Under CAFA, a court has original jurisdiction of a civil action in which the matter in controversy exceeds $5,000,000 and "any member of a class of plaintiffs is a citizen of a State different from any defendant." 28 U.S.C. § 1332(d)(2)(A); see Lowery v. Alabama Power Co., 483 F.3d 1184, 1193 n.24 (11th Cir. 2007) (explaining CAFA has a "minimal diversity" requirement between one plaintiff and any defendant). A plaintiff alleging diversity jurisdiction has the burden of proving diversity. King v. Cessna Aircraft Co., 505 F.3d 1160, 1171 (11th Cir. 2007). For a natural person, citizenship, not residency alone, must be alleged. Taylor v. Appleton, 30 F.3d 1365, 1367 (11th Cir. 1994). Citizenship requires residency and an intent to remain there indefinitely. Travaglio v. Amer. Exp. Co., 735 F.3d 1266, 1269 (11th Cir. 2013). A limited liability company is a citizen of any state of which a member of the company is a citizen. Rolling Greens MHP, L.P. v. Comcast SCH Holdings L.L.C., 374 F.3d 1020, 1022 (11th Cir. 2004).

Standing is a threshold jurisdictional question that must be addressed sua sponte if not raised by the parties and before and independent of the merits of a claim. Jones v. Comm'r Ga. Dep't of Corrs., 811 F.3d 1288, 1295 (11th Cir. 2016). A plaintiff "must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins, 136 S.Ct. 1540, 1547 (2016). A plaintiff must "clearly allege facts demonstrating each element." Debernardis v. IQ Formulations, LLC, 942 F.3d 1076, 1083 (11th Cir. 2019). Standing must be established between the named plaintiff and a defendant. Griffin v. Dugger, 823 F.2d 1476, 1483 (11th Cir. 1987).

To be an injury in fact, an injury must be an "invasion of a legally protected interest that is concrete and particularized and actual or imminent, not conjectural or hypothetical." Spokeo, 136 S. Ct. at 1548 (internal quotation marks omitted). "[T]he focus is on the qualitative nature," not the size, of the injury. Salcedo v. Hanna, 936 F.3d 1162, 1173 (11th Cir. 2019); see also In re Brinker Data Incident Litigation, No. 3:18-cv-686-J-32MCR, 2019 WL 3502993, (M.D. Fla. Aug. 1, 2019) (unpublished) (finding in a data-breach case regarding customer information stolen from restaurants that (1) some customers had suffered injury in fact when they had unauthorized charges on their credit cards that caused them to replace cards and lose ability to accrue cash back, and (2) other customers had not suffered injury in fact where future injury of harm was too speculative, actions like setting up free credit-monitoring services were insufficient, and the plaintiffs' "information, if even compromised, ha[d] not been misused"). Whether an injury is "fairly traceable" to the defendant's conduct "requires less than a showing of `proximate cause.'" Resnick v. AvMed, Inc., 693 F.3d 1317, 1324 (11th Cir. 2012). In cases involving data breach and identity theft, "the pleadings must include allegations of a nexus between the two instances beyond allegations of time and sequence." Id.

The plaintiff explains a security researcher discovered an alleged breach when looking for databases visible on publicly accessible servers. Doc. 1 ¶ 28. He states he has incurred costs in buying credit monitoring services. Doc. 1 ¶ 39. He does not clearly allege his information was ever used as a result of the alleged breach. See generally Doc. 1 & Doc. 1 ¶ 10.