Clark v. Valparaiso University

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF INDIANA HAMMOND DIVISION ZACHARY CLARK on behalf of himself ) and all others similarly situated, ) ) Plaintiffs, ) ) vs. ) CAUSE NO. 2:25-CV-451-PPS-AZ ) VALPARAISO UNIVERSITY, ) ) Defendant. ) OPINION AND ORDER On September 9, 2025, Plaintiff Zachary Clark became aware of something most Americans have probably had a brush with in the past few years—Valparaiso University (his alma mater) posted a notice of data breach on its website. Concerned that his personal information (like his social security number, diver’s license number, and credit card information) may have been compromised, Clark filed this class action complaint on behalf of thousands of current, former, and prospective students of the University, as well as some employees. The case is brought under the Class Action Fairness Act wherein Clark alleges a slew of state law claims. He filed this case less than two weeks after the general notice was posted to the University’s website. He seeks compensatory and injunctive damages based on the argument that the University’s cybersecurity was insufficient to protect his sensitive information. While Clark has pleaded the potential for harm, he has failed to allege that his information was, in fact, included in the corpus of data that was compromised in the breach. As such, he lacks standing to bring the claims asserted in the complaint, and Valparaiso’s motion to dismiss will therefore be granted without prejudice on jurisdictional grounds. Background Plaintiff, Zachary Clark, was a student at Valparaiso and graduated in 2014. [Compl., DE 1 at 6.] When he enrolled, he (and the other putative class members) disclosed their non-public and sensitive personal information to the University. [Id. at 6- 7.] More than a decade later, on September 19, 2025, Valparaiso posted a Notice of Data Incident on its website. [Id. at 7.] The Notice (attached to the Complaint as an exhibit) states it was “providing notification of an event that may impact certain individual[s].” [DE 1-1 at 1.] After being notified of the data breach, Valparaiso began working with third-party specialists to conduct an investigation. Id. The investigation “determined that certain files and folders were copied and/or downloaded by an unknown third party between August 7, 2025, and August 8, 2025.” Id. The University indicated it was “in the process of conducting a comprehensive review of the relevant files and folders to determine the full nature and scope of the information at risk.” Id. Although the review remained ongoing at the time the notice was released, the University indicated “the type of information potentially impacted likely varies by individual but may include name and one or more of the following: Social Security number, driver’s license or state identification number, and/or financial account information.” Id. Finally, the notice encouraged potentially affected individuals 2 “to remain vigilant against incidents of identity theft and fraud by reviewing credit reports/account statements and explanation of benefits forms for suspicious activity and to detect errors” and then described how people can place an initial or extended fraud alert on a credit file or place a credit freeze on a credit report. [Id. at 1-2.] The complaint preliminarily defines the class as: “[a]ll individuals whose Personal Information was compromised as a result of the Data Breach with Valpo which was announced on or about September 19, 2025.” [DE 1 at 17.] It further alleges that Clark and the class members have suffered significant injury and damages, including out-of-pocket expenses involved with reasonable mitigation measures, and other damages, plus they now “forever face an amplified risk of further misues, fraud, and identity theft.” [Id. at 2 (emphasis in original).] To date, Plaintiffs have not yet filed a motion to certify the class. Jurisdiction is proper pursuant to the Class Action Fairness Act, 28 U.S.C. § 1331(d), because it is alleged: (1) there are more than 100 class members; (2) the aggregate amount in controversy exceeds $5 million; and (3) some class members are citizens of states different than Valparaiso. [Id. at 4.] In looking specifically at Plaintiffs’ claims, they allege Valparaiso failed to adhere to the guidelines of the Federal Trade Commission (“FTC”) in securing data and failed to adhere to guidelines of the Gramm-Leach-Bliley Act, 16 CFT 313.3(k)(2)(vi) (“GLBA”). [Id. at 10-15.] Plaintiffs allege they have suffered or are at increased risk of suffering misuse of personal