LASALLE v. ADOPTIONS FROM THE HEART, INC.

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF PENNSYLVANIA ERIK LASALLE, on behalf of himself and : all others similarly situated, : : CIVIL ACTION v. : No. 25-974 : ADOPTIONS FROM THE HEART, INC. : McHUGH, J. August 1, 2025 MEMORANDUM This is a data breach case. In April 2024, an adoption agency inadvertently exposed the sensitive personal data of over 2,000 present and former clients. The data remained publicly accessible on the internet for a nine-day period before it was taken down, and the agency failed to notify any impacted parties for nine months. Soon after his data was exposed, Erik LaSalle, a former client, experienced a spike in spam communications and attempted bank fraud. Mr. LaSalle now brings a putative class action for both monetary and injunctive relief on behalf of himself and the other individuals whose data was compromised. Defendant has moved to dismiss for lack of standing, arguing that Plaintiff has not experienced injuries fairly traceable to the data incident. I disagree. In an era of data mining by sophisticated programs, once information is made public on the internet, even if only for a few days, the vulnerability is real. Here, Plaintiff has sufficiently alleged that he is both at risk of, and has already begun to experience, serious harms that plausibly flow from the data incident. The motion to dismiss will therefore be denied. I. Facts as Pled Defendant Adoptions from the Heart, Inc. is a non-profit adoption agency. Compl. ¶¶ 9, 13, ECF 11. In running its business, Defendant receives and maintains adoption files containing personal identifiable information (“PII”) and protected health information (“PHI”) of thousands of its current and former clients. Id. ¶ 14. Some of this information includes names, dates of birth, social security numbers, medical records, and names of social workers. Id. ¶ 3. In agreeing to work with Defendant, clients sign a Privacy Policy, wherein Defendant promises not to share the PHI or PII with anyone outside of the Agency. Id. ¶ 17. Despite this assurance, on April 17, 2024, the data stored in Defendant’s internal database was made available and searchable on the internet (“the Incident”). Id. ¶ 18. At least 2,502 of Defendant’s former patients and clients’ data files were exposed, and the data remained public for nine days. Id. ¶¶ 4, 22. During this period, the data was susceptible to search engine indexing bots, which are automated data harvesting mechanisms designed to crawl the internet for publicly accessible data. Id. ¶ 19. Such bots often facilitate large-scale automated data scraping, a known exploitation method used by cybercriminals and data brokers to capture sensitive personal information at scale. Id. ¶ 20. Personal data collected through web scraping is frequently sold or published on the Dark Web.1 Id. ¶ 35. Plaintiff asserts that “on information and belief,” the PII/PHI data jeopardized in the Incident has already been made publicly accessible and has been published, or will be published imminently, by cybercriminals on the Dark Web. Id. ¶ 36. Yet, Defendant did not notify affected parties of the Incident until January 24, 2025 – over nine months after the exposure. Id. ¶ 23. This dramatic delay limited the ability of affected parties to try to mitigate their injuries in a timely manner. 2 Id. ¶ 24. 1 The Harvard Business Review describes the Dark Web as a “hub of criminal and illicit activity” where cybercriminals “sell data from companies they have gained unauthorized access to through credential stuffing attacks, phishing attacks, [or] hacking.” Compl. ¶ 35; Brenda R. Sharton, Your Company’s Data Is for Sale on the Dark Web. Should You Buy It Back?, HARVARD BUS. REV. (Jan. 4, 2023) https://hbr.org/2023/01/your-companys-data-is-for-sale-on-the-dark-web-should-you-buy-it-back. 2 In their Notice, Defendant offered to provide some victim credit monitoring and identity related services. Id. ¶ 31. But this offer carries little import when it was not made until over nine months had lapsed, for time is of the essence when attempting to mitigate a data breach. Plaintiff Erik LaSalle is a former client of Defendant, and thus provided the Agency with his PII and PHI, trusting that the Agency would use reasonable measures to keep his information safe. Plaintiff “is very careful about the privacy and security of his PII/PHI,” “does not knowingly transmit his PII/PHI over the internet in an unsafe manner,” and is careful to store any sensitive documents in a secure location. Id. ¶ 40. But in February 2025, LaSalle received notice that his data file was one of those exposed in the Incident. Id. ¶ 45. LaSalle avers that following the Incident, he experienced a spike in spam and scam text messages and phone calls. Id. ¶ 47. Within a year of the Incident, LaSalle also asserts that he received a call from Capital One informing him that an unauthorized actor had made several attempts to withdraw money from his account. Capital One consequently froze his account, which he then decided to close. Id. ¶ 46. LaSalle believes that these episodes of fraudulent activity are a product of the Incident. To this point, LaSalle does not recall ever learning that his information was compromised in any other data security incident, other than the Incident at issue here, leading him to infer that as a result of the Incident and the widespread prevalence of indexing bots, his information was compromised and accessed by nefarious third parties. Id. ¶¶ 44, 49. In addition to the spam calls and attempted bank fraud, LaSalle states that he has spent, and will continue to spend, significant time, effort, and money monitoring his accounts to protect himself from identity theft. Id. ¶¶ 51, 62. He avers that he has suffered from anxiety, sleep disruption, stress, fear, and frustration. Id. ¶ 53. He also alleges a loss of opportunity costs and wages from spending time trying to mitigate the fraud, and an ongoing risk of additional data breaches until Defendant takes appropriate protective measures. Id. ¶ 62. Plaintiff purports that Defendant knew or should have known that a failure to safeguard sensitive data presents great risk, but that they nevertheless failed to take adequate precautions, follow statutory or industry standards, or sufficiently notify affected parties once aware of the Incident. Id. ¶¶ 77, 83, 84, 86, 90. LaSalle brings this suit as a class action on behalf of himself and a similarly situated class consisting of “all individuals residing in the United States whose PII/PHI was compromised and/or made accessible to internet search engines as a result of the indexing error discovered by Adoptions From The Heart in April 2024, including all individuals who received a Notice of Security Incident.” Id. ¶ 92. Defendant does not dispute that the Incident occurred, nor that they failed to notify putative Plaintiffs for nine months. Defendant argues instead that Plaintiff cannot establish a causal connection between the Incident and Plaintiff’s alleged fraud, warranting dismissal for lack of standing. II. Standard of Review Defendant argues that the action should be dismissed for lack of subject matter jurisdiction pursuant to Rule 12(b)(1). A challenge to subject matter jurisdiction under Rule 12(b)(1) may be either a facial or factual attack. “A facial attack, as the adjective indicates, is an argument that considers a claim on its face and asserts that it is insufficient to invoke the subject matter of the court[.]” Const. Party of Pa. v. Aichele, 757 F.3d 347, 358 (3d Cir. 2014). In contrast, a factual attack is “an argument that there is no subject matter jurisdiction because the facts of the case . . . do not support the asserted jurisdiction.” Id. In both instances, the plaintiff bears the burden of establishing subject matter jurisdiction. Kehr Packages, Inc. v. Fidelcor, Inc., 926 F.2d 1406, 1409 (3d Cir. 1991). The jurisdictional challenge here is a facial challenge to standing. As such, I must “accept the Plaintiff’s well-pleaded factual allegations as true and draw all reasonable inferences from those allegations in the Plaintiff’s favor.” In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 633 (3d Cir. 2017) (cleaned up). Where, as here, Plaintiff brings a class action, only one Named Plaintiff must have standing for the matter to proceed. Id. at 634 . III. Discussion A federal court may only exercise jurisdiction where there is a live “case” or “controversy.” U.S. Const. art. III, § 2. For a lawsuit to satisfy that requirement, plaintiffs must have standing to sue. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992). To establish Article III standing, a plaintiff must show (1) that he suffered an “injury in fact”; (2) that the injury is “fairly traceable to the challenged conduct of the defendant”; and (3) that the injury would likely be redressed by a favorable judicial decision. Spokeo, Inc. v. Robbins, 578 U.S. 330, 338 (2016). Defendant only contests the first two elements. Plaintiff demonstrates injury-in-fact. To qualify as an injury in fact, the injury must be (a) actual or imminent, not conjectural or hypothetical, and (b) concrete and particularized. Spokeo, 578 U.S. at 339 (quoting Lujan, 504 U.S. at 560 ); Adam v. Barone, 41 F.4th 230 , 234 (3d Cir. 2022). Both the actual injuries that Plaintiff has already incurred and Plaintiff’s concerns about the ongoing threat of identity theft satisfy these requirements. 1. Actual or Imminent To have standing, a plaintiff must allege an actual or imminent injury. An actual injury is “a concrete loss as the result of [the defendant’s] actions.” Taliaferro v. Darby Twp. Zoning Bd., 458 F.3d 181 , 190 (3d Cir. 2006). By contrast, a claim of future injury can be “imminent” if there is a “substantial risk” that the threatened harm will occur. Susan B. Anthony List v. Driehaus, 573 U.S. 149 , 158 (2014) (quoting Clapper v. Amnesty Int’l USA, 568 U.S. 398 , 414 n.5 (2013)). While a risk of future injury might suffice to establish injury-in-fact, that risk of injury cannot be hypothetical or speculative. Clemens v. ExecuPharm Inc., 48 F.4th 146, 153 (3d Cir. 2022). Once private data is released to the public on the internet, even if only for a brief spell, it is exceedingly difficult, if not impossible, to control what happens to that data downstream. The Third Circuit has recognized that the unique character of data breach claims makes them likely to present a serious risk of imminent harm, explaining that it is “critical” that “actual or imminent” is disjunctive: “it indicates that a plaintiff need not wait until he or she has actually sustained the feared harm in order to seek judicial redress, but can file suit when the risk of harm becomes imminent. This is especially important in the data breach context, where the disclosure of the data may cause future harm as opposed to currently felt harm.” Id. at 152 (emphasis in original). Two cases bookend the landscape of the injury-in-fact inquiry in the Third Circuit as it relates to data breaches. In Reilly v. Ceridian Corp., where plaintiffs alleged that hackers may have accessed their law firm’s payroll system and the sensitive data contained therein, the Court held that the plaintiffs failed to establish injury in fact. 664 F.3d 38 (3d Cir. 2011). Critically, the Reilly plaintiffs did not allege any misuse of their data, and based their claim entirely on the possibility that if a hacker came across the leaked data, they could use it to engage in identity theft. The Court concluded that the future injuries alleged were entirely speculative and declined to find standing. Id. at 42 . Over a decade later, and amidst the ever-growing ubiquity of our digital footprints and our greater understanding of its pitfalls, the Third Circuit decided Clemens. There, the Court held that a plaintiff sufficiently established injury-in-fact where employee addresses, social security numbers, banking and financial account numbers, insurance and tax information, and more, were stolen during a ransomware attack on the defendant-company’s system. Clemens, 48 F.4th at 156 . In its analysis, the Third Circuit presented three non-dispositive factors to consider when evaluating whether an alleged injury in the data breach context is sufficiently imminent to satisfy Article III. First, standing is supported where the data breach was intentional and where known hackers or ransomware can be identified. Second, allegations of misuse weigh in favor of standing.3 And third, courts should consider the sensitivity of the information accessed. “[D]isclosure of social security numbers, birth dates, and names is more likely to create a risk of identity theft or fraud,” than instances where financial information without corresponding PII is disclosed, as financial information alone “generally cannot be used to commit identity theft or fraud.” Id. at 154 (citing McMorris v. Carlos Lopez & Assoc., LLC, 995 F.3d 295, 302 (2d Cir. 2021) and In re SuperValu, Inc., 