Markle, Judge. Several former and current patients filed a putative class action against the Athens Orthopedic Clinic (“the Clinic”), asserting claims for negligence, breach of implied contract, unjust enrichment, attorney fees, injunctive relief under Georgia’s Uniform Deceptive Trade Practices Act (UDTPA),[1] and declaratory judgment stemming from a data breach of their personal information. The trial court dismissed all claims, and we affirmed. Collins v. Athens Orthopedic Clinic, 347 Ga. App. 13, 14-22 (2) (815 SE2d 639) (2018). Our Supreme Court granted certiorari and reversed, holding that the allegations in the complaint sufficiently stated a claim for negligence that was not merely speculative, and thus, it was error to dismiss the negligence claim. Collins v. Athens Orthopedic Clinic, 307 Ga. 555, 563-564 (3) (837 SE2d 310) (2019). The Court then directed this Court to reconsider the remaining claims in light of this ruling. Id. at 557 (1), n.1, 566 (4). On remand, we adopt the Supreme Court’s decision as our own, reverse the dismissal of the negligence count, and remand it for further proceedings. With regard to the remaining counts, for the reasons that follow, we conclude that the trial court erred in dismissing the counts for breach of implied contract and attorney fees, and we reverse the dismissal of those counts and remand for further proceedings. We affirm the trial court’s dismissal of the counts for unjust enrichment, declaratory relief, and those raised under the UDTPA.[2] We review the grant of a motion to dismiss de novo, construing the factual allegations of the complaint in the light most favorable to the plaintiff. Radio Perry, Inc. v. Cox Communications, Inc., 323 Ga. App. 604, 605 (1) (746 SE2d 670) (2013). The complaint should be dismissed only if its allegations demonstrate with certainty that the claimant “would not be entitled to relief under any state of provable facts asserted in support thereof; and . . . the movant establishes that the claimant could not possibly introduce evidence within the framework of the complaint sufficient to warrant a grant of the relief sought.” (Citation omitted.) Id.; see also Babalola v. HSBC Bank, USA, N.A., 324 Ga. App. 750, 752 (2) (751 SE2d 545) (2013). The facts are set forth in our prior opinion, but are summarized here: In June 2016, an anonymous hacker known as the “Dark Overlord” stole the personally identifiable information, including social security numbers, birthdates, addresses, and health insurance information, of approximately 200,000 current and former Clinic patients. The hacker demanded ransom, but the Clinic refused to pay, and the hacker sold the information on the “dark web.” The Clinic alerted its patients of the breach in August 2016. Collins, 347 Ga. App. at 13. Thereafter, Christine Collins, Paulette Moreland, and Kathryn Strickland (collectively, “the plaintiffs”) filed a putative class action. In their complaint, they alleged that the Clinic failed to offer and pay for any credit monitoring or identity theft protection following the data breach despite the “imminent threat” that the stolen information will be used to their detriment now that “criminals are . . . able to assume [the patients'] identity and fraudulently obtain credit cards, issue fraudulent checks, file tax refund returns, liquidate bank accounts, and open new accounts, all in [the patients'] names.”[3] Based on these allegations, the plaintiffs asserted claims for negligence, breach of implied contract, unjust enrichment, and violations of the Georgia UDTPA. They requested a declaratory judgment and injunctive relief in the form of monitoring, theft protection, and other prospective corrective measures. We now consider whether the other claims as alleged above are sufficient to survive a motion to dismiss. (1) Breach of implied contract. In our prior opinion, we concluded that this claim failed because the plaintiffs had yet to suffer injury and thus incurred no damages. 347 Ga. App. at 19 (2) (b). The Clinic concedes that this claim must be remanded. See Collins, 307 Ga. at 563 (3); see also In re Arby’s Restaurant Group Inc. Litigation, 2018 WL 2128441, at *16 (III) (C) (N. D. Ga. 2018) (citing cases from other circuits allowing implied contract claims to survive motion to dismiss and agreeing that “[t]hese decisions are grounded in the recognition that when a customer uses a credit card in a commercial transaction, she intends to provide that data to the merchant only . . . and certainly does not intend . . . the merchant to allow unauthorized third parties to access that data.” (citation and punctuation omitted)); Irwin v. RBS Worldpay, Inc., 2010 WL 11570892, at *67 (III) (C) (3) (N. D. Ga. 2010) (plaintiff sufficiently stated claim for breach of implied contract claim based on allegations that he would not have provided his personal financial information without defendant’s implied agreement to protect it). We accept the Clinic’s concession, and therefore reverse the dismissal of this claim, and remand it for further proceedings. 