Illinois Federal Court Dismisses Data Breach Class Action Lawsuit For Lack Of Subject-Matter Jurisdiction

Duane Morris Takeaways: On August 20, 2025, in Phelps v. Ill. Bone & Joint Inst., LLC, No. 24-CV-08555, 2025 WL 2410341 (N.D Ill. Aug. 20, 2025), Judge Martha Pacold of the U.S. District Court for the Northern District of Illinois granted Defendant Illinois Bone & Joint Institute, LLC's motion to dismiss for lack of subject matter jurisdiction. The Court held Plaintiff failed to adequately plead Defendant's citizenship, given its status as a limited liability company; therefore, the Court could not determine whether complete diversity existed between the parties. This ruling illustrates the differences between the general diversity statute under 28 U.S.C. § 1332(a), and the more lenient "minimal diversity" requirement under the Class Action Fairness Act, as well as the consequences of failing to sufficiently plead a limited liability company's citizenship.

Case Background

On August 30, 2024, Defendant Illinois Bone & Joint Institute, LLC ("Defendant") sent a data breach notification letter to its patients, including Plaintiff Alexandra Phelps ("Plaintiff"). Id. at *1. Plaintiff, individually and on behalf of a putative class, filed a lawsuit shortly after receiving the letter alleging negligence, negligence per se, breach of implied contract, and violation of the Illinois Personal Information Protection Act. Id.

Defendant moved to dismiss the complaint pursuant to Rule 12(b)(1) of the Federal Rules of Civil Procedure for lack of subject matter jurisdiction. Id. In the motion, Defendant raised two arguments, including: (i) that Plaintiff lacked Article III standing, and (ii) that Plaintiff could not establish diversity jurisdiction under the Class Action Fairness Act ("CAFA"). Id. Although Plaintiff had invoked jurisdiction under the CAFA in her Complaint, she did not respond to Defendant's CAFA arguments. Id. at 2. Instead, Plaintiff argued that she could "invoke jurisdiction under the general diversity statute, 28 U.S.C. § 1332(a)." Id.

The Court's Order

The Court determined that the Complaint failed to allege sufficient facts to support diversity jurisdiction.

First, the Court reasoned that Plaintiff's decision not to respond to Defendant's CAFA arguments amounted to a concession that Plaintiff could not meet the standards for subject-matter jurisdiction under the statute. Id. However, although Plaintiff had not invoked general diversity jurisdiction in her Complaint, the Court permitted her to raise these arguments because "a complaint's imperfect statement of the legal theory supporting jurisdiction does not itself defeat jurisdiction." Id.

Second, the Court observed that, to satisfy general diversity jurisdiction, Plaintiff must be able to show that Plaintiff is a citizen of a different state than Defendant and "the amount in controversy exceeds $75,000, exclusive of interest and costs." Id. Under the CAFA, an LLC, like Defendant, is "a citizen of the State where it has its principal place of business and the State under whose laws it is organized." Id. Under the general diversity statute, on the other hand, an LLC is a citizen "of every state of which any member is a citizen." Id. The Court concluded that the Complaint did not include any allegations of Defendant's "member's identity or citizenship." Id. As such, the Court could not determine whether "any member is a citizen of the same state as Phelps." Id. Because the Complaint did not allege facts sufficient for the Court to conclude that "complete diversity between the parties" existed, the Court dismissed the case without prejudice. Id.

In sum, the Court concluded that, to establish diversity jurisdiction, a Complaint must adequately allege the citizenship of all parties. Id. Plaintiff's failure to plead the citizenship of all Defendant's members was, therefore, fatal to her claims. Id. at 3

Implications For Employers

The Court's ruling in Phelps serves as a reminder of the distinctions between the the CAFA's minimal diversity jurisdiction requirement and general diversity jurisdiction. While Plaintiff's Complaint may have included sufficient facts to establish Defendant's citizenship under the CAFA, the Complaint could not support the more demanding "complete" diversity jurisdiction requirement under 28 U.S.C. § 1332(a).

This case highlights an important procedural defense available to employers, particularly if the named corporate entity in the litigation is a limited liability company (rather than a traditional corporation, who's citizenship is tied to its state of incorporation and principal place of business). Employers should take note of a plaintiff's burden to sufficiently establish federal subject matter jurisdiction at the outset of the litigation, and the accompanying procedural defenses they might avail themselves of when a plaintiff fails to sufficiently plead the jurisdictional prerequisite.