information, the continued risk to their personal 3 information, and current and future costs related to the time, effort, and money that will be expended to prevent, detect, remediate and repair the impact of the data breach. [Id. at 15-16.] They bring six claims, all under state law: negligence (Count I), negligence per se (Count II), breach of express/implied contractual duty (Count III), unjust enrichment (Count IV), invasion of privacy (Count V), and bailment (Count VI). Plaintiffs request actual damages, injunctive or declaratory relief, costs, and attorneys’ fees. [DE 1 at 32.] The University has moved to dismiss the complaint pursuant to both Federal Rule of Civil Procedure 12(b)(1) for lack of subject matter jurisdiction (due to lack of standing) and 12(b)(6) for failure to state claims upon which relief may be granted. Because Clark has failed to plausibly allege that he was harmed by the data breach, this case will be dismissed on standing grounds. Discussion Defendants seek dismissal of the complaint under both Federal Rule of Civil Procedure Rules 12(b)(1) and (6). In order to survive a motion to dismiss under Rule 12(b)(6), “a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal quotation marks and citation omitted); accord Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). While I must accept all factual allegations as true and draw all reasonable inferences in the complainant’s favor, I don’t need to accept threadbare legal conclusions supported by purely conclusory statements. See Iqbal, 556 U.S. at 678. 4 Plaintiff must allege “more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Twombly, 550 U.S. at 555. Making the plausibility determination is “a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Iqbal, 556 U.S. at 679. Finally, “a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) ‘tests the sufficiency of the complaint, not the merits of the case.’” Tarzian v. Kraft Heinz Foods Co., No. 18 C 7148, 2019 WL 5064732, at *2 (N.D. Ill. Oct. 9, 2019) (quoting McReynolds v. Merrill Lynch & Co., 694 F.3d 873, 878 (7th Cir. 2012)). When evaluating a facial challenge to subject matter jurisdiction under Rule 12(b)(1), I must use the same “plausibility” standard; therefore, I must accept alleged factual matters as true and draw all reasonable inferences in favor of Plaintiff. Silha v. ACT, Inc., 807 F.3d 169, 174 (7th Cir. 2015). Plaintiff bears the burden of establishing the jurisdictional requirements. Ctr. for Dermatology and Skin Cancer, Ltd. v. Burwell, 770 F.3d 586, 588-89 (7th Cir. 2014). As usual, the question of jurisdiction must come first. This case rises and falls on the issue of standing. The University argues the complaint should be dismissed for lack of standing because Clark has failed to allege a concrete injury. [DE 7-1 at 5-7.] It points to the fact that Clark is a former student of Valpo who graduated in 2014, and a full eleven years later, he saw a notice posted on the University’s website stating there was a data security incident “that may impact certain individual[s],” [DE 1-1 at 1], but there 5 is no allegation that Clark’s personal data was actually stolen in this incident. [DE 13 at 3-4.] Clark counters with a slew of caselaw (some from this circuit and some outside), insisting that his injuries are not speculative, arguing they have claimed a variety of injuries including diminution in value of their personal information, out-of-pocket costs associated with the prevention, detection, recovery, and remediation from identity theft, and that he will continue to suffer injuries as a result of the breach in the future. [DE 10 at 7-11.] Clark completely misses the point. If Clark had alleged the University gave him personal notice that his data was stolen, or if he had any proof that his data was in fact breached, we would be in a different procedural position than we are in now. But he did not. Clark only alleged that the University posted the Notice of Data Incident on its website and then he filed suit a mere 11-days later. In order for Clark to properly plead Article III standing, he must allege an actual injury. Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 691-92 (7th Cir. 2015); see also Halperin v. Int’l Web Servs., LLC, 70 F.Supp.3d 893, 898 (N.D. Ill. 2014) (“[t]he standing test can be easily met in most types of class suits so long as the class representative has incurred actual injury.”). Federal courts have consistently held that a named plaintiff cannot establish Article III standing by relying on unidentified potential class members’ injuries without alleging injuries he personally has suffered. In the seminal case of Warth v. Seldin, the Supreme Court found that “P[laintiff]s must allege and show that they personally have been injured, not that injury has been suffered by other, 6 unidentified members of the class to which they belong and which they purport to represent.” 