[PUBLISH]

In the United States Court of Appeals For the Eleventh Circuit

____________________

No. 22-12853 ____________________

CARLOS RAMIREZ, on behalf of himself and all others similarly situated, Plaintiff-Appellant, versus THE PARADIES SHOPS, LLC, a Georgia limited liability company,

Defendant-Appellee.

____________________

Appeal from the United States District Court for the Northern District of Georgia USCA11 Case: 22-12853 Document: 38-1 Date Filed: 06/05/2023 Page: 2 of 15

2 Opinion of the Court 22-12853

D.C. Docket No. 1:21-cv-03758-ELR ____________________

Before JILL PRYOR and DUBINA, Circuit Judges, and COVINGTON,* District Judge. COVINGTON, District Judge: Carlos Ramirez worked for a company later acquired by the Paradies Shops. He, like many employees, entrusted his employer with sensitive personally identifiable information (PII). In October 2020, Paradies suffered a ransomware attack on its administrative systems in which cybercriminals obtained the Social Security num- bers of Ramirez and other current and former employees. Shortly after learning of the data breach, Ramirez brought claims for neg- ligence and breach of implied contract on behalf of himself and those affected by the data breach, arguing Paradies should have protected the PII. He now appeals from the district court’s order granting Paradies’s motion to dismiss for failure to state a claim. He contends the district court demanded too much at the pleadings stage. With the benefit of oral argument, we agree in part. While we affirm the dismissal of the breach of implied contract claim, we reverse the district court’s dismissal of Ramirez’s negligence claim and remand for further proceedings.

*Honorable Virginia M. Covington, United States District Judge for the Mid- dle District of Florida, sitting by designation. USCA11 Case: 22-12853 Document: 38-1 Date Filed: 06/05/2023 Page: 3 of 15

22-12853 Opinion of the Court 3

I. BACKGROUND According to Ramirez’s complaint, he worked for Hojeij Branded Foods (HBF) from 2007 to 2014. After Ramirez left HBF, Paradies acquired HBF and its database of current and former em- ployees. Paradies operates retail stores and restaurants primarily in airports throughout the United States and Canada. It has over $1 billion in sales and employs more than 10,000 people. The employees of Paradies and the companies it acquired had to provide PII about themselves and their beneficiaries as a condition of employment. At the time of the data breach, Paradies maintained records containing the PII, including names and Social Security numbers, of more than 76,000 current or former employ- ees. The sensitivity of this type of PII, particularly Social Security numbers, is well-known. Once stolen, fraudulent use of that infor- mation—and the resulting damage to victims—can continue for years. Ramirez alleged he was careful with his sensitive infor- mation. He relied on Paradies, a sophisticated company, to simi- larl