
traceability, Plaintiffs plausibly alleged that they were
“required to entrust their sensitive, non-public Private
Information to one or more Defendants and by extension to
VSI,” who ultimately suffered the subject breach. Dkt 70 at
¶6. In addition, Plaintiffs pleaded that, but for SWC and
PAI’s failures, the VSI data breach would not have
occurred and was a foreseeable consequence of their failure
to properly vet and monitor VSI. Id at ¶¶9–13; see Dkt 93
at 19–20. Plaintiffs thus have plausibly alleged that their
injuries are traceable to SWC and PAI, despite the
intervening actions of VSI and cybercriminals. See Dkt 93
at 17–20.
Regarding the negligent hiring claim, SWC and PAI
argue that Plaintiffs failed to plead any facts supporting
their purported failure to “vet or investigate VSI’s data
security protocols.” Dkt 95 at 15. But Plaintiffs did allege
that both Defendants shared confidential information
without “vetting VSI and inquiring about its data security
qualifications.” Dkt 70 at ¶679. And they further allege
that if SWC and PAI had done so, they “would have
discovered VSI did not have data security measures in
place” compliant with recognized industry standards. Id at
¶680. The Memorandum and Recommendation thus
appropriately concluded that the plausible allegations by
Plaintiff in that regard survive dismissal. Dkt 93 at 25–26.
The objections by Defendants to the Memorandum and
Recommendation of the Magistrate Judge are OVERRULED.
Dkts 94 & 95.
Case 4:24-cv-03492 Document 98 Filed 03/16/26 in TXSD Page 3 of 4

4
No clear error otherwise appears upon review and
consideration of the Memorandum and Recommendation,
the record, and the applicable law.
The Memorandum and Recommendation of the
Magistrate Judge is ADOPTED as the Memorandum and
Order of this Court. Dkt 93.
The motion by Defendant VeriSource Services, Inc, to
dismiss is GRANTED IN PART and DENIED IN PART. Dkt 76.
The motion is GRANTED as to the claims for negligence
per se, breach of implied contract, breach of third-party
beneficiary contract, unjust enrichment, declaratory
judgment, and injunctive relief. Those claims are
DISMISSED WITH PREJUDICE.
The motion is DENIED as to the negligence claim
against VSI. That claim will proceed.
The motion to dismiss by Defendants Southwest Water
Company, LLC, and Planned Administrators, Inc, is
GRANTED IN PART and DENIED IN PART. Dkt 77.
The motion is GRANTED as to the claims for negligence
and negligence per se, unjust enrichment, breach of
implied contract, declaratory judgment, and injunctive
relief. Those claims are DISMISSED WITH PREJUDICE.
The motion is DENIED to the extent that it proceeds
under Rule 12(b)(1) for lack of standing. It is also DENIED
as to the negligent hiring claim against SWC and PAI. That
claim will proceed.
SO ORDERED.
Signed on March 16, 2026, at Houston, Texas.
___________________________
Honorable Charles Eskridge
United States District Judge
Case 4:24-cv-03492 Document 98 Filed 03/16/26 in TXSD Page 4 of 4