925 F.3d 955 (8th Cir. 2019)
In 2014, hackers accessed customer financial information from hundreds of retail grocery stores operated by SuperValu, Inc., AB Acquisition, LLC, and New Albertsons, Inc.1 A group of customers sued the stores after two cyberattacks allowed hackers to steal customers’ card information, including their names, credit or debit card account numbers, expiration dates, personal identification numbers, and card verification value codes.2
The first attack occurred in late June and early July 2014 and was announced via a press release on August 14, 2014.3 The second attack took place in late August or early September 2014 and was announced on September 29, 2014.4 Plaintiffs filed multiple putative class actions against the stores, which were consolidated in the United States District Court for the District of Minnesota.5
Defendants moved to dismiss asserting that the court lacked subject-matter jurisdiction because plaintiffs lacked standing and that plaintiffs failed to state a claim.6 The district court granted defendants’ motion under Rule 12(b)(1) and dismissed the complaint without prejudice on January 7, 2016, concluding that none of the plaintiffs had alleged an injury in fact.7 Plaintiffs then filed a motion to alter or amend the judgment under Rule 59(e), attaching three declarations from officers of financial institutions who averred that some payment cards issued by their respective institutions incurred fraudulent charges following the data breaches, but did not attach a proposed amended complaint.8
The district court denied plaintiffs’ Rule 59(e) motion.9 Plaintiffs appealed the district court’s dismissal for lack of subject-matter jurisdiction.10 The Eighth Circuit affirmed the district court’s dismissal of all of the named plaintiffs for lack of standing, except for David Holmes.11 Holmes used his credit card at a Shop ’n Save store operated by SuperValu in Belleville, Illinois.12 Shortly after the data breaches were announced, Holmes noticed a fraudulent charge on his credit card statement and immediately cancelled his credit card.13
On remand, defendants renewed their motion to dismiss.14 Plaintiffs filed a second motion for leave to amend that included a proposed amended complaint adding general allegations about the likelihood of identity theft following a data breach based on the same three affidavits.15 The district court denied plaintiffs’ motion for leave to amend, reasoning that futility and undue delay compelled denial under Rule 15(a)(2).16 The court dismissed all claims against AB Acquisition and New Albertsons because Holmes did not shop at an Albertsons store and dismissed Holmes’s negligence, consumer protection, implied contract, and unjust enrichment claims under Rule 12(b)(6).17
Plaintiffs appealed the denial of the motion for leave to amend and the dismissal of the claims.18 The motion was filed on November 7, 2017, a year and ten months after the district court’s original judgment.19
Whether plaintiffs’ motion for leave to amend the complaint after the initial dismissal must be treated as a postjudgment motion subject to Rule 59(e) or Rule 60(b) standards?20
A motion for leave to amend after dismissal is subject to different considerations than a motion prior to dismissal.21 Leave to amend should be granted liberally under Rule 15 prior to dismissal.22 After judgment has been entered, district courts may not ignore the considerations of Rule 15, but leave to amend a pleading will be granted only if it is consistent with the stringent standards governing the grant of Rule 59(e) and Rule 60(b) relief.23 Even if a dismissal is without prejudice, if the court intended the decision to be a final, appealable order, it constitutes dismissal of the entire action, and the more stringent postjudgment standards apply.24
Yes. The district court’s original dismissal on January 7, 2016 constituted a final, appealable order dismissing the entire action.25 Plaintiffs acknowledged as much by styling their initial motion to amend as a motion under Rule 59(e) and by appealing the district court’s judgment of dismissal to this court.26 Plaintiffs’ proposed amendments relate only to the claims of the previously-dismissed plaintiffs and do not contain any new allegations specific to Holmes.27
Thus the motion must be treated as a postjudgment motion.28
Plaintiffs’ motion for leave to amend the complaint after the initial dismissal must be treated as a postjudgment motion subject to Rule 59(e) or Rule 60(b) standards.29
Whether the district court abused its discretion in denying plaintiffs’ motion for leave to amend as untimely?30
No. Plaintiffs filed their motion on November 7, 2017, a year and ten months after the district court’s original judgment.33 This places the motion well outside the 28-day limitation in Rule 59(e).34 The motion is also untimely if construed as a Rule 60(b) motion because it was not filed within a reasonable time or within one year of the original judgment.35 The district court therefore did not abuse its discretion in denying the motion for leave to amend.36