2. Unjust enrichment. [A] claim for unjust enrichment exists where a plaintiff asserts that the defendant induced or encouraged the plaintiff to provide something of value to the defendant; that the plaintiff provided a benefit to the defendant with the expectation that the defendant would be responsible for the cost thereof; and that the defendant knew of the benefit being bestowed upon it by the plaintiff and either affirmatively chose to accept the benefit or failed to reject it. Campbell v. Ailion, 338 Ga. App. 382, 387 (2) (790 SE2d 68) (2016). “Unjust enrichment is an equitable principle that may be applied when there is no valid written contract between the parties[.]“[4] (Citation omitted.) Ga. Dept. of Community Health v. Data Inquiry, 313 Ga. App. 683, 687 (2) (722 SE2d 403) (2012). In other words, if there was no express or implied contract, the plaintiffs can bring a claim for unjust enrichment. See Watson v. Sierra Contracting Corp., 226 Ga. App. 21, 28 (c) (485 SE2d 563) (1997) (physical precedent only). Importantly, however, the plaintiffs in this case “did not plead unjust enrichment as an alternate theory of recovery based on a failed contract.” 347 Ga. App. at 22 (2) (e). Instead, they pled it as a separate tort seeking damages in the form of credit monitoring and a credit freeze in addition to restitution of payments made for security services.[5] As such, the plaintiffs have alleged unjust enrichment as a separate and distinct cause of action and not as an alternate remedy for a failed contract.[6] Therefore, this claim fails as a matter of law. See Cash v. LG Electronics, Inc., 342 Ga. App. 735, 742 (2) (804 SE2d 713) (2017); Tolson Firm, LLC v. Sistrunk, 338 Ga. App. 25, 31 (4) (789 SE2d 265) (2016); Wachovia Ins. Svcs. v. Fallon, 299 Ga. App. 440, 449 (6) (682 SE2d 657) (2009); Tidikis v. Network for Med. Communications & Research, LLC, 274 Ga. App. 807, 810-811 (2) (619 SE2d 481) (2005). The Supreme Court’s analysis does not dictate we reach a different result with respect to this claim, and the trial court properly dismissed it. See Shadix v. Carroll County, 274 Ga. 560, 562-563 (1) (554 SE2d 465) (2001); see also Schroeder v. Dekalb County, 350 Ga. App. 82, 82-83 (828 SE2d 108) (2019); Jordan v. Everson, 345 Ga. App. 509, 511 (813 SE2d 600) (2018). 3. UDTPA. “A person likely to be damaged by a deceptive trade practice of another may be granted an injunction against it under the principles of equity and on terms that the court considers reasonable. Proof of monetary damage, loss of profits, or intent to deceive is not required.” OCGA § 101373 (a). The UDTPA offers only injunctive relief where the plaintiff has established a likelihood of future damage, but it does not address past harm. Catrett v. Landmark Dodge, Inc., 253 Ga. App. 639, 644 (3) (560 SE2d 101) (2002); MooreDavis Motors, Inc. v. Joyner, 252 Ga. App. 617, 619 (3) (556 SE2d 137) (2001). Thus, to state a claim and to establish standing under the UDTPA, the plaintiffs must allege that they are likely to be damaged in the future by an unfair trade practice.[7] See OCGA § 101373 (a); Friedlander v. HMSPep Products, Inc., 226 Ga. App. 123, 124125 (1) (a) (485 SE2d 240) (1997). In their complaint, the plaintiffs alleged that the Clinic engaged “in the unconscionable, deceptive, or unfair acts or practices . . . [by] breaching duties [the Clinic] owes . . . , by failing to provide fair, reasonable, or adequate computer systems and data security practices”; that the Clinic did so knowing it was likely to mislead patients who were acting reasonably under the circumstances; that the Clinic knew or should have known that it kept its lack of adequate safeguards from its patients; and that they would not have obtained care at the Clinic had they known. Pretermitting whether the plaintiffs have alleged an “unfair trade practice” under the statute, an injunction would serve no purpose at this point because, as alleged, their personal information was already sold and is available on the dark web. As such, the plaintiffs have failed to allege a future harm caused by the unfair practice, as required by the UDTPA, and the trial court properly dismissed this claim. See Catrett, 253 Ga. App. at 644 (3); see also Willingham v. Global Payments, Inc., 2013 WL 440702, *16 (III) (C) (1) (N. D. Ga. 2013). 