Community Bank of Trenton v. Schnuck Markets, Incorporated ( 2018 )

In the
United States Court of Appeals
For the Seventh Circuit
____________________
No. 17-2146
COMMUNITY BANK OF TRENTON, et al.,
Plaintiffs-Appellants,
v.
SCHNUCK MARKETS, INC.,
Defendant-Appellee.
____________________
Appeal from the United States District Court for the
Southern District of Illinois.
No. 15-cv-1125 — Michael J. Reagan, Chief Judge.
____________________
ARGUED JANUARY 10, 2018 — DECIDED APRIL 11, 2018
____________________
Before WOOD, Chief Judge, HAMILTON, Circuit Judge, and
BUCKLO, District Judge. *
HAMILTON, Circuit Judge. In late 2012, hackers infiltrated
the computer networks at Schnuck Markets, a large
Midwestern grocery store chain based in Missouri and known
as “Schnucks.” The hackers stole the data of about 2.4 million
*
The Honorable Elaine E. Bucklo, United States District Judge for the
Northern District of Illinois, sitting by designation.
2 No. 17-2146
credit and debit cards. By the time the intrusion was detected
and the data breach was announced in March 2013, the
financial losses from unauthorized purchases and cash
withdrawals had reached into the millions. Litigation ensued.
Like many other recent cases around the country, this case
involves a massive consumer data breach. See, e.g., Lewert v.
P.F. Chang’s China Bistro, Inc., 819 F.3d 963 (7th Cir. 2016);
Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688 (7th Cir.
2015). Unlike most other data-breach cases, however, the
proposed class of plaintiffs in this case is comprised not of
consumers but of financial institutions. Card-issuing banks
and credit unions are required by federal law to indemnify
their card-holding customers for losses from fraudulent
activity, so our four plaintiff-appellant banks here bore the
costs of reissuing cards and indemnifying the Schnucks
hackers’ fraud. See 15 U.S.C. § 1643(a) (limiting credit-card-
holder liability for unauthorized use); 12 C.F.R. § 205.6
(limiting debit-card-holder liability for unauthorized use).
The Article III standing and injury issues that arose in Lewert,
Remijas, and many other data-breach cases with consumer
plaintiffs are not issues in this case.
The principal issues in this case present fairly new
variations on the economic loss rule in tort law. The central
issue is whether Illinois or Missouri tort law offers a remedy
to card-holders’ banks against a retail merchant who suffered
a data breach, above and beyond the remedies provided by
the network of contracts that link merchants, card-processors,
banks, and card brands to enable electronic card payments.
The plaintiff banks assert claims under the common law as
well as Illinois consumer protection statutes. Our role as a
federal court applying state law is to predict how the states’
No. 17-2146 3
supreme courts would likely resolve these issues. We predict
that both states would reject the plaintiff banks’ search for a
remedy beyond those established under the applicable
networks of contracts. Accordingly, we affirm the district
court’s dismissal of the banks’ complaint.
I. Factual Background and Procedural History
A. Today’s Electronic Payment Card System
When a customer uses a credit or debit card at a retail
store, the merchant collects the customer’s information. This
includes the card-holder’s name and account number, the
card’s expiration date and security code, and, in the case of a
debit card, the personal identification number. Collectively,
this payment card information is known as “track data.” At
the time of purchase, the track data and the amount of the
intended purchase are forwarded electronically to the
merchant’s bank (the “acquiring bank”), usually through a
payment processing company. The acquiring bank then
requests payment from the customer’s bank (the “issuing
bank”) through the relevant card network—in this case, Visa
or MasterCard. If the issuing bank approves the purchase, the
transaction goes through within seconds. The customer’s
issuing bank then pays the merchant’s acquiring bank the
amount of the customer’s purchase, which is credited to the
merchant’s account, minus processing fees. Contracts govern
all of these relationships, although typically no contracts
directly link the merchant (e.g., Schnucks) with the issuing
banks (our four plaintiffs here). Here is a simplified diagram
of this series of relationships:
4 No. 17-2146
The Card Payment System
Card Network
e.g., Visa,
MasterCard
Acquiring Issuing Bank
Bank e.g., Community
e.g., Citicorp Bank of Trenton
Retail Retail
Merchant Customer
e.g., Schnucks
In this case, Schnucks routed customer track data through
a payment processor, First Data Merchant Services, to its
acquiring bank, Citicorp. Citicorp then routed customer track
data through the card networks to the issuing banks
(plaintiffs here), who approved purchases and later collected
payments from their customers, the card-holders. This web of
contractual relationships facilitates the dotted line above: the
familiar retail purchase by a customer from a merchant.
Because Schnucks was the weak security link in this regime,
the plaintiff banks seek to recover directly from Schnucks
itself, a proposed line of liability represented by the dashed
line above. This new form of liability would be in addition to
the remedies already provided by the contracts governing the
card payment systems.
No. 17-2146 5
B. The Contracts that Enable the Card Payment System
All parties in the card payment system agree to take on
certain responsibilities and to subject themselves to specified
contractual remedies. In joining the card payment system,
issuing banks—including our plaintiffs here—agree to
indemnify their customers in the event that a data breach
anywhere in the network results in unauthorized
transactions. 1 Visa requires issuers to “limit the Cardholder’s
liability to zero” when a customer timely notifies them of
unauthorized transactions. Appellee App. at 99–100
(§ 4.1.13.3). MasterCard has the same requirement. Id. at 107
(§ 6.3).
For their parts, acquiring banks and their agents must
abide by data security requirements. Id. at 102. As a merchant,
Schnucks also agreed to abide by data security requirements
in the contracts linking it to the card payment system. Id. at
54, 58, 70–72, 73. These data security rules are called the
Payment Card Industry Data Security Standards or “PCI
DSS.” In their contracts, Schnucks, its bank, and its data
processor effectively agreed to share resulting liabilities from
any data breaches. Id. at 53–54, 70–71, 73 (Master Services
Agreement §§ 4, 5.4; Bankcard Addendum §§ 23, 25, 28); see
also Schnuck Markets, Inc. v. First Data Merchant Services Corp.,
852 F.3d 732, 735, 737–39 (8th Cir. 2017) (“First Data”)
(interpreting § 5.4 in light of this data breach at Schnucks). As
we explain below, the specific details of these contractual
1 This contractual duty goes beyond the federal law requirement to
limit customer liability in the event of a data breach. See 15 U.S.C.
§ 1643(a); 12 C.F.R. § 205.6.
6 No. 17-2146
remedies do not matter here. What is important is that they
exist at all, by agreements among the interested parties.
When a retailer or other party in the card payment system
suffers a data breach, issuing banks must bear the cost, at least
initially, of indemnifying their customers for unauthorized
transactions and issuing new cards. The contracts that govern
both the Visa and MasterCard networks then provide a cost
recovery process that allows issuing banks to seek
reimbursement for at least some of these losses. See Appellee
App. at 102 (Visa), 110 (MasterCard). Schnucks agreed to
follow card network “compliance requirements” for data
security and to pay “fines” for noncompliance. Id. at 70. Our
colleagues in the Eighth Circuit later read Schnucks’ contract
with its data processor and acquiring bank to include
significant limits on Schnucks’ share of the liability for losses
of issuing banks. See First Data, 852 F.3d at 736, 737–39
(holding that contractual limit on liability favoring Schnucks
applied to limit liabilities resulting from this data breach). 2
2 We can properly consider the remedies provided in the card brand
rules and Schnucks’ contractual agreements. A court deciding a motion to
dismiss under Rule 12(b)(6) may consider documents that are attached to
a complaint or that are central to the complaint, even if not physically
attached to it. Tierney v. Vahle, 304 F.3d 734, 738 (7th Cir. 2002) (discussing
Rules 12(b)(6) and 10(c)); see also, e.g., Mueller v. Apple Leisure Corp., 880
F.3d 890, 895 (7th Cir. 2018) (affirming dismissal of contract claims); Hecker
v. Deere & Co., 556 F.3d 575, 578, 582–83 (7th Cir. 2009) (affirming dismissal
of ERISA claims). Moreover, even the plaintiff banks say they want the
court to consider these contracts “as to the liability issues” because they
establish “the data protection and reporting standards to which Schnucks
agreed to be bound.” Reply Br. at 4. We cannot consider in isolation just
those contractual provisions that plaintiffs find helpful. See Minnesota Life
Insurance Co. v. Kagan, 724 F.3d 843, 850–51 (7th Cir. 2013). The substance
of contracts among members of the card payment system is important in
No. 17-2146 7
C. The Schnucks Data Breach and Response
In early December 2012, hackers gained access to
Schnucks’ computer network in Missouri and installed
malicious software (known as “malware”) on its system. This
malware harvested track data from the Schnucks system
while payment transactions were being processed. As soon as
payment cards were swiped at a Schnucks store and the
unencrypted payment card information went from the card
reader into the Schnucks system for payment, customer
information was available for harvesting. The breach affected
79 of Schnucks’ 100 stores in the Midwest, many of which are
located in Missouri and Illinois, the states whose laws we
consider here.