422 U.S. 490, 502 (1975). The Supreme Court has further specified that “if none of the named plaintiffs purporting to represent a class establishes the requisite of a case or controversy with the defendants, none may seek relief on behalf of himself or any other member of the class.” O’Shea v. Littleton, 414 U.S. 488, 494 (1974) (citing Bailey v. Patterson, 369 U.S. 31, 32-33 (1962); see also Payton v. County of Kane, 308 F.3d 673, 682 (7th Cir. 2002) (“it bears repeating that a person cannot predicate standing on injury which he does not share. Standing cannot be acquired through the back door of a class action.”). While it is true that the test is whether the plaintiff “has sustained or is immediately in danger of sustaining some direct injury,” it has to be actual and not conjectural or hypothetical. O’Shea, 414 U.S. at 494. Clark has not established that he is immediately in danger of suffering an injury because he has not alleged his personal data was actually breached. While the Seventh Circuit has noted in a data breach case that “[defendant’s] customers should not have to wait until hackers commit identity theft or credit-card fraud in order to give the class standing, because there is an objectively reasonable likelihood that such an injury will occur,” Remijas, 794 F.3d at 864, Clark’s situation is different because he has not alleged that his personal information was in fact compromised. For example, in looking at some of the cases cited by the University, the difference becomes obvious. In Johnson v. Nice Pak Prods., Inc., 736 F.Supp.3d 639, 644 7 (S.D. Ind. 2024), employees of defendant Nice Pak were “sent letters . . . informing them of the Data Breach.” Similarly, in In re MOVEit Customer Data Security Breach Litigation, No. 1:23-md-03083-ADB-PGL, 2024 WL 5092276, at *4 (D. Mass. Dec. 12, 2024), the two putative class plaintiffs alleged they received notice that their personal information had been stolen in the breach. In McCreary v. Filters Fast LLC, 3:20-cv-595-FDW-DCK, 2021 WL 3044228, at *1 (W.D. N.C. July 19, 2021), each plaintiff received a letter from defendant notifying them of the data breach. And in Krupa v. TIC Int’l Corp., 1:22-cv- 01951-JRS-MG, 2023 WL 143140, at *2 (S.D. Ind. Jan. 10, 2023), the court noted it “seem[ed] an odd case to be arguing about standing and damages. [The putative named plaintiff] was not a random plaintiff speculating about future risks of harm or seeking to assert the rights of others—he personally is a victim of a data breach that actually happened. His social security number was stolen. . . .” Clark stands in sharp contrast to these putative class plaintiffs. He provided his personal information to the University more than a decade ago. Under this scenario, there is no reason to suppose the University retained his information for this long. And even if they did, there is no indication that Clark’s information was among the information stolen in the data breach. To be sure, there are some inconsistencies with the complaint. On the one hand, Clark alleges he “received a notice from Valpo stating that his Personal Information including his name and Social Security Number, and financial information were compromised during the Data Breach.” [DE 1 at 4.] But this is misleading because later 8 in the complaint, Clark specifies that “Valpo posted a Notice of Data Incident on its website providing notification that Personal Information had been compromised during the Data Breach and they began working with third-party specialists to investigate.” Id. at 7. The website post is the only attachment to the complaint, and it provides the event “may impact certain individual[s].” [DE 1-1 at 1] (emphasis added). Nowhere in his briefing does Clark claim he received a personal letter or other notification from the University indicating his specific information was breached, and what that information may have been. Given the foregoing, the University insists that Clark lacks standing because eleven years after he graduated, he saw a notice posted on the University’s website stating there had been a data security incident, and some individuals may have been affected. [DE 13 at 3.] The exhibit attached to the complaint is a post to the University’s website. I can only presume this was the “notice” Clark