4. Declaratory judgment. [A] declaratory judgment may not be granted in the absence of a justiciable controversy. The plaintiff must show facts or circumstances whereby it is in a position of uncertainty or insecurity because of a dispute and of having to take some future action which is properly incident to its alleged right, and which future action without direction from the court might reasonably jeopardize its interest. (Citation and punctuation omitted.) Effingham County Bd. of Commrs. v. Effingham County Indus. Dev. Auth., 286 Ga. App. 748, 749 (650 SE2d 274) (2007). As we have explained, [t]he object of the declaratory judgment is to permit determination of a controversy before obligations are repudiated or rights are violated. As many times pointed out by this court, its purpose is to permit one who is walking in the dark to ascertain where he is and where he is going, to turn on the light before he steps rather than after he has stepped in a hole. (Citation omitted.) Oconee Fed. S & L Assn. v. Brown, 351 Ga. App. 561, 566 (2) (a) (831 SE2d 222) (2019). Thus, “when a party seeking declaratory judgment does not show it is in a position of uncertainty as to an alleged right, dismissal of the declaratory judgment action is proper.” (Citation omitted.) SAWS at Seven Hills, LLC v. Forestar Realty, Inc., 342 Ga. App. 780, 783 (1) (805 SE2d 270) (2017); see also U-Haul Co. of Arizona v. Rutland, 348 Ga. App. 738, 747 (1) (824 SE2d 644) (2019). In their complaint, the plaintiffs sought a declaration that the Clinic is not in compliance with its “existing obligations, and that [the Clinic] must implement specific additional, prudent security practices” and “provide credit monitoring and identity theft protection” to them. They then listed eight specific requirements they wish the court to direct the Clinic to complete, including auditing the system, security testing and monitoring, training, and educating patients about the threats to their personal information. They further alleged that the Clinic remains vulnerable to similar attacks and must take more stringent measures in the future. Notably, the plaintiffs’ personal information had already been stolen and they have taken measures to protect themselves by placing alerts on their credit reports. They are not operating under any uncertainty, and they “need[ ] no direction” to take steps to protect their information. Effingham County Bd. of Commrs., 286 Ga. App. at 750 (declaratory judgment improper where the declaration sought addressed an act that already occurred). Moreover, “[d]eclaratory judgment will not be rendered based on a possible or probable future contingency,” such as another possible data theft. (Citation omitted.) Id. But that is precisely what the plaintiffs are seeking here. The fact that we are reviewing this issue on appeal from the grant of a motion to dismiss does not alter our conclusion. A review of the complaint demonstrates that none of the plaintiffs’ allegations show a future uncertainty as to their rights. Therefore, we must conclude that the plaintiffs could prove no set of facts that would entitle them to declaratory relief, and the trial court properly dismissed this claim.[8] 5. Attorney fees. Attorney fees and litigation expenses under OCGA § 13611 “are ancillary and recoverable only where other elements of damage are recoverable on the underlying claim[s].” (Citation and punctuation omitted.) Sparra v. Deutsche Bank Nat. Trust Co., 336 Ga. App. 418, 423 (1) (f) (785 SE2d 78) (2016). Because, as stated above, and as the Clinic concedes, the plaintiffs may proceed with their negligence and breach of implied contract claims, it was error to dismiss the claim for attorney fees. Accordingly, we reverse the dismissal of this claim, and remand it for further proceedings. For the foregoing reasons, we affirm the trial court’s dismissal of the claims for unjust enrichment, declaratory relief, and an injunction under the UDTPA; we reverse the dismissal of the claims for negligence, breach of implied contract, and attorney fees, and we remand the case for further proceedings as to those remaining claims. Judgment affirmed in part; reversed in part; and case remanded with direction. Rickman, J., concurs. McFadden, C. J., concurs in Divisions 1 and 5; concurs specially in Division 3; and dissents in Divisions 2 and 4. In the Court of Appeals of Georgia