For the next four months, hackers harvested and sold
customer track data, which were used to create counterfeit
cards and to make unauthorized cash withdrawals, including
from the plaintiff banks. Schnucks says it did not learn of the
breach until March 14, 2013, when it heard from its card
payment processor. A few days later, an outside consultant
quickly identified the source of the problem. On March 30,
Schnucks issued a press release announcing the data breach.
The plaintiff banks estimate that for every day the data
breach continued, approximately 20,000 cards may have been
deciding whether to impose tort liability on top of existing contractual
remedies. Cf. Lone Star Nat’l Bank, N.A. v. Heartland Payment Systems, Inc.,
729 F.3d 421, 426 (5th Cir. 2013) (reversing dismissal of issuing banks’ tort
claims against payment processor; record was uncertain as to contractual
remedies). From the contracts in our record, we know that the issuing
banks (plaintiffs here), the specific acquiring bank (Citicorp), and the
breached retail merchant (Schnucks) are all voluntarily part of the card
payment systems and subject to their rules and remedies.
8 No. 17-2146
compromised. This means around 2.4 million cards in total
were at risk from the Schnucks breach. Given this rate,
plaintiffs estimate that more than 300,000 cards may have
been compromised between March 14 and March 30, after
Schnucks knew that security had been breached but before it
announced that fact publicly. The plaintiff banks allege that
numerous security steps could have prevented the breach and
that those steps are required by the card network rules. 3 In
fact, under the networks’ contractual provisions, the card
networks later assessed over $1.5 million in reimbursement
charges and fees against Schnucks, which eventually split that
liability with its card processor and acquiring bank. Brief for
Appellants at 4, First Data, 852 F.3d 732 (8th Cir. 2017) (No. 15-
3804), 2016 WL 284697, at *4; see also First Data, 852 F.3d at
735–36 (describing card networks’ expectations, assessments,
and resulting litigation).
D. The Banks’ Lawsuit
The plaintiff banks, which may or may not have received
some of those reimbursement funds, filed a lawsuit in 2014
seeking to be made whole directly by Schnucks. The banks
dismissed their first complaint voluntarily and then filed this
action in the Southern District of Illinois in October 2015. They
amended their complaint in October 2016. The banks contend
that despite the existence of the contractual remedies, issuing
banks “cannot always recoup the reimbursed fraudulent
charges” and must pay other fees and bear card reissuing
3 These steps include installing appropriate antivirus software,
complying with network segmentation and firewall standards, encrypting
sensitive payment data, tracking and monitoring all access to payment
information, and implementing two-factor authentication for remote
access.
No. 17-2146 9
costs, which these banks seek to recover from Schnucks.
Appellants’ Br. at 11. 4
In effect, the banks seek reimbursement for their losses
above and beyond the remedies provided under the card
network contracts. They say their losses include employee
time to investigate and resolve fraud claims, payments to
indemnify customers for fraudulent charges, and lost interest
and transaction fees on account of changes in customer card
usage. Plaintiffs estimate their damages in the tens of millions
of dollars, placing this lawsuit in the same league as some
others between financial institutions and breached retail
merchants. See David L. Silverman, Developments in Data
Security Breach Liability, 72 Bus. Law. 185, 185 (Winter 2016–
17) (discussing three recent data breach cases settled by retail
merchants for more than $15 million, including attorney fees).
In a thorough order, the district court dismissed all of the
plaintiff banks’ claims against Schnucks. No. 15-cv-01125-
MJR, 2017 WL 1551330, at *1–2 (S.D. Ill. May 1, 2017).
Jurisdiction was secure under the Class Action Fairness Act.
The proposed plaintiff class of banks includes both Illinois
and Missouri citizens; Schnucks is a citizen of Missouri; and
4 The most important set of facts alleged by the plaintiffs involves the
March 14–30 period, when Schnucks knew of the data breach but had not
yet alerted banks and consumers. Because Schnucks “derives the majority
of its revenue from electronic payment card transactions,” plaintiffs
believe Schnucks intentionally dragged its feet in announcing the data
breach. See Am. Compl. ¶ 59. By having substandard security and by
delaying disclosure of the breach, plaintiffs allege, Schnucks “saved the
cost of implementing the proper payment card security policies,
procedures, protocols, and hardware and software systems, and …
wrongfully shifted the risk and expense of the Data Breach” to the banks.
Am. Compl. ¶ 84.
10 No. 17-2146
the matter in controversy exceeds $5 million. See 28 U.S.C.
§ 1332(d)(2). The parties agreed that both Illinois and
Missouri laws apply, given the proposed plaintiff class. None
of the plaintiff banks’ claims made it past the pleadings. The
complaint was dismissed for failing to state a plausible claim
under any of the banks’ theories.
II. Analysis
A. Standard of Review
We review de novo the dismissal of a complaint for failure
to state a claim under Rule 12(b)(6), accepting plaintiffs’
factual allegations as true and drawing all permissible
inferences in the plaintiffs’ favor. West Bend Mut. Insurance Co.
v. Schumacher, 844 F.3d 670, 675 (7th Cir. 2016). A plaintiff
must, however, “provide more than mere labels and
conclusions” and must go beyond “a formulaic recitation of
the elements of a cause of action for her complaint to be
considered adequate.” Id., quoting Bell v. City of Chicago, 835
F.3d 736, 738 (7th Cir. 2016). A party must also “proffer some
legal basis to support his cause of action” and cannot expect
either the district court or this court to “invent legal
arguments” on his behalf. County of McHenry v. Insurance Co.
of the West, 438 F.3d 813, 818 (7th Cir. 2006), quoting Stransky
v. Cummins Engine Co., 51 F.3d 1329, 1335 (7th Cir. 1995).
B. Common Law Claims
1. Framing the Analysis
The plaintiff banks’ substantive claims all arise under state
law, but the relevant state courts have not addressed the
specific questions we face. Under Erie Railroad Co. v. Tompkins,
304 U.S. 64 (1938), our role in deciding these questions of state
law is to predict how the highest courts of the respective states
No. 17-2146 11
would answer them. In re Zimmer, NexGen Knee Implant
Products Liability Litig., 884 F.3d 746, 751 (7th Cir. 2018);
Cannon v. Burge, 752 F.3d 1079, 1091 (7th Cir. 2014). We are to
take into account trends in a state’s intermediate appellate
decisions, see In re Zimmer, 884 F.3d at 751, but the focus is
always a prediction about the state’s highest court. See Santa’s
Best Craft, LLC v. St. Paul Fire & Marine Insurance Co., 611 F.3d
339, 349 n.6 (7th Cir. 2010), citing Taco Bell Corp. v. Continental
Cas. Co., 388 F.3d 1069, 1077 (7th Cir. 2004) (concerned with
making a “reliable prediction of how the Supreme Court of
Illinois would rule”). In predicting state law in the relevant
states, we try to avoid simply grafting abstract hornbook law
principles onto the particular fact pattern in front of us, see
NLRB v. Int’l Measurement & Control Co., 978 F.2d 334, 339 (7th
Cir. 1992) (refusing to defer to agency’s prediction of state law
based on “blackletter terms” without citing state court
decisions), but we can look to well-reasoned decisions in other
jurisdictions for guidance.