received. If he had later received more information from the University or a letter indicating his data was actually compromised, I presume Clark would have moved to amend the complaint (which he did not). Where a notice does not definitively state that a named individual’s data was actually stolen and his data has not been misused, allegations of injury are speculative and not sufficient to support standing in a data security class action. See, e.g., Greenstein v. Noblr Reciprocal Exchange, No. 22-17023, 2024 WL 3886977, at *2 (9th Cir. Aug. 21, 2024) (finding allegations of theft of information are too speculative to 9 support standing where plaintiffs relied on a data breach notification letter sent to 97,633 individuals that did not definitively state that the plaintiffs’ driver’s license numbers were actually stolen); Petta v. Christie Bus. Holdings Co., P.C., 267 N.E.3d 904, 909-10 (Ill. 2025) (finding no standing where data breach notification letter did not state that the data was actually acquired by a third party where plaintiff sought monetary damages but only alleged increased risk of future harm). One more thing: Clark attaches as supplemental authority the state case of Paxson v. SMC Corp. of America (Ind. Super. Ct. May 15, 2026), in support of his claims. [DE 27-1.] In that case, the Hamilton Superior Court found SMC “issued a breach notice” stating certain personal information potentially may have been exposed. The Paxson Court relied on Hensley v. Lewis Brothers Bakeries, Inc., 263 N.E.3d 199 (Ind. Ct. App. 2025), in denying a motion to dismiss and finding allegations of monetary loss, anxiety, and increased risk of suffering an immediate injury sufficient to establish an injury for the purposes of standing. But in Hensley, the Court specifically recognized that the plaintiff’s personal information was among the personal information accessed and stolen in the data breach, and in Paxson, the plaintiff was specifically notified that his information may have been exposed. Hensley, 263 N.E.3d at 200. Again, this is different than the present situation. In this case, Clark merely saw a general notice posted on the University’s website, and then filed this lawsuit. As the University recognizes, the issue is not that his allegations of injury are vague (or may happen in the future), but rather the salient issue is that Clark was never notified that 10 his information was breached and therefore he cannot even show that he suffered any injury himself whatsoever. If litigants were able to file a lawsuit against a company simply because they were worried their information might have been breached in an incident, without possessing any additional information to support their fear that their information was actually stolen, lawsuits would abound. This is a bridge too far that I am not willing to cross. Finally, Clark states that he “reported receiving spam texts and phone calls after the breach.” [DE 1 at 16.] The Seventh Circuit has required that a plaintiff establish some link between the information allegedly stolen and “suspicious activity” alleged in order to have standing in a data breach class action. See Baysal v. Midvale Indem. Co., 78 F.4th 976, 978 (7th Cir. 2023). But in this case, Clark hasn’t alleged any suspicious activity regarding the data identified on the website post (social security number, driver’s license number and/or financial account information) [DE 1-1 at 1]. We all receive spam. An alleged increase in spam is just too speculative to show the requisite connection. In other words, I don’t think it can be inferred that just because one received a spam message that it was somehow related to this incident. For all of these reasons, Clark lacks standing and the complaint must be dismissed on this basis. Dismissal without prejudice is appropriate. See Am. Bottom Conservancy v. U.S. Army Corps of Eng’rs, 650 F.3d 652, 660 (7th Cir. 2011) (where a district court dismisses a suit for lack of standing, “it ha[s] no jurisdiction [and] therefore could only dismiss without prejudice”); Ramsay v. Mayer, 420 F. App’x 586, 11 588 (7th Cir. 2011) (emphasis added) (“If plaintiffs indeed lack standing, and there is no jurisdiction, then dismissal must be without prejudice; a court cannot adjudicate a claim over which it lacks jurisdiction.”). Conclusion For the aforementioned reasons, Defendant Valparaiso University’s motion to dismiss [DE 7] is GRANTED and the case is DISMISSED WITHOUT PREJUDICE for lack of jurisdiction. SO ORDERED. ENTERED: July 10, 2026. /s/ Philip P. Simon PHILIP P. SIMON, JUDGE UNITED STATES DISTRICT COURT 12