pisciotta v old national bancorp

In the

United States Court of Appeals

For the Seventh Circuit

____________No. 06-3817L

UCIANO

P

ISCIOTTA

and D

ANIEL

M

ILLS

, on behalf of themselvesand others similarly situated,

Plaintiffs-Appellants

,

v

.O

LD

N

ATIONAL

B

ANCORP

,

Defendant-Appellee

.____________

Appeal from the United States District Courtfor the Southern District of Indiana, Indianapolis Division.No. 05 C 668—

Larry J. McKinney

,

Chief Judge.

____________

A

RGUED

M

AY

21, 2007—D

ECIDED

A

UGUST

23,

2007

____________Before R

IPPLE

, W

OOD

and E

VANS

,

Circuit Judges

.R

IPPLE

,

Circuit Judge

. Plaintiffs Luciano Pisciotta andDaniel Mills brought this action on behalf of a putativeclass of customers and potential customers of Old Na-tional Bancorp (“ONB”). They alleged that, through itswebsite, ONB had solicited personal information fromapplicants for banking services, but had failed to secure itadequately. As a result, a third-party computer “hacker”was able to obtain access to the confidential information of tens of thousands of ONB site users. The plaintiffs sought

2No. 06-3817damages for the harm that they claim to have suffered because of the security breach; specifically, they requestedcompensation for past and future credit monitoringservices that they have obtained in response to the compro-mise of their personal data through ONB’s website. ONBanswered the allegations and then moved for judgment onthe pleadings under Rule 12(c). The district court grantedONB’s motion and dismissed the case. The plaintiffs timelyappeal. For the reasons set forth in this opinion, we affirmthe judgment of the district court.

IBACKGROUNDA. Facts

ONB operates a marketing website on which individualsseeking banking services can complete online applica-tions for accounts, loans and other ONB banking services.The applications differ depending on the service requested, but some forms require the customer or potential cus-tomer’s name, address, social security number, driver’slicense number, date of birth, mother’s maiden name andcredit card or other financial account numbers. In 2002 and2004, respectively, Mr. Pisciotta and Mr. Mills accessedthis website and entered personal information in connec-tion with their applications for ONB banking services.In 2005, NCR, a hosting facility that maintains ONB’swebsite, notified ONB of a security breach. ONB then sentwritten notice to its customers. The results of the investiga-tion that followed have been filed under seal in this court;for present purposes, it will suffice to note that the scopeand manner of access suggests that the intrusion wassophisticated, intentional and malicious.

No. 06-38173

B. District Court Proceedings

Mr. Pisciotta and Mr. Mills, on behalf of a putative classof other ONB website users, brought this action in theUnited States District Court for the Southern District of Indiana. They named ONB and NCR as defendants andasserted negligence claims against both defendants aswell as breach of implied contract claims by ONB and breach of contract by NCR. The plaintiffs alleged that:[b]y failing to adequately protect [their] personalconfidential information, [ONB and NCR] causedPlaintiffs and other similarly situated past and presentcustomers to suffer substantial potential economicdamages and emotional distress and worry that thirdparties will use [the plaintiffs’] confidential personalinformation to cause them economic harm, or sell theirconfidential information to others who will in turncause them economic harm.R.37 at 2.In pleading their damages, the plaintiffs stated that theyand others in the putative class “have incurred expensesin order to prevent their confidential personal informationfrom being used and will continue to incur expenses in thefuture.”

Id.

at 4. Significantly, the plaintiffs did not allegeany

completed

direct

financial loss to their accounts as aresult of the breach. Nor did they claim that they or anyother member of the putative class

already had been

thevictim of identity theft as a result of the breach. Theplaintiffs requested “[c]ompensation for all economic andemotional damages suffered as a result of the Defendants’acts which were negligent, in breach of implied contractor in breach of contract,” and “[a]ny and all other legaland/or equitable relief to which Plaintiffs . . . are entitled,