To frame the issues, we begin by examining the economic
loss doctrine in commercial litigation. For more than fifty
years, state courts have generally refused to recognize tort
liabilities for purely economic losses inflicted by one business
on another where those businesses have already ordered their
duties, rights, and remedies by contract. The reason for this
rule is that “liability for purely economic loss … is more
appropriately determined by commercial rather than tort
law,” i.e., by the system of rights and remedies created by the
parties themselves. Indianapolis-Marion County Public Library
v. Charlier Clark & Linard, P.C., 929 N.E.2d 722, 729 (Ind. 2010),
citing Miller v. U.S. Steel Corp., 902 F.2d 573, 574 (7th Cir. 1990)
(“tort law is a superfluous and inapt tool for resolving purely
commercial disputes” whose risks are better allocated by the
12 No. 17-2146
contracting parties themselves than by judges), and citing
Seely v. White Motor Co., 403 P.2d 145 (Cal. 1965). “The issue”
in these cases “is not causation; it is duty,” in the sense that
tort law generally does not supply additional liabilities on top
of specified contractual remedies. Rardin v. T & D Machine
Handling, Inc., 890 F.2d 24, 26, 27–28 (7th Cir. 1989) (applying
Illinois law).
Courts invoking the economic loss rule trust the
commercial parties interested in a particular activity to work
out an efficient allocation of risks among themselves in their
contracts. Courts “see no reason to intrude into the parties’
allocation of the risk” when bargaining should be sufficient to
protect the parties’ interests, and where additional tort law
remedies would act as something of a wild card to upset their
expectations. East River S.S. Corp. v. Transamerica Delaval Inc.,
476 U.S. 858, 872–73, 875–76 (1986) (adopting economic loss
rule in admiralty cases); see also Sovereign Bank v. BJ’s
Wholesale Club, Inc., 533 F.3d 162, 176 (3d Cir. 2008) (explaining
Robins Dry Dock & Repair Co. v. Flint, 275 U.S. 303 (1927), an
early case limiting tort liabilities for economic losses).
The doctrinal explanation is relatively simple: tort law
often applies where there is “a sudden, calamitous accident as
distinct from a mere failure to perform up to commercial
expectations.” Rardin, 890 F.2d at 29. In the latter case, contract
law should be sufficient because a sophisticated business
plaintiff could “have protected himself through his
contractual arrangements” ahead of time. See id. at 28; see also
Chicago Heights Venture v. Dynamit Nobel of America, Inc., 782
F.2d 723, 729 (7th Cir. 1986) (applying Illinois law and
comparing “the ‘safety-insurance policy of tort law’” to the
“‘expectation-bargain protection policy’ of contracts”); Mark
No. 17-2146 13
P. Gergen, The Ambit of Negligence Liability for Pure Economic
Loss, 48 Ariz. L. Rev. 749, 752 (2006) (even when there is a need
for tort liability, if conduct results in “solely pecuniary harm”
and there are reasons to doubt tort law’s efficacy in providing
proper incentives, “the common law has erred on the side of
preserving freedom of action, rather than on the side of
protecting against harm”).
This principle has also been applied in other contexts. For
example, when physical or personal injuries occur because of
defective products, “[s]ociety has a great interest in spreading
the cost of such injuries,” but when a product causes
economic loss by simply failing to perform as expected, tort
liability is unwarranted; the Uniform Commercial Code
already provides “a finely tuned mechanism for dealing with
the rights of parties to a sales transaction with respect to
economic losses.” Sanco, Inc. v. Ford Motor Co., 579
F. Supp. 893, 897, 898 (S.D. Ind. 1984) (Dillin, J.), citing Seely,
403 P.2d at 151. Similarly, in construction disputes, where the
complex relationship of contractors and subcontractors is
analogous to the web of contracts in this case, the economic
loss rule encourages contracting parties to “prospectively
allocate risk and identify remedies within their agreements.”
Flagstaff Affordable Housing Ltd. Partnership v. Design Alliance,
Inc., 223 P.3d 664, 670 (Ariz. 2010). “These goals would be
undermined by an approach that allowed extra-contractual
recovery for economic loss based not on the agreement itself,
but instead on a court’s post hoc determination that a
construction defect”—or a data breach—“posed risks of other
loss … .” Id.
Some form of the economic loss rule is the rule in most
jurisdictions in the United States, Rardin, 890 F.2d at 28,
14 No. 17-2146
including Illinois and Missouri. In Illinois, it is known as the
Moorman doctrine, from Moorman Mfg. Co. v. Nat’l Tank Co.,
435 N.E.2d 443 (Ill. 1982). Illinois applies Moorman to services
as well as the sale of goods because both business contexts
provide “the ability to comprehensively define a
relationship” by contract. Fireman’s Fund Ins. Co. v. SEC
Donohue, Inc., 679 N.E.2d 1197, 1200 (Ill. 1997), quoting
Congregation of the Passion, Holy Cross Province v. Touche Ross &
Co., 636 N.E.2d 503, 514 (Ill. 1994). Illinois recognizes three
exceptions, but none applies here: for personal injuries or
property damage resulting from sudden or dangerous
occurrences, for fraud, and for negligent misrepresentations
by professional business advisors. Id. at 1199. Missouri more
generally prohibits “a plaintiff from seeking to recover in tort
for economic losses that are contractual in nature.” Autry
Morlan Chevrolet Cadillac, Inc. v. RJF Agencies, Inc., 332 S.W.3d
184, 192 (Mo. App. 2010), citing Crowder v. Vandendeale, 564
S.W.2d 879, 881 (Mo. 1978). Exceptions to the Missouri
economic loss doctrine are limited to losses arising from
personal injuries, property damage or destruction, or from
special relationships giving rise to fiduciary duties. Autry
Morlan Chevrolet, 332 S.W.3d at 192, 194.
The parties offer numerous doctrinal arguments about the
economic loss rule and common law duties. Before we dig
into those arguments, we pause to explain the broader choice
between paradigms in this case. In deciding whether
economic losses are recoverable in tort law, courts face a
choice between what scholars have called the “stranger
paradigm” and the “contracting parties paradigm.” Catherine
M. Sharkey, Can Data Breach Claims Survive the Economic Loss
Rule?, 66 DePaul L. Rev. 339, 344 (2017); see also Dan B. Dobbs,
An Introduction to Non-Statutory Economic Loss Claims, 48 Ariz.
No. 17-2146 15
L. Rev. 713, 714 (2006); William Powers, Jr., Border Wars, 72
Tex. L. Rev. 1209, 1229 (1994) (addressing more general issue
of borders between contract and tort law in terms of
competing paradigms); Vincent R. Johnson, The Boundary-Line
Function of the Economic Loss Rule, 66 Wash. & Lee L. Rev. 523,
546 (2009) (addressing purposes of rule).
The stranger paradigm fits “when an actor’s negligence
causes financial losses to a party with whom the actor has no
pre-existing relationship.” Sharkey, 66 DePaul L. Rev. at 344.
The stranger paradigm seeks to set the “parameters of the
duty of reasonable care … at physical injuries and property
damage” and, traditionally, does not allow recovery for
simple economic losses. Id. But some courts taking this
approach in data breach cases have decided to allow tort
recovery anyway, both for consumers and for sophisticated
financial institutions. These courts, one scholar argues, “are
doing so not only in an ad hoc manner, but also by stretching
and misapplying the stranger paradigm” instead of taking a
“broader regulatory perspective.” Id. at 383.
The contracting parties paradigm approaches the problem
differently. Under this paradigm, “the question is whether a
duty should be imposed by [tort] law … over and above … any
voluntary allocation of risks and responsibilities already
made between the contracting parties.” Id. at 344–45. In this
approach, the presence of contract remedies sets a boundary
for tort law. If “contract law purports to decide the case, the
negligence paradigm … should stay in the background.” Id.
at 345 n.16, quoting Powers, 72 Tex. L. Rev. at 1229 (alteration
in original).
