MEMORANDUM & ORDER Plaintiffs Tiffany Troy and Eric John Mata, (collectively, “Plaintiffs”) bring a putative class action against Defendant American Bar Association (“ABA” or “Defendant”) arising from a March 2023 data security breach (the “Breach”). Plaintiffs seek relief on behalf of themselves and several proposed classes of similarly situated persons with ABA accounts, asserting claims for (i) breach of implied contract; (ii) violation of various state consumer protection statutes; (ii) deceptive business practices under N.Y. G.B.L. §349; and (iii) deceptive business practices under TX. Bus. & Com. §17.46. Defendant has moved to dismiss Plaintiffs’ Amended Complaint (Am. Compl. (Dkt. 15)), in its entirety for failure to state a claim pursuant to Federal Rule of Civil Procedure 12(b)(6). (See Not. of Mot. (Dkt. 17); Mem. of Law in Support of Def’s. Mot. to Dismiss (“Def’s. Mot.”) (Dkt. 19).) For the following reasons, the Defendant’s motion is GRANTED and Plaintiffs’ claims are dismissed in their entirety. I. BACKGROUND1 Plaintiff Troy is a citizen of New York and has been a registered member of ABA since August 2018. (Am. Compl. 12.) Plaintiff Mata is a citizen of Texas and has been a registered member of ABA since 2022. (Id. 13.) In addition to being members with the ABA, both Plaintiffs made purchases from ABA during the relevant time period. (Id.
12-13.) Defendant ABA is a nation-wide voluntary attorney bar association. (Id. 14.) ABA requires customers to disclose personal identifying information and processes customer credit and debit card payments. (Id.) On March 6, 2023, an unidentified “hacker” acquired unauthorized access to the ABA network. (Id. 16.) Plaintiffs allege Defendant took no action to remove the hacker’s access until on or about March 17, 2023. (Id. 17.) Plaintiffs further allege that the Breach was a result of Defendant’s failure to comply with reasonable security standards and that ABA’s IT department was poorly managed, only exacerbating its purported inadequate security practices. (Id.