870 F.3d 763, 770-71 (8th Cir. 2017)). Based on the three factors, the Court determined that the claims in Clemens were distinguishable from those in Reilly and allowed the case to proceed. First, while it was unclear in Reilly whether anyone had accessed the exposed data, the Clemens plaintiff identified a known ransomware attacker. Second, unlike in Reilly, where the Court could not discern any harm that flowed from the data breach at issue, the plaintiff in Clemens asserted that her information had already been distributed on the Dark Web. And while she did not point to any uptick in fraudulent activity, the Clemens plaintiff alleged that misuse of her data was either already afoot or would soon manifest. Third, the Clemens Court determined that the information at issue was precisely the sort of sensitive information that would lend itself to identity theft – birth dates, social security numbers, and names – weighing in favor of standing as well. See id. at 156 (while potential identity 3 The Third Circuit was careful to qualify that standing might also exist without alleged misuse where there is a clear increased risk of future harm that a plaintiff would not have otherwise faced. See Clemens, 48 F.4th at 154 (discussing Pisciotta v. Old Nat’l Bancorp, 449 F.3d 629 , 634 (7th Cir. 2007)). theft mitigation could involve “changing one’s banking information,” “there is no guarantee that mitigative measures will be effective – especially given that some information, such as our names and social security numbers, generally stay with us for life.”). Moreover, the Third Circuit held that a meaningful threat of identity theft was sufficiently imminent, supporting a finding of injuryin-fact. While the facts alleged here differ from Clemens on the first factor, this case is still closer to Clemens than Reilly. Admittedly, Plaintiff does not assert that the data breach was “intentional” and cannot identify a specific hacker or ransomware, beyond articulating the high likelihood that web scraping bots indexed the data while it was publicly accessible. But this factor is not dispositive. Plaintiff clearly alleges misuse that precipitated from the breach – namely, the noteworthy surge in spam communications and the attempted bank fraud.4 Plaintiff’s allegations of misuse are actual injuries that support standing. See Roma v. Prospect Med. Holdings, Inc., No. 23-3216, 2024 WL 3678984 , at *6 (E.D. Pa. Aug. 6, 2024) (holding that allegations of ongoing identity theft are actual injuries that support standing without needing to also find imminence); see also In re Am. Med. Collection Agency, Inc. Customer Data Sec. Breach Litig., No. 19-2904, 2021 WL 5937742 , at *8 (D.N.J. Dec. 16, 2021) (same); cf. In Re. Retreat Behav. Health, LLC, No. 23-26, 2024 WL 1016368 , at *3 (E.D. Pa. Mar. 7, 2024) (granting motion to dismiss where plaintiff did not allege that their data was misused or published, and thus failed to show imminence). 4 The alleged misuse also supports an inference that Plaintiff’s data was in fact scraped while it was public, making the risk of additional future harm more likely and supporting a finding of imminence on Plaintiff’s future harm claims. Finally, the information at issue is precisely the sort of sensitive information contemplated in Clemens that creates a substantial risk of identity theft if publicized. Plaintiff alleges that names, birthdays, and social security numbers, as well as other PHI and PII, were compromised in the Incident. It is difficult to conceive of data more sensitive, as this personal information seldom changes, and can be used to unlock troves of additional sensitive data and accounts. Plaintiffs’ injuries are thus “actual” or “imminent.” 2. Concrete A concrete injury is real, not abstract. TransUnion LLC v. Ramirez, 594 U.S. 413, 424 (2021). Intangible injuries and harms that are difficult to prove or measure can also be concrete. Spokeo, 578 U.S. at 340-41 . Certain intangible harms lend themselves to a finding of concreteness. In TransUnion v. Ramirez, the Supreme Court explained that “central to assessing concreteness is whether the asserted harm has a ‘close relationship’ to a harm ‘traditionally’ recognized as providing a basis for a lawsuit in American courts.” Ramirez, 594 U.S. at 417 . These harms “include, for example, reputational harms, disclosure of private information, and intrusion upon seclusion.” Id. at 425 (emphasis added). Where a Plaintiff seeks both injunctive and monetary relief, the risk of future harm alone can be concrete, if the risk is sufficiently imminent and substantial. Clemens, 48 F.4th at 155 (citing Ramirez, 594 U.S. at 435 ). And where the claimed injury is exposure to a substantial risk of future harm, a plaintiff can show concreteness by alleging the future harm caused “currently felt concrete harms.”5 Id. at 155-56. 