Courts using the contracting parties paradigm first take
into account the mechanisms the parties have chosen to
16 No. 17-2146
allocate the risks they face. Courts then consider whether
these mechanisms have sufficiently reduced the externalities
visited upon third parties, or whether the breached entities
need additional financial incentives to pursue better data
security. Id. at 382–83. The ultimate question is whether these
arrangements already place costs on “the cheapest cost
avoider” or whether additional tort liability is necessary
because the existing contracts “externalize significant risk
onto hapless third parties.” Id. at 383.
The plaintiff banks emphasize here that they have no
direct contractual relationship with Schnucks. That’s true, but
it does not undermine use of the contracting parties
paradigm. The plaintiff banks and Schnucks all participate in
a network of contracts that tie together all the participants in
the card payment system. That network of contracts imposes
the duties plaintiffs rely upon and provides contractual
remedies for breaches of those duties. See Annett Holdings, Inc.
v. Kum & Go, L.C., 801 N.W.2d 499, 504 (Iowa 2011) (“When
parties enter into a chain of contracts, even if the two parties
at issue have not actually entered into an agreement with each
other, courts have applied the ‘contractual economic loss rule’
to bar tort claims for economic loss, on the theory that tort law
should not supplant a consensual network of contracts.”),
citing Dobbs, 48 Ariz. L. Rev. at 726 (discussing relationships
among buyers, retailers, and manufacturers and landowners,
contractors, and subcontractors). Under these circumstances,
we believe the Illinois and Missouri courts would most likely
use the contracting parties paradigm.
As described above, in deciding to join the card payment
system, Schnucks agreed to abide by the data security
standards of the industry, the PCI DSS. Schnucks also agreed
No. 17-2146 17
to be subject to assessments and fines from the card networks
in the event that it was responsible for data breaches and
unauthorized card activity. On their end, the plaintiff banks
agreed to exceed federal requirements for indemnifying their
card-holders and also consented to the remedial assessment
and reimbursement process provisions and related risks.
Even if these issuing banks had heard of this particular
merchant before its data breach was announced, parties to the
card payment system are not ships passing (or colliding) in
the night. All parties involved in the complicated network of
contracts that establish the card payment system have
voluntarily decided to participate and to accept responsibility
for the risks inherent in their participation. This includes at
least some risk of not being fully reimbursed for the costs of
another party’s mistake.
The details of these reimbursement remedies are not fully
apparent from the contract excerpts presented in this case. But
what matters is not the details of the remedies but their
existence. Merchants and acquiring banks face the financial
cost of data breaches through the card networks’
reimbursement regime. That means the cheapest cost
avoiders (the data handlers) already bear the cost of data
security protocols and breaches. The plaintiff banks in this
case make no effort to explain how this system is inadequate
in providing reimbursement. They ask us, though, to predict
the recognition of new theories of state tort liability through
simplistic application of sweeping black-letter tort law
principles, leaving the card network reimbursement systems
to be considered as mere damage issues on remand.
Given this network of contracts and contractual remedies,
we decline plaintiffs’ invitation to apply a version of the
18 No. 17-2146
stranger paradigm. We doubt the wisdom of recognizing new,
supplemental liabilities without a clear sense of why they are
necessary. It’s not as if the banks have no rights or remedies at
all. This is also not a situation where sensitive data is collected
and then disclosed by private, third-party actors who are not
involved in the customers’ or banks’ direct transactions. See,
e.g., In re Equifax, Inc., Customer Security Data Breach Litigation,
— F. Supp. 3d —, 2017 WL 6031680 (J.P.M.L. 2017). The
plaintiff banks seek additional recovery because they are
disappointed by the reimbursement they received through
the contractual card payment systems they joined voluntarily.
The legal issues raised by the plaintiff banks are similar to
the issues that arise in large construction projects with layers
of contractors, subcontractors, sub-subcontractors, and so on.
There may be no direct contractual relationship between a
negligent subcontractor and other businesses that suffer from
delays and expenses it caused. Yet all participants are tied into
a network of contracts that allocate the risks of sub-standard
or slow work. In such cases, as the Indiana Supreme Court has
explained, claims of purely economic loss are better treated
under contract law, without supplementary remedies from
tort law. See Indianapolis-Marion County Public Library,
929 N.E.2d at 740 (“the substance of our holding is that when
it comes to claims for pure economic loss, the participants in
a major construction project define for themselves their
respective risks, duties, and remedies in the network or chain
of contracts governing the project”). Illinois and Missouri
have reached the same general conclusion about contractual
relationships in construction disputes. See Fireman’s Fund
Insurance Co., 679 N.E.2d at 1198, 1201–02 (holding that
economic loss rule barred bar tort recovery by subcontractor’s
insurance company against construction engineers); Fleischer
No. 17-2146 19
v. Hellmuth, Obata & Kassabaum, Inc., 870 S.W.2d 832, 834, 837
(Mo. App. 1993) (holding that in absence of direct contract,
architect owed no duty of care and was not liable to
construction manager in tort for economic losses as result of
negligent performance of contract with property owner).
As we explain in more detail below, we do not see either a
paradigmatic or doctrinal reason why either Illinois or
Missouri would recognize a tort claim by the issuing banks in
this case, where the claimed conduct and losses are subject to
these networks of contracts. We now turn to plaintiffs’ more
specific doctrinal arguments.
2. Negligence Claims
a. Illinois Law
Plaintiffs allege that Schnucks, a retail merchant, had a
common law duty to safeguard customers’ track data and that
the duty extends to its customers’ banks. We first consider this
question under Illinois tort law, which asks whether the
defendant had “an obligation of reasonable conduct for the
benefit of the plaintiff” using a four-factor analysis. Marshall
v. Burger King Corp., 856 N.E.2d 1048, 1057 (Ill. 2006). Though
duty is a basic concept in tort law, the Illinois Supreme Court
has not directly spoken to this question in the context of data
breaches, so “we consider decisions of intermediate appellate
courts unless there is good reason to doubt the state’s highest
court would agree with them.” Anicich v. Home Depot U.S.A.,
Inc., 852 F.3d 643, 649 (7th Cir. 2017), citing Rodas v. Seidlin, 656
F.3d 610, 626 (7th Cir. 2011).
The Illinois Appellate Court addressed this topic in Cooney
v. Chicago Public Schools, where Social Security numbers and
other personal information of more than 1,700 former school
20 No. 17-2146
employees were disclosed in a mailing. 943 N.E.2d 23, 27 (Ill.
App. 2010). The Cooney court first considered whether a duty
to safeguard personal information was imposed by federal or
state statutes. It rejected the theory that the Illinois Personal
Information Protection Act (PIPA) or the federal Health
Insurance Portability and Accountability Act of 1996 (HIPAA)
imposed any such duty beyond providing notice of a security
breach. Id. at 28.
Cooney then rejected “‘a new common law duty’ to
safeguard information,” writing that “we do not believe that
the creation of a new legal duty beyond legislative
requirements,”—i.e., beyond notice—“is part of our role on
appellate review.” Id. at 28–29. The Cooney court concluded
that “the legislature has specifically addressed the issue and
only required the [School] Board to provide notice of the
disclosure,” which it had done. Id. at 29. The contractor who
actually sent the offending mailing, All Printing & Graphics,
Inc., was similarly excused from tort liability for its
negligence. Id. Cooney did not characterize its holding on the
duty question as an application of the economic loss rule. The
opinion reads as a more general statement that no duty to
safeguard personal information existed, regardless of the
kind of loss. See id. at 28–29. Nothing in the Cooney analysis
indicates that retail merchants like Schnucks should or would
be treated differently than the former employer and
contractor at issue there. In the absence of some other reason
why the Illinois Supreme Court would likely disagree with
the Cooney analysis on this issue of duty under the common
law, see Anicich, 852 F.3d at 649, we predict that the state court
No. 17-2146 21
would not impose the common law data security duty the
plaintiff banks call for here. 5
Even if Cooney had not come to this conclusion, Illinois
would probably apply the economic loss rule to bar recovery
anyway. As mentioned above, Illinois’ Moorman doctrine has
three exceptions, Fireman’s Fund Insurance Co., 679 N.E.2d at
1199–1200, but none applies here. There was no sudden or
dangerous occurrence. Data breaches are a foreseeable (and
foreseen) risk of participating in the card networks, not an
unexpected physical hazard. See Moorman, 435 N.E.2d at 449,
citing Cloud v. Kit Mfg. Co., 563 P.2d 248, 251 (Alaska 1977)
(severe property damage caused by fire). Though the plaintiff
banks suggested in their complaint that Schnucks engaged in
“wrongful conduct” or “wrongful actions … [and] omissions”
by not immediately announcing the data breach,
see Am. Compl. ¶¶ 59, 112-13, 117-18, these allegations fail to
identify specifically an actionable fraudulent statement under
Illinois law. See below at 33–36; see also Moorman, 435 N.E.2d
at 452, citing Soules v. General Motors Corp., 402 N.E.2d 599, 601
(Ill. 1980) (involving allegations of falsified franchisee
financial reports). Finally, Schnucks did not have a
professional advisory relationship with the plaintiff banks
here, so that exception also does not apply. See Moorman, 435
N.E.2d at 452, citing Rozny v. Marnul, 250 N.E.2d 656, 663 (Ill.
