Moyer v. Michaels Stores, Inc., No. 14-CV-00561 (N.D. Ill., dismissed Jul. 17, 2014). Safety National Casualty Corp. v. Michaels Stores, Inc., No. 3:14-cv-02223 (N.D. Tex., filed June 18, 2014).
Last month, we reported that Michaels Stores sought dismissal of several, now consolidated, putative class actions regarding a January data breach that may have exposed customers’ credit and debit card information. The putative class brought claims for (i) breach of implied contract and (ii) violations of the Illinois Consumer Fraud Act and other state consumer protection laws. Michaels argued that the plaintiffs lacked standing because they had not suffered actual or imminent injuries and that the plaintiffs’ claims failed because they had not sufficiently alleged an injury. On July 17, 2014, the Northern District of Illinois granted Michaels’ motion. The court held that the plaintiffs’ increased risk of identity theft as a result of the data breach was sufficiently imminent to confer standing. However, the court found that the plaintiffs had failed to state a claim because they did not plead actual monetary damages. Purchases of credit monitoring services and general allegations regarding unauthorized bank withdrawals were insufficient to constitute actual damage.
Meanwhile, on June 18, Safety National Casualty Corp. filed an action for declaratory relief against Michaels, seeking a judgment that a general commercial liability insurance policy does not oblige Safety National to provide a defense and coverage to Michaels in the Illinois class actions. Safety National alleges that the policy provides a duty to defend and coverage for claims alleging “bodily injury,” “property damage,” and “personal or advertising injury.” According to Safety National, the putative class actions alleged none of those injuries and, therefore, the policy provides no coverage. Following the dismissal of the class actions, on July 22, Safety National stipulated to a dismissal without prejudice.
Also in July, an Illinois state court dismissed another putative class action data breach case but, contrary to the Michaels court, ruled that increased risk of future harm was not enough to confer standing, where there was “no actual or impending certainty of identity theft” arising from the data breach [Case No. 13-L-538].