5 A claim for damages alone requires a more significant showing that includes extant harms, such as costs spent on mitigation measures or emotional distress requiring medical care. Clemens, 48 F.4th at 155 . Here, Plaintiff pleads the Ramirez-recognized harm of “disclosure of private information.” Ramirez, 594 U.S. at 425 . Further, Plaintiff asserts that Defendant’s exposure of his sensitive data has resulted in fraudulent activity, supported by a surge in spam communications and an attempted banking breach. Even if these were Plaintiff’s only allegations, he would have sufficiently established concreteness at the pleading stage. Rauhala v. Greater New York Mut. Ins., Inc., No. 22-1788, 2022 WL 16553382 , at *3 (E.D. Pa. Oct. 31, 2022) (denying a motion to dismiss and describing plaintiff’s alleged increase in spam calls as a concrete and particularized harm). In addition to his allegations of misuse, Plaintiff argues that his heightened risk of identity theft also establishes concreteness. I agree. Where a plaintiff advances a substantial risk theory, he can “satisfy concreteness as long as he alleges that the exposure to that substantial risk caused additional, currently felt concrete harms.” Clemens, 48 F.4th at 155-56 . The Third Circuit explained that if, for example, “the plaintiff’s knowledge of the substantial risk of identity theft causes him to presently experience emotional distress or spend money on mitigation measures like credit monitoring services, the plaintiff has alleged a concrete injury.” Id. at 156 . As in Clemens, Plaintiff’s fear of future identity theft is sufficiently concrete because it is bolstered by presently felt harms. Plaintiff asserts that he has suffered monetary losses, lost time, anxiety, and emotional distress from Defendant’s failure to safeguard his data and adequately notify him about the Incident. The Complaint specifies that these losses include out-of-pocket costs from trying to “prevent, detect, and recover[] from identity theft and fraud,” as well as ongoing anxiety, sleep disruption, stress, fear, and frustration. Compl. ¶ 62. Because Plaintiff pleads injuries that are both actual or imminent, concrete, and particularized, Plaintiff sufficiently establishes injury-in-fact. Plaintiff’s alleged injuries are fairly traceable to Defendant. The second prong of the standing inquiry requires a plaintiff to establish that the injury was caused by the challenged action of the defendant, as opposed to an independent action of a third party. Lujan, 504 U.S. at 560 . Either but-for or concurrent causation will suffice. See Edmonson v. Lincoln Nat. Life Ins. Co., 725 F.3d 406, 418 (3d Cir. 2013) (finding the traceability requirement met “where the conduct in question might not have been a proximate cause of the harm, due to intervening events”); Aichele, 757 F.3d 347, 366 (3d Cir. 2014) (explaining that an indirect causal relationship will suffice, so long as there is a fairly traceable connection, even if the direct cause of injury is a third party). Defendant argues that Plaintiff cannot establish traceability, both because it is not clear that any hackers accessed the data within the nine-day period, and because the type of information exposed is not the type of information that would facilitate the attempted bank fraud that Plaintiff asserts. Both arguments fail. Although there are certainly data breach cases where the known identities and behaviors of hackers might help a plaintiff plead a tighter causal link, a data breach incident need not have a known hacker to merit standing. Here, Plaintiff plausibly alleges that as a result of Defendant’s flawed policies and inadequate cyber security training, his sensitive information was exposed for nine days, rendering it susceptible to automatic web scraping bots. Further, Plaintiff