5 The plaintiff banks attempt to distinguish Cooney by pointing out
that track data, as opposed to Social Security numbers, can be used more
easily to cause lasting financial harm. From the card-holding consumer’s
perspective, given federally-mandated and card network-promised
indemnification, this may or may not be true. And the plaintiffs point to
no Illinois authority that explains why this difference, or the fact that
financial institutions seek to impose this duty here, should change the
result.
22 No. 17-2146
1969) (permitting recovery for economic losses caused by “a
surveyor’s professional mistakes”); see also In re Michaels
Stores Pin Pad Litigation, 830 F. Supp. 2d 518, 530 (N.D. Ill.
2011) (explaining Fireman’s Fund and other Illinois
“professional malpractice” cases).
The plaintiff banks respond to these points by claiming
that Illinois’ economic loss rule does not apply when the duty
is “extra-contractual.” The banks claim that a duty attaches
because there is no direct contract between these parties. The
problem is that all parties in the card networks (including
card-holding customers) expect everyone to comply with
industry-standard data security policies as a matter of
contractual obligation. See above at 5–6. Cooney shows that
Illinois has not recognized an independent common law duty
to safeguard personal information. The banks’ argument also
fails to account for the scope of the Moorman doctrine.
Schnucks assumed contractual data security responsibilities
in joining the card networks. Even if the plaintiff banks were
not direct parties to agreements with Schnucks, they seek
additional recovery for the breach of those contractual duties.
“Even in the absence of an alternative remedy in contract,”
Illinois does not permit tort recovery for businesses who seek
to correct the purely economic “defeated expectations of a
commercial bargain.” 2314 Lincoln Park West Condo. Ass’n v.
Mann, Gin, Ebel & Frazier, Ltd., 555 N.E.2d 346, 350 (Ill. 1990),
quoting Anderson Elec., Inc. v. Ledbetter Erection Corp., 503
N.E.2d 246, 249 (Ill. 1986). The plaintiff banks are
disappointed in the amounts the card networks’ contractual
reimbursement process provided. That type of tort claim is
not permitted under Moorman.
No. 17-2146 23
b. Missouri Law
The Missouri appellate courts have said less than Illinois
appellate courts on this question of duty. All the same
elements important to the Cooney court, though, are also
present in Missouri law. The Missouri courts use the same
four-factor common law duty test. Compare Hoffman v. Union
Elec. Co., 176 S.W.3d 706, 708 (Mo. 2005), with Marshall, 856
N.E.2d at 1057. Missouri, like Illinois, has a data privacy
statute whose only consumer-facing mandate is notice.
Compare Mo. Ann. Stat. § 407.1500 (2017), with 815 Ill. Comp.
Stat. 530/10 (2017); see also Sharkey, 66 DePaul L. Rev. at 340
n.2 (noting that 47 states have notice statutes and that only
three states “take statutory protection a step further”). In
addition, the state’s attorney general has “exclusive
authority” for enforcing Missouri’s data breach notice statute
by a civil action. § 407.1500(4) (2017). 6
Other state legislatures have acted to impose the kind of
reimbursement or damages liability the plaintiff banks call for
here. Minnesota, Nevada, and Washington stand out as
examples. See Minn. Stat. Ann. § 325E.64, subd. 3 (2017)
(requiring reimbursement and imposing liability); Nev. Rev.
Stat. Ann. § 603A.215(1), (3) (2017) (requiring PCI DSS
compliance, but holding harmless compliant data collectors
who are less than grossly negligent); Wash. Rev. Code Ann.
§ 19.255.020(3) (2017) (requiring reimbursement). We think
the Missouri courts would take notice of these state laws and
6 So far, only one court has examined this statutein a data breach case
in a reported opinion. It predicted that no such negligence cause of action
exists under Missouri law. Amburgy v. Express Scripts, Inc., 671 F. Supp. 2d
1046, 1055 (E.D. Mo. 2009).
24 No. 17-2146
draw the inference that the Missouri legislature has chosen
not to go as far. There may be statutes in other states that
envision some type of monetary recovery, see Amburgy, 671 F.
Supp. 2d at 1056, though it is clear that Missouri is not one of
them. See § 407.1500; see also Rachael M. Peters, Note, So
You’ve Been Notified, Now What? The Problem with Current Data-
Breach Notification Laws, 56 Ariz. L. Rev. 1171, 1185–87 (2014).
Even if Missouri courts were not convinced by these
comparisons and recognized a common law duty to
safeguard customer data, the economic loss doctrine would
still thwart the plaintiff banks’ claims. Missouri does not
permit “recovery in tort for pure economic damages” without
personal injuries or property damage. Autry Morlan Chevrolet
Cadillac, Inc. v. RJF Agencies, Inc., 332 S.W.3d 184, 192 (Mo.
App. 2010). Missouri’s economic loss doctrine applies to
“losses that are contractual in nature,” Captiva Lake
Investments, LLC v. Ameristructure, Inc., 436 S.W.3d 619, 628
(Mo. App. 2014), citing Autry Morlan Chevrolet, 332 S.W.3d at
192, which, as explained above regarding the contracting
parties paradigm, applies here. There is an exception from the
economic loss rule for special relationships that give rise to a
fiduciary duty, but “the existence of a business relationship
does not give rise to a fiduciary relationship, nor a
presumption of such a relationship” short of, for example, a
“financial partnership” or principal-agent relationship. See
Autry Morlan Chevrolet, 332 S.W.3d at 194, 195 (citations
omitted). Like Illinois, Missouri is not likely to recognize the
negligence claims the plaintiff banks assert here.
3. Negligence Per Se
The plaintiff banks’ negligence per se claims fail because of
the same statutory inferences. Neither Illinois nor Missouri
No. 17-2146 25
has legislatively imposed liability for personal data breaches,
opting instead to limit their statutory intervention to notice
requirements. Cooney, 943 N.E.2d at 28–29; Amburgy, 671 F.
Supp. 2d at 1055. This is critical. Both states require a plaintiff
to show, as the first element of a negligence per se action, that
a statute or ordinance has been violated. Departures from
industry custom are not sufficient, since industry custom
would be a source of common law duties to be litigated in a
negligence action. See Bier v. Leanna Lakeside Property Ass’n,
711 N.E.2d 773, 783 (Ill. App. 1999); Sill v. Burlington Northern
Railroad, 87 S.W.3d 386, 392 (Mo. App. 2002). 7
To bolster their negligence and negligence per se
arguments, the plaintiff banks cite two district court cases
declining to dismiss similar claims by banks against retail
merchants. These cases are not persuasive regarding the
common law of Illinois or Missouri. One case consciously
sought to further statutory data security breach policies not
present here. In re Target Corp. Customer Data Security Breach
Litig., 64 F. Supp. 3d 1304, 1310 (D. Minn. 2014) (denying in
7 Plaintiffs allege a violation of the Federal Trade Commission Act, 15
U.S.C. § 45, but they do not point to any FTC interpretations or court
interpretations that extend its coverage to financial institutions in
merchant data breach cases. Irwin v. Jimmy John’s Franchise, LLC and FTC
v. Wyndham Worldwide Corp. both involved customer injuries, not actions
by their banks. 175 F. Supp. 3d 1064 (C.D. Ill. 2016); 799 F.3d 236 (3d Cir.
