Marsh McLennan Asks Court to Revisit Data Breach Ruling to Avoid Flood of Litigation

Marsh McLennan wants the Second Circuit appeals court to reconsider its August decision that overruled a district court and reinstated a former employee’s lawsuit against the company over a 2021 data breach.

Marsh McLennan (MMC) asserts that the employee lacks standing to sue because the damages claimed in the proposed class action are speculative, based on potential future harm, and not sufficiently “concrete” to qualify as valid claims for relief.

The professional services and insurance firm is warning the court that the ruling undermines the requirement that a plaintiff state a cognizable claim and, if the current ruling stands, it “will open the floodgates to litigation.”

Former employee Nancy Bohnak filed a putative class action after her personal identifiable information (PII) was exposed when the company was hacked. Bohnak’s claimed injuries on behalf of the class members include lost or diminished value of their PII; lost opportunity costs because of their attempts to mitigate the effects of the breach; and their expenses for the prevention and recovery from identity theft, tax fraud and unauthorized use of their PII.

MMC moved to dismiss the suit for lack of standing, and for failure to state a claim.

The district court of Southern New York granted MMC’s dismissal in a January 2022 ruling. The district court found that while the plaintiff had standing to bring the suit, she had not plausibly alleged cognizable damages arising from the disclosure of her PII. In particular, the district court concluded that Bohnak could only speculate about the extent of any future harm, and that the damages arising from any risk of future harm are not “capable of proof with reasonable certainty.”

The district court concluded that Bohnak’s alleged loss of time and money responding to the increased risk of harm is not “cognizable” because it was not proximately caused by the harm of disclosure which, the court emphasized, was the harm for which the court found the plaintiffs had standing.

In her appeal, Bohnak questioned the district court’s reasoning that she failed to achieve standing in citing the risk of future harm and that she failed to state a cognizable claim for damages.

In August, a panel of the Second Circuit reversed in favor of Bohnak. The appeals court found that she has standing to pursue her claims for relief and she has sufficiently alleged a cognizable claim for damage.

The appeals panel agreed with Bohnak that her claimed harm is sufficiently “concrete” to constitute an injury in fact, and that her allegation that an unauthorized third party accessed her personal information through a targeted data breach gives her standing to bring this action. The court concluded that the district court erred in dismissing Bohnak’s claims for failure to plausibly allege cognizable damages.

In seeking a review, MMC argues that the appeals court reversal rests on two major errors and has moved to dismiss under Federal Rule of Civil Procedure 12(b)(1) for lack of standing, and under Rule 12(b)(6) for failure to state a claim.

First, MMC contends that Bohnak waived any challenge on appeal to the district court’s failure to state a claim analysis but the appeals court ignored that waiver and took it up it anyway.

Second, MMC challenges the conclusion that Bohnak sufficiently alleges damages under her state-law causes of action. The company maintains that the court did not correctly apply the standard that “damages must be capable of proof with reasonable certainty and not merely speculative.” MMC says that this analysis would have “made clear that Bohnak fails to allege any non-speculative damages capable of proof with reasonable certainty under state law.”

Also, MMC asserts that the panel erred by assuming that Bohnak pled out-of-pocket losses. According to MMC, the complaint does not allege that Bohnak herself lost any money due to the attack, but instead alleges economic harm only when referring to Bohnak and class members collectively.

MMC is asking the Second Circuit to grant its petition for a panel rehearing and hold that Bohnak waived her challenge to the district court’s decision on cognizable damages. Alternatively, MMC says the panel should itself hold that Bohnak failed to plausibly allege cognizable damages or should remand to the district court to resolve that question.

Absent correction of these errors, MMC says the court should grant a rehearing before the full court (en banc).

“If left uncorrected, that ruling renders 12(b)(6) toothless and will open the floodgates to litigation,” MMC concludes in its request for review.

Topics Lawsuits Cyber Flood