alleges that Defendant failed to notify any affected parties of the breach for nine months, deeply undercutting Plaintiff’s ability to mitigate potential harm. And shortly after Plaintiff’s information became available online, in addition to the significant emotional distress, time, and money he allegedly expended, he began experiencing signs of identity theft through attempted bank fraud and a spike in spam calls. It is not difficult to discern a causal link between both Defendant’s failure to safeguard sensitive data and to provide prompt notice and the harms that Plaintiff asserts, even if Plaintiff cannot point to the specific data scraping bot or scam caller at play. Additionally, it is significant that Defendant failed to notify Incident victims for nine months. Cf. Clemens, 48 F.4th at 150-51 (where affected parties were notified immediately and encouraged to take precautionary measures, including enrolling in defendant’s complimentary credit-monitoring service); Roma, 2024 WL 3678984 , at *1 (notifying affected parties after two months); Rauhala, 2022 WL 16553382 , at *1 (notifying affected parties after four months); In re Retreat Behavioral Health LLC, 2024 WL 1016368 , at *1 (notifying affected parties after five months). Equity favors relaxation of the pleading standard on traceability where Defendant had knowledge of the breach and does not promptly reveal it, because such delay on its part would have the effect of hindering Plaintiff’s ability to plead traceability with the precision Defendant now demands. Had Defendant timely disclosed the Incident, patterns of increased fraudulent activity such as those observed by Mr. LaSalle may have been recognized by other members of the putative class, facilitating identification of further potentially affected individuals. But the lengthy delay necessarily limits the ability of those impacted by the breach to notice a pattern and assert their claims. Finally, Defendant’s simplistic assertion that one cannot attempt to open a fraudulent bank account without access to one’s banking information is divorced from reality. As recognized by the Eleventh Circuit, there is “unequivocal damage” that can be done with social security numbers, names, and dates of birth, as this data is some of “the most sensitive personal information possible.” In re Equifax Inc. Customer Data Sec. Breach Litig., 999 F.3d 1247, 1257, 1262 (11th Cir. 2021). And it is often the case that cybercriminals and hackers target password protected accounts using piecemeal sensitive information, such as the names, birthdays, social security records, and more, at issue here. At this stage of litigation, Plaintiff’s allegations that Defendant’s failure to safeguard sensitive data and to timely notify victims of the Incident led to resultant fraud, anxiety, and mitigation costs are sufficient to demonstrate traceability. While Defendant may ultimately show, after the opportunity for discovery, that the alleged injuries are not caused by the Incident, it is premature to dismiss Plaintiff’s claims on traceability grounds. See In re Marriott Int’l Inc., Customer Data Security Breach Litig., 440 F.Supp.3d 447 , 495 (D. Md. 2020) (plaintiffs sufficiently established traceability by asserting that they gave information to the defendant, defendant had a data incident, the scope of the incident was unknown, and the plaintiffs experienced harm). In sum, at least one plaintiff, Mr. LaSalle, has plausibly alleged that he has suffered an injury in fact, and that those injuries can be fairly traced to Defendant’s conduct. Lujan, 504 U.S at 560. As Defendant does not contest that Plaintiff’s injuries would be redressed by the relief Plaintiff seeks, Plaintiff has therefore plausibly alleged Article III standing.6 IV. Conclusion For the reasons set forth above, Defendant’s Motion to Dismiss will be denied. An appropriate order follows. /s/ Gerald Austin McHugh United States District Judge 6 Although not addressed by either party, Plaintiff’s claims are redressable. “The injuries caused by a data breach are ‘easily and precisely compensable with a monetary reward,’” and Plaintiff’s concerns about future harms could be assuaged if Defendant were required to take protective measures or implement new cybersecurity policies. See Clemens, 48 F.4th at 157 (citing Reilly, 665 F.3d at 45-6).