2015). The Illinois Consumer Fraud and Deceptive Business Practices Act
incorporates by reference Commission and court interpretations of the
FTCA, 815 Ill. Comp. Stat. 505/2, but again, plaintiffs point us to no such
interpretations that support their claim of an FTCA violation here. These
FTCA arguments are too underdeveloped to consider further. See Bonte v.
U.S. Bank, N.A., 624 F.3d 461, 465–67 (7th Cir. 2010) (affirming motion to
dismiss generalized claim when appellants “provided precious little in the
way of argument” in either district court or appeal).
26 No. 17-2146
part motion to dismiss). The other was based on a prediction
of Georgia law that seems to have been incorrect. In re The
Home Depot, Inc., Customer Data Security Breach Litig., No. 1:14-
md-2583-TWT (MDL No. 2583), 2016 WL 2897520, at *6–7
(N.D. Ga. May 18, 2016) (same). 8 The district court here was
correct not to follow these cases on this point.
4. Other Common Law Claims
The plaintiff banks assert three other claims sounding in
the common law of contracts: unjust enrichment, implied
contract, and third-party beneficiary. The district court
correctly dismissed them as well. All three fail because of
basic contract law principles.
Illinois law and Missouri law on these common law
contract theories are similar. Both refuse to recognize unjust
enrichment claims where contracts already establish rights
and remedies. Guinn v. Hoskins Chevrolet, 836 N.E.2d 681, 704
(Ill. App. 2005) (“where there is a specific contract that
governs the relationship of the parties, the doctrine of unjust
enrichment has no application” (brackets and citation
omitted)); Howard v. Turnbull, 316 S.W.3d 431, 438 (Mo. App.
2010) (“plaintiff’s entering into an agreement with known
risks precluded recovery under an unjust enrichment claim
when an anticipated contingency occurred”), citing Farmers
New World Life Ins. Co. v. Jolley, 747 S.W.2d 704, 707 (Mo. App.
1988).
8 The Court of Appeals of Georgia later disagreed with the Home Depot
prediction of state law. McConnell v. Dep’t of Labor, 787 S.E.2d 794, 797 n.4
(Ga. App. 2016), vacated on other grounds, McConnell v. Dep’t of Labor, 805
S.E.2d 79 (Ga. 2017).
No. 17-2146 27
Illinois and Missouri also do not recognize implied
contracts where written agreements define the business
relationship. Industrial Lift Truck Service Corp. v. Mitsubishi Int’l
Corp., 432 N.E.2d 999, 1002 (Ill. App. 1982) (“Quasi-contract is
not a means for shifting a risk one has assumed under
contract.”); City of Cape Girardeau ex rel. Kluesner Concreters v.
Jokerst, Inc., 402 S.W.3d 115, 121–22, 122 (Mo. App. 2013)
(contract may be implied by law where “there is no formal
contract” covering specific subject of dispute).
Neither state recognizes third-party beneficiary claims
unless the beneficiary is identified or the third-party benefit
is clearly intended by the contracting parties. Construction
law is again helpful here. Illinois and Missouri have required
a subcontractor to show that the contract in question between
the principal parties clearly extends the rights of a third-party
beneficiary. See L.K. Comstock & Co. v. Morse/UBM Joint
Venture, 505 N.E.2d 1253, 1257 (Ill. App. 1987); Drury Co. v.
Missouri United School Insurance Counsel, 455 S.W.3d 30, 34–35
(Mo. App. 2014).
As the district court found, Schnucks was not unjustly
enriched. Its card-paying customers paid the same amount as
those paying in cash; thus there is no unjust enrichment left
uncovered outside of the card payment system contracts. As
for an implied contract, the First Circuit has recognized an
implied contract between a grocery store’s customers and the
store over the safeguarding of personal data. See Anderson v.
Hannaford Bros. Co., 659 F.3d 151, 158–59 (1st Cir. 2011)
(predicting Maine law). In this case, however, the only
business activity between the plaintiff banks and Schnucks
happened (nearly instantaneously) through the indirect route
of the card payment system, not in a direct face-to-face retail
28 No. 17-2146
transaction. Even if we assume that Illinois or Missouri would
accept the Hannaford Brothers logic, in the absence of any state
authority on the point, we see no basis to predict that either
state would extend that logic to find that the implied
contractual duty extended to a customer’s bank.
Similarly, we have no reason to think Illinois or Missouri
would conclude that a retail merchant and its customer
specifically intended the customer’s bank to be a third-party
beneficiary of their retail transaction. Illinois has rejected this
theory where a construction subcontractor (not unlike the
plaintiff banks here) sought damages for a breach of the
contract between a construction manager and a construction
client (like the retail merchant and customer here,
respectively), where provisions of the contract were
inconsistent with the idea that it envisioned the subcontractor
as a third-party beneficiary. L.K. Comstock & Co., 505 N.E.2d at
1257. Missouri has permitted third-party recovery in the
context of a subcontractor and a construction client’s
insurance policy, though apparently only because the relevant
contract specifically named “the Owner, the Contractor,
Subcontractors and Sub-subcontractors in the Project” in its
insurance provisions. Drury Co., 455 S.W.3d at 35 (emphasis
added).
The plaintiff banks have not argued on appeal that the
card payment system contracts specifically envision them as
a third-party beneficiary regarding the data security
provisions, nor did they argue this point in the district court
beyond vague references to the interchange fees the issuing
banks receive simply for being part of the card payment
system. See Dkt. 65 at 17; Am. Compl. ¶ 24. This is not enough
to overcome the “strong presumption” in Illinois law “that
No. 17-2146 29
parties intend a contract to apply solely to themselves” for
enforcement purposes. Bank of America, N.A. v. Bassman FBT,
L.L.C., 981 N.E.2d 1, 11 (Ill. App. 2012); see also Martis v.
Grinnell Mut. Reinsurance Co., 905 N.E.2d 920, 924 (Ill. App.
2009) (“It must appear from the language of the contract that
the contract was made for the direct, not merely incidental,
benefit of the third person.”); accord, FDIC v. G. III
Investments, Ltd., 761 S.W.2d 201, 204 (Mo. App. 1988) (“The
party claiming rights as a third party beneficiary has the
burden of showing that provisions in the contract were
intended to be made for his direct benefit.”).
No express contract exists between Schnucks and its
customers (beyond the basic exchange of products for
payment), let alone one that specifically intends to include the
plaintiff banks as third-party beneficiaries. As with
construction contracts, the direct rights and reimbursement
possibilities provided by the web of contracts, either for the
construction job or the card payment system, define the limits
of recovery. See, e.g., Indianapolis-Marion County Public Library
v. Charlier Clark & Linard, P.C., 929 N.E.2d 722, 740 (Ind. 2010).
In this case, the web of contracts also precludes resort to
secondary common law contract theories. We affirm the
district court’s rejection of these theories.
5. Decisions in Other Circuits
One other federal circuit court has reached a different
prediction of state law on facts similar to these. Our
colleagues in the Fifth Circuit predicted that New Jersey
would recognize a negligence claim brought by an issuing
bank against a payment processor, though not retail
merchants. See Lone Star Nat’l Bank, N.A. v. Heartland Payment
Sys., Inc., 729 F.3d 421 (5th Cir. 2013). Our conclusion is
30 No. 17-2146
different for at least two reasons. First, the Lone Star court
relied on New Jersey’s practice of being “a leader in
expanding tort liability.” Id. at 426–27, quoting Hakimoglu v.
Trump Taj Mahal Assocs., 70 F.3d 291, 295 (3d Cir. 1995) (Becker,
J., dissenting). Second, unlike the Lone Star court, we know
enough about the card network agreements in our record for
them to inform our analysis. See 729 F.3d at 426.
