In re: SuperValu, Inc., Customer Data Security Breach Litigation
SuperValu, Inc.; AB Acquisition, LLC; New Albertsons, Inc. Defendants - Appellees Melissa Alleruzzo; Heidi Bell; Rifet Bosnjak; John Gross; Kenneth Hanff; David Holmes; Steve McPeak; Gary Mertz; Katherin Murray; Christopher Nelson; Carol Puckett; Alyssa Rocke; Timothy Roldan; Ivanka Soldan; Melissa Thompkins; Darla Young Plaintiffs - Appellants
Submitted: February 12, 2019
from United States District Court for the District of
Minnesota - Minneapolis
LOKEN, COLLOTON, and KELLY, Circuit Judges.
2014, hackers accessed customer financial information from
hundreds of retail grocery stores operated by SuperValu,
Inc., AB Acquisition, LLC, and New Albertsons, Inc. A group
of customers sued the stores. We previously affirmed
dismissal of all but one of the suit's named plaintiffs
for lack of standing. See In re SuperValu, Inc., 870
F.3d 763 (8th Cir. 2017). On remand, the district
courtdismissed the remaining plaintiff for
failure to state a claim under Federal Rule of Civil
Procedure 12(b)(6) and denied plaintiffs' motion for
leave to amend their complaint. We affirm both rulings.
prior opinion summarizes the facts alleged in the
consolidated amended complaint, which we accept as true.
See id. at 766-67. We repeat here only the facts
relevant to the instant appeal. In 2014, defendants'
grocery stores suffered two cyberattacks that allowed hackers
to steal customers' card information, including their
names, credit or debit card account numbers, expiration
dates, personal identification numbers, and card verification
value codes. The stolen card information is distinct from the
type of personally identifying information generally
necessary to open a new fraudulent account, "such as
social security numbers, birth dates, or driver's license
numbers." Id. at 770. Defendants notified
customers of the first attack, which occurred in late June
and early July 2014, via a press release on August 14, 2014.
On September 29, 2014, they announced a second attack, which
took place in late August or early September 2014. Plaintiffs
allege that the two data breaches were connected and resulted
from the stores' failure to properly safeguard their
customers' personal information.
filed multiple putative class actions against the stores,
which were consolidated. Defendants moved to dismiss,
asserting that the court lacked subject-matter jurisdiction
because plaintiffs lacked standing, see Fed.R.Civ.P.
12(b)(1), and that plaintiffs failed to state a claim upon
which relief could be granted, see Fed.R.Civ.P.
12(b)(6). The district court granted defendants' motion
under Rule 12(b)(1) and dismissed the complaint without
prejudice. It concluded that none of the plaintiffs had
alleged an injury in fact because the complaint's
allegations were insufficient to plausibly suggest that
plaintiffs were likely to suffer future identity theft. The
court did not address defendants' alternative motion
under Rule 12(b)(6).
then filed a motion to alter or amend the judgment under Rule
59(e). Plaintiffs attached three declarations from officers
of financial institutions who averred that some payment cards
issued by their respective institutions incurred fraudulent
charges following the data breaches. Plaintiffs' motion
included a request for leave to file an amended complaint but
did not attach a proposed amended pleading. The district
court denied plaintiffs' Rule 59(e) motion for failing to
meet the standard for newly discovered evidence. It also
denied the motion for leave to amend because plaintiffs had
not submitted a proposed amended complaint, as required by
the court's local rules. Plaintiffs appealed the district
court's dismissal for lack of subject-matter jurisdiction
but did not appeal the denial of their Rule 59(e) motion.
appeal, we affirmed the district court's dismissal of all
of the named plaintiffs for lack of standing, except for
David Holmes. We concluded that no plaintiff had alleged a
prospective injury in fact because, as pleaded, the
likelihood of future identity theft was purely speculative.
In re SuperValu, 870 F.3d at 768-72. But we found
that Holmes, the only plaintiff who alleged that he
experienced an unauthorized charge to his account, had
alleged a present injury in fact. Id. at 772.
According to the complaint, Holmes used his credit card at a
Shop 'n Save store operated by SuperValu in Belleville,
Illinois, on an unspecified date. "On information and
belief," Holmes's card information was compromised
as a result of the cyberattacks. Shortly after the data
breaches were announced, Holmes noticed a fraudulent charge
on his credit card statement and immediately cancelled his
credit card, which took two weeks to replace. This was
sufficient for standing purposes, but we nonetheless
acknowledged that Holmes's failure to allege certain
details-such as "the date he shopped at the affected
Illinois store, the amount of the charge, or that the charge
was unreimbursed"-"could be fatal to the complaint
under the 'higher hurdles' of Rules 8(a) and
12(b)(6)." Id. at 773. We remanded to allow the
district court to consider defendants' Rule 12(b)(6)
motion as to Holmes in the first instance.
remand, defendants renewed their motion to dismiss. A week
later, plaintiffs filed a second motion for leave to amend.
This time, plaintiffs included a proposed amended complaint
that added general allegations about the likelihood of
identity theft following a data breach. Many of these
allegations were based on the same three affidavits
plaintiffs had attached to their earlier Rule 59(e) motion.
The district court denied plaintiffs' motion, reasoning
that futility and undue delay compelled denial of leave to
amend under Rule 15(a)(2). The court then dismissed all
claims against AB Acquisition and New Albertsons because
Holmes did not shop at an Albertsons store. It also found
that Holmes's negligence, consumer protection, implied
contract, and unjust enrichment claims all failed as a matter
of law and therefore granted SuperValu's motion to
dismiss in full.
first address the district court's denial of
plaintiffs' second motion for leave to amend. As an
initial matter, the parties dispute which rules govern this
motion. Defendants argue that, because the district court
initially dismissed the complaint and entered judgment on
January 7, 2016, plaintiffs cannot seek leave to amend their
complaint unless that judgment is first set aside or vacated
under Rule 59(e) or Rule 60(b). Plaintiffs contend that they
need not satisfy the requirements of those rules because the
court's initial dismissal was without prejudice. The
district court declined to opine on whether the motion was
properly construed as a postjudgment motion because, even
under the more lenient standards applicable to prejudgment
motions, futility and undue delay counseled against granting
leave to amend under Rule 15(a)(2).
repeatedly explained that "[a] motion for leave to amend
after dismissal is subject to different considerations than a
motion prior to dismissal." Mountain Home Flight
Serv., Inc. v. Baxter Cty., 758 F.3d 1038, 1045 (8th
Cir. 2014). Leave to amend should be granted liberally under
Rule 15 prior to dismissal. After judgment has been entered,
district courts may not ignore the considerations of Rule 15,
but leave to amend a pleading will be granted only "if
it is consistent with the stringent standards governing the
grant of Rule 59(e) and Rule 60(b) relief." United
States v. Mask of Ka-Nefer-Nefer, 752 F.3d 737, 743 (8th
Cir. 2014). Even if a dismissal is without prejudice, if the
court intended the ...