The district court did not abuse its discretion in denying plaintiffs’ motion for leave to amend as untimely.37
Whether Holmes stated a plausible negligence claim under Illinois law?38
To state a claim for negligence under Illinois law a complaint must allege facts establishing a duty of care owed by the defendant to the plaintiff, a breach of that duty, and an injury proximately caused by the breach.39 In Illinois there is generally no affirmative duty to protect another from criminal attack unless one of four historically recognized special relationships exists.40 The FTCA creates no private right of action and Illinois courts are unlikely to recognize a duty enforceable through negligence arising from the FTCA.41
No. Holmes’s negligence claim is premised on the view that SuperValu had a duty to safeguard credit-card information from cyberattacks.42 Illinois generally recognizes no such duty absent a special relationship.43 The Seventh Circuit predicted Illinois would not impose the duty on retailers, relying on Cooney v. Chicago Public Schools, and Holmes identified no contrary Illinois authority.44 The FTCA creates no private right of action and implying one would be inconsistent with the enforcement scheme Congress established.45
Holmes therefore failed to state a plausible negligence claim.46
Holmes did not state a plausible negligence claim under Illinois law.47
Whether Holmes stated a plausible claim under the Illinois Consumer Fraud and Deceptive Business Practices Act?48
A claim under the ICFA requires the plaintiff to have suffered actual damage as a result of the defendant’s conduct.49 Actual damage requires a real and measurable out-of-pocket pecuniary loss.50 A purely speculative injury is not actual damage.51 The collateral source doctrine does not apply when indemnity arises from contracts connected to the defendant through the card payment system.52
No. Holmes alleged time spent monitoring his account, a single fraudulent charge, and effort replacing his card.53 The risk of future identity theft is speculative and not real or measurable.54 Holmes did not allege he was obligated to pay the fraudulent charge, and the inference that he paid it is unreasonable because federal law and card contracts ordinarily absolve consumers.55 The collateral source doctrine does not apply because any indemnity came from sources connected to SuperValu through the payment system.56
Holmes therefore failed to state a plausible ICFA claim.57
Holmes did not state a plausible claim under the Illinois Consumer Fraud and Deceptive Business Practices Act.58
Whether Holmes stated a plausible claim under the Illinois Uniform Deceptive Trade Practices Act?59
No. The only remedy available for a UDTPA claim is injunctive relief.62 To obtain an injunction, Holmes must show that he is likely to be damaged by SuperValu’s practices in the future.63 Holmes failed to allege any likelihood that he would be damaged by SuperValu’s practices in the future.64 The complaint’s allegations of future identity theft risk were previously held too speculative to support standing.65 Holmes therefore failed to state a plausible UDTPA claim.66
Holmes did not state a plausible claim under the Illinois Uniform Deceptive Trade Practices Act.67
Whether Holmes stated a plausible claim for breach of an implied contract under Illinois law?68
To state a plausible implied-contract claim the complaint must sufficiently allege that the plaintiff was party to a contract with the defendant.69
No. We previously held that the complaint does not sufficiently allege that plaintiffs were party to an implied contract with SuperValu.70 The complaint does not sufficiently allege that Holmes was party to an implied contract with SuperValu.71 Holmes therefore failed to state a plausible implied-contract claim.72
Holmes did not state a plausible claim for breach of an implied contract under Illinois law.73
Whether Holmes stated a plausible unjust enrichment claim under Illinois law?74
To state a claim of unjust enrichment in Illinois a plaintiff must allege that the defendant has unjustly retained a benefit to the plaintiff’s detriment and that retention violates the fundamental principles of justice, equity, and good conscience.75 A plaintiff must show a benefit conferred in exchange for protection of personal information.76
No. Holmes alleged that SuperValu unjustly retained the money he paid for groceries because immediate notice of the breach would have prevented the purchase.77 Holmes paid the same price for groceries whether using cash or credit card and did not allege any portion of the payment was for data protection.78 Common sense shows he received the groceries at the ordinary price and conferred no separate benefit for data security.79 Holmes therefore failed to state a plausible unjust enrichment claim.80
Holmes did not state a plausible unjust enrichment claim under Illinois law.81