Our predictions here are closer to the analysis in two cases
from the Third and First Circuits. The Third Circuit applied
the economic loss rule to bar negligence claims and rejected
most of the other theories invoked by issuing banks against a
breached retail merchant. Sovereign Bank v. BJ’s Wholesale Club,
Inc., 533 F.3d 162, 175–78, 179–83 (3d Cir. 2008). Though the
Sovereign Bank court reached a different conclusion about the
third-party beneficiary claims in that case, id. at 168–73, here
we have no specific argument on appeal to support the
plaintiff banks’ claims for third-party beneficiary status.
Similarly, the First Circuit has rejected a negligence theory
because of the economic loss rule and also rejected a third-
party beneficiary theory under the card payment system
contracts. In re TJX Companies Retail Security Breach Litig., 564
F.3d 489, 498–99 (1st Cir. 2009). In that case, a negligent
misrepresentation claim survived “on life support,” in light of
the fact that the Massachusetts courts had recently handled a
similar case that way. See id. at 494–96. Here we are presented
with no such state authority on a negligent misrepresentation
theory.
No. 17-2146 31
C. Illinois Statutory Claims – The ICFA
1. The Plaintiff Banks’ Claims
We turn next to plaintiffs’ claims under Illinois statutes.
(As noted, Missouri provides no statutory cause of action for
financial institutions in retail data breaches.) The plaintiff
banks allege that Schnucks violated the Illinois Consumer
Fraud and Deceptive Business Practices Act (ICFA) by
engaging in an unfair practice of having poor data security
procedures. See 815 Ill. Comp. Stat. 505/2, 505/10a. The banks
also allege that Schnucks violated the Illinois Personal
Information Protection Act (PIPA), 815 Ill. Comp. Stat. 530/10,
and point out that PIPA violations are identified by statute as
per se unlawful practices actionable under the ICFA, 815 Ill.
Comp. Stat. 530/20. We affirm the district court’s rejection of
both theories in this case.
2. Basic Elements of an ICFA Claim
We first explain the relevant features of the ICFA before
explaining why this claim fails as a matter of law. A plaintiff
bringing a private claim under the ICFA must show five
elements, the first of which is “a deceptive act or practice by
the defendant.” Avery v. State Farm Mut. Auto. Ins. Co., 835
N.E.2d 801, 849–50 (Ill. 2005). Because the statute’s right of
action is available to “Any person who suffers actual damage
as a result of a violation,” id., quoting 815 Ill. Comp. Stat.
505/10a(a), Illinois courts have interpreted the ICFA to apply
not only in consumer-against-business cases but also in some
cases when “both parties to the transaction are business
entities.” Law Offices of William J. Stogsdill v. Cragin Fed. Bank
for Savings, 645 N.E.2d 564, 566–67 (Ill. App. 1995). A mere
breach of contract, though, “does not amount to a cause of
32 No. 17-2146
action” under the ICFA, id. at 567, even when the defendant
systematically breaches many contracts across an entire
“prospective plaintiff class,” Greenberger v. GEICO General
Insurance Co., 631 F.3d 392, 400 (7th Cir. 2011).
ICFA plaintiffs must identify “some stand-alone …
fraudulent act or practice,” id., and they must also show that
the injury they seek to redress was “proximately caused by
the alleged consumer fraud.” Connick v. Suzuki Motor Co., 675
N.E.2d 584, 594 (Ill. 1996), citing Stehl v. Brown’s Sporting
Goods, Inc., 603 N.E.2d 48, 51–52 (Ill. App. 1992). ICFA
plaintiffs cannot rely on a generalized “market theory” of
causation claiming that the defendant “inflate[d] the cost of
its product far above what it could have charged had the”
defendant not “misled consumers.” De Bouse v. Bayer AG, 922
N.E.2d 309, 314–15 (Ill. 2009), citing Oliveira v. Amoco Oil Co.,
776 N.E.2d 151, 155 (Ill. 2002). To show proximate cause, the
“plaintiff must actually be deceived by a statement or
omission that is made by the defendant;” the plaintiff cannot
rest on vague accusations about inadequate disclosures and
resulting price effects in the marketplace. De Bouse, 922
N.E.2d at 316. 9
9 In addition, plaintiffs in Illinois state court must plead fraud under
the ICFA with the same level of specificity as under the common law. Con-
nick, 675 N.E.2d at 593, citing People ex rel. Hartigan v. E & E Hauling, Inc.,
607 N.E.2d 165, 174 (Ill. 1992). As a procedural matter we have held that
ICFA complaints alleging an unfair practice in federal court should be
judged under Federal Rule of Civil Procedure 8(a) and not the particular-
ity requirement for fraud under Rule 9(b). Windy City Metal Fabricators &
Supply, Inc. v. CIT Tech. Financing Services, Inc., 536 F.3d 663, 670 (7th Cir.
2008). The ICFA’s heightened state court pleading requirement is still in-
structive here for two reasons. First, we read the plaintiff banks’ complaint
as invoking the misrepresentation and fraud line of ICFA cases, and not
No. 17-2146 33
As mentioned above, the “any person” language in the
ICFA means that businesses can sometimes sue one another
under the statute, but a business plaintiff under the ICFA
must show a “nexus between the complained of conduct and
consumer protection concerns,” which we refer to here as the
“consumer nexus test.” Athey Products Corp. v. Harris Bank
Roselle, 89 F.3d 430, 437 (7th Cir. 1996). Illinois courts are
skeptical of business-v.-business ICFA claims when neither
party is actually a consumer in the transaction. ICFA claims
may not be available when the business relationship is more
like that of “partners” or “joint venturers” and not
“consumers of each other’s services.” See Cragin Fed. Bank, 645
N.E.2d at 566, citing Century Universal Enterprises, Inc. v. Triana
Dev. Corp., 510 N.E.2d 1260 (Ill. App. 1987). In applying the
consumer nexus test, Illinois courts have observed that “there
is no inherent consumer interest implicated in a construction
contract between a general contractor and a subcontractor,”
Peter J. Hartmann Co. v. Capital Bank and Trust Co., 694 N.E.2d
1108, 1117 (Ill. App. 1998) (citation omitted), a situation
similar to the web of contracts that comprise the card payment
system at issue here.
But we need not decide here whether the plaintiff banks
could ever establish a consumer nexus in an ICFA data breach
claim. As a more preliminary matter, they fail to allege any
ICFA violation in this lawsuit that would make that secondary
consumer nexus determination necessary.
the unfair practice cases, as described below. Second, we read this ICFA
requirement as a sign that Illinois courts are cautious in recognizing new
kinds of liability under the ICFA. See Connick, 675 N.E.2d at 593–94.
34 No. 17-2146
3. Unfair Practice Claim
The plaintiff banks fail to allege an unfair practice under
the ICFA because their theory is essentially a “market theory
of causation” argument that Illinois courts have rejected. The
complaint alleges that “Schnucks engaged in unfair business
practices in violation of [the] ICFA by failing to implement
and maintain reasonable payment card data security
measures.” Am. Compl. ¶ 116. The complaint goes on to
allege: “While Schnucks cut corners and minimized costs, its
competitors spent the time and money necessary to ensure”
the security of “sensitive payment card information.” Id.,
¶ 118. By not warning consumers or banks of its
compromised payment system, this theory goes, Schnucks
acted deceptively to maintain its prices and to ensure business
as usual until it publicly announced the data breach. See Dkt.
65 at 4.
This argument does not support an ICFA claim. It is very
similar to the argument the Illinois Supreme Court rejected in
Oliveira v. Amoco Oil Co., where the plaintiff alleged that he
paid an “‘artificially inflated’ price for … gasoline” due to the
“defendant’s allegedly deceptive advertising scheme.” 776
N.E.2d at 155. He also alleged that “all purchasers of Amoco’s
premium gasolines were injured irrespective of whether [they
saw] specific advertisements and marketing materials”
because everyone “paid a higher price for the gasoline than
they would have paid in the absence of the ads.” Id. at 156.
This could not support an ICFA claim, the Illinois Supreme
Court later explained, because “plaintiffs in a class action”
under the ICFA “must prove that ‘each and every consumer
who seeks redress actually saw and was deceived by the
statements in question.’” De Bouse, 922 N.E.2d at 315, quoting
No. 17-2146 35
Barbara’s Sales, Inc. v. Intel Corp., 879 N.E.2d 910, 927 (Ill. 2007).
General effects on consumer behavior or the price of goods
are not enough. See De Bouse, 922 N.E.2d at 315. 10
The plaintiff banks allege that Schnucks effectively
manipulated both its prices and sales volume by deliberately
concealing the data breach. This manipulation would not
have been possible, say the banks, if Schnucks had told the
truth about its data security. Dkt. 65 at 4. The banks admit that
they did not “plead specific misrepresentations.” They argue
instead that they do not need to—that alleging an unfair
practice directed at the market in general is enough. By
simply continuing business as usual as its consultant
investigated the data breach, plaintiffs argue, Schnucks
violated public policy and by extension the ICFA.11
10 In 2006, which was after Oliveira but before De Bouse, the Illinois
Appellate Court found that a consumer could state an ICFA claim where
a manufacturer of aluminum-clad wooden windows failed to disclose
physical defects in its product. Pappas v. Pella Corp., 844 N.E.2d 995, 1004
(Ill. App. 2006). Pappas was not directly addressed by the Illinois Supreme
Court in De Bouse, where the court relied on its own opinion in Oliveira
and related cases. See 922 N.E.2d at 314–16. We think the Illinois Supreme
Court would take the same approach here and apply De Bouse and
Oliveira, and not Pappas, to this case. The plaintiff banks’ claim is that
Schnucks misrepresented the integrity of its data security policies and
thus effectively mispriced its goods in the consumer market. It is not a
claim about undisclosed physical product defects. Also, there is no third-
party intermediary here, such as a doctor who passed along deceptive in-
formation from the defendant. See De Bouse, 922 N.E.2d at 318–19.
11 To characterize their claim as an “unfair practice” rather than a
misrepresentation, the plaintiff banks cite a district court decision that in
turn quoted Robinson v. Toyota Motor Credit Corp., 775 N.E.2d 951, 961 (Ill.
2002). Robinson adopted a three-factor test employed under the Federal
Trade Commission Act in judging unfair practices, but it did not follow
36 No. 17-2146
This theory is not consistent with Oliveira, which likened
its plaintiff’s theory to “the fraud on the market theory found
in federal securities case law” and rejected it for ICFA claims.
776 N.E.2d at 155 n.1, 164 (internal quotation omitted). An
allegation that Schnucks mispriced its products and deceived
all of its customers and also the plaintiff banks about its
practices must actually identify a deceptive guarantee about
data security in order to state an ICFA claim. Plaintiffs have
not done so.
4. Illinois Personal Information Protection Act
It might be possible for the plaintiff banks to state a
different kind of claim under the ICFA by alleging that
Schnucks violated the Illinois Personal Information Protection
Act by failing to disclose the breach for two weeks after
learning of it. A violation of the PIPA can be sufficient to
obtain ICFA relief. See 815 Ill. Comp. Stat. 530/20. The data
breach occurred in this case, and PIPA requires notice to
Illinois residents affected by data breaches. § 530/10. But the
plaintiffs failed to explain to the district court whether and
how Schnucks’ conduct fell under one of the operative
subsections of the notice statute and not any of its exceptions.
the sort of element-by-element analysis the plaintiff banks seek here. See
id. at 961–64. Instead, Robinson analyzed the unfair practices claims by
asking whether a disclosure law or public policy had been violated, see id.
at 962–63, or whether the plaintiff experienced “oppressiveness and lack
of meaningful choice” in a manner similar to a contractual
unconscionability claim, see id. at 962. The plaintiff banks here do not
identify a specific public policy violation or an unconscionability rationale
that fits Schnucks’ conduct; instead, they maintain that “Schnucks
deliberately concealed the ongoing data breach for over two weeks.” This
is a misrepresentation allegation that claims the consumer market as a
whole was deceived. We address it as such.
No. 17-2146 37
See id. Such an explanation was needed to preserve the PIPA-
ICFA claim for appellate review, especially for a counseled
class of sophisticated plaintiffs advocating a novel theory.
The problem here is not the adequacy of pleadings but the
adequacy of the legal argument in the district court. In
responding to a motion to dismiss, “the non-moving party
must proffer some legal basis to support his cause of action.”
Bonte v. U.S. Bank, N.A., 624 F.3d 461, 466 (7th Cir. 2010),
quoting County of McHenry v. Insurance Co. of the West, 438 F.3d
813, 818 (7th Cir. 2006). Courts “will not invent legal
arguments for litigants,” even at the motion to dismiss stage,
and are “not obliged to accept as true legal conclusions or
unsupported conclusions of fact.” County of McHenry, 438
F.3d at 818 (citations omitted). This need stems not from the
modest pleading requirements of Rule 8 but instead from the
adversarial process. If a Rule 12 motion to dismiss is filed,
plaintiffs must “specifically characterize or identify the legal
basis” of their claims or face dismissal; just because the
complaint may have complied with Rule 8 does not mean that
it is “immune from a motion to dismiss.” See Kirksey v. R.J.
Reynolds Tobacco Co., 168 F.3d 1039, 1041 (7th Cir. 1999).
This is especially true when a party advances a novel legal
theory. See id. at 1042 (“a claim that does not fit into an
existing legal category requires more argument by the
plaintiff to stave off dismissal, not less”). Our situation here is
reminiscent of Kirksey, where the plaintiff’s lawyer seemed to
have hoped “that the current legal ferment in the world of
tobacco litigation”—or in this case data breach litigation—
“will brew him up a theory at some future date if only he can
stave off immediate dismissal under Rule 12(b)(6).” Id. The
failure to respond waives the claim. Bonte, 624 F.3d at 466.
38 No. 17-2146
The plaintiff banks argue that they asserted this claim
properly in the district court. Their support is meager.
Plaintiffs point to a footnote in the complaint that refers to a
PIPA code section, see Am. Compl. ¶35 n.23, and a page and
a half devoted to their ICFA claims in the brief opposing the
motion to dismiss, Dkt. 65 at 18–19. These were not sufficient
to alert the district court that plaintiffs were even relying on
the theory they argue on appeal, let alone to explain the
theory to the district court. Though plaintiffs summarized the
connections between the federal FTCA and the ICFA, see Am.
Compl. ¶ 115, they simply did not address the potential
application of PIPA to this case in either filing.
One district court case cited in the plaintiff banks’
response mentions PIPA. Even if that were enough to alert the
district judge to the issue—and it is certainly not—plaintiffs
tried to distinguish that case, not to draw parallels to it. See
Dkt. 65 at 18, distinguishing In re Michaels Stores Pin Pad Litig.,
830 F. Supp. 2d 518 (N.D. Ill. 2011) (brought by consumers).
Rather, they argued that their ICFA “claim should stand for
the same reasons as in Home Depot,” a case that does not
mention PIPA or even cite the portion of Michaels that
discussed PIPA. See Home Depot, 2016 WL 2897520, at *6.
Nothing in this complaint or the plaintiffs’ briefing in the
district court fairly alerted the district court that PIPA had any
relevance.
We will not revive this potential claim here. “Even if the
argument was not waived … the [plaintiffs-appellants] failed
to support it in this court with anything more than abstract
generalities,” which is a sufficient reason not to wade into the
issue. Hassebrock v. Bernhoft, 815 F.3d 334, 342 (7th Cir. 2016);
see also Voelker v. Porsche Cars North Am., Inc., 353 F.3d 516, 527
No. 17-2146 39
(7th Cir. 2003) (under Fed. R. App. P. 28, “an appellant’s
argument must provide both his ‘contentions and the reasons
for them’” to be considered). Whether—and if so how—a
PIPA violation could support an ICFA claim brought by one
business against another is a question for another case.
Conclusion
We agree with the district court that neither Illinois nor
Missouri would recognize any of the plaintiff banks’ theories
to supplement their contractual remedies for losses they
suffered as a result of the Schnucks data breach. The judgment
dismissing the action is
AFFIRMED.