Ordered that the order, insofar as appealed from, is reversed, without costs, and defendant's motion to dismiss the complaint is granted.

Plaintiff commenced this action by summons and verified complaint dated June 7, 2022, to recover damages for violations of General Business Law § 349 and the Fair Debt Collection Practices Act (FDCPA) (15 USC § 1692 et seq.) and for negligence per se, negligence, and negligent misrepresentation in connection with her receipt of a debt collection letter from defendant. The complaint alleged, among other things, that plaintiff was not familiar with the creditor identified in the letter and did not owe any debt to that creditor; that defendant used a third party to prepare and mail the letter; that defendant disseminated plaintiff's private information to that third party; that defendant thereby "exposed Plaintiff to possible identity theft"; and that plaintiff feared that defendant would take additional steps to collect the alleged debt. The complaint asserted two principal theories of liability: the mailing vendor theory (i.e., that defendant disclosed plaintiff's private information to a third-party mailing vendor), the basis [*2]of the first through fourth causes of action, alleging violations of General Business Law § 349, violations of the FDCPA, negligence per se, and negligence, respectively; and the unknown creditor theory (i.e., that defendant attempted to collect a debt from plaintiff that plaintiff did not owe), the basis of the fifth through ninth causes of action, alleging violations of General Business Law § 349, violations of the FDCPA, negligence per se, negligence, and negligent misrepresentation, respectively.

Defendant moved to dismiss the complaint pursuant to, in effect, CPLR 3211 (a) (3), arguing that plaintiff lacked standing to bring the action because she had not alleged an injury-{**85 Misc 3d at 28}in-fact, and moved to dismiss the fifth through ninth causes of action pursuant to CPLR 3211 (a) (7) on the additional ground of failure to state a cause of action. Plaintiff opposed. By order entered January 5, 2023, the District Court, insofar as is relevant to this appeal, denied defendant's motion.

"Where a CPLR 3211 (a) (3) motion is based upon an alleged lack of standing, the burden is on the moving defendant to establish, prima facie, the plaintiff's lack of standing as a matter of law" (Sizova v Union Mut. Fire Ins. Co., 217 AD3d 1007, 1007-1008 [2d Dept 2023] [internal quotation marks omitted]). "In opposition, to defeat the motion, the plaintiff must raise a question of fact as to [her] standing" (Wilmington Trust, N.A. v Teo, 204 AD3d 735, 736-737 [2d Dept 2022]). "In order to possess standing, [the] plaintiff was required, inter alia, to have suffered 'an injury-in-fact' " (Greco v Syracuse ASC, LLC, 218 AD3d 1156, 1156 [4th Dept 2023], quoting Matter of Association for a Better Long Is., Inc. v New York State Dept. of Envtl. Conservation, 23 NY3d 1, 6 [2014]; see Society of Plastics Indus. v County of Suffolk, 77 NY2d 761, 772-773 [1991]). "To confer standing, a claimed injury may not depend upon speculation about what might occur in the future, but must consist of cognizable harm, meaning that a plaintiff has been or will be injured" (Frankel v J.P. Morgan Chase & Co., 193 AD3d 689, 690 [2d Dept 2021], citing New York State Assn. of Nurse Anesthetists v Novello, 2 NY3d 207, 214 [2004]).

In Greco v Syracuse ASC, LLC (218 AD3d 1156), the plaintiff brought a putative class action asserting claims for negligence, breach of express contract, breach of implied contract, violations of General Business Law §§ 899-AA and 349, and invasion of privacy (see Greco v Syracuse ASC, LLC, 2022 NY Slip Op 32104[U], *2 [Sup Ct, Onondaga County 2022])

"to recover damages allegedly arising when an unknown third party gained unauthorized access to certain personal information belonging to [the] plaintiff and others, which was stored on [the] defendant's computer system. [The] [d]efendant moved to dismiss the complaint on the ground that, inter alia, [the] plaintiff lacked standing to bring the action because she had not alleged an injury-in-fact" (Greco v Syracuse ASC, LLC, 218 AD3d at 1156).

The lower court denied the defendant's motion and the defendant appealed. The Appellate Division, Fourth Department, reversed,{**85 Misc 3d at 29} holding that "[the] plaintiff has not alleged an injury-in-fact and thus lacks standing" because, "other than a general concern that certain of [the] plaintiff's health information may have been illegally accessed by a third party, [the] plaintiff does not allege any direct harm flowing from the breach of [the] defendant's electronic system" (id. at 1158).[*3]

Here, similar to Greco, plaintiff, in connection with the dissemination of her private information, brought claims for violations of General Business Law § 349 (first cause of action) and negligence (third and fourth causes of action). Also similar to Greco, plaintiff did not allege that her private information had been misused; rather, she alleged only that defendant "exposed [her] to possible identity theft." Thus, on the basis of the holding in Greco, we dismiss the first, third, and fourth causes of action for lack of standing.

With respect to the second and sixth causes of action, alleging violations of the FDCPA, which are not addressed in Greco, we find that plaintiff's claims of injury-in-fact amount to "speculation about what might occur in the future" (Frankel v J.P. Morgan Chase & Co., 193 AD3d at 690) and, thus, are insufficient "to demonstrate 'concrete injury fulfilling the requirement of standing' " (id., quoting Matter of Town of E. Hampton v State of New York, 263 AD2d 94, 96 [3d Dept 1999]; see Greco v Syracuse ASC, LLC, 218 AD3d at 1158). Consequently, the second and sixth causes of action must also be dismissed for lack of standing.

We need not decide whether plaintiff has standing to assert the fifth, seventh, eighth, and ninth causes of action, as, in any event, these claims must be dismissed pursuant to CPLR 3211 (a) (7) (see West 63 Empire Assoc., LLC v Walker & Zanger, Inc., 107 AD3d 586, 586 [1st Dept 2013]; Lake v Kaleida Health, 60 AD3d 1469, 1470 [4th Dept 2009]; Matter of Malloy v Incorporated Vil. of Sag Harbor, 12 AD3d 107, 108 [2d Dept 2004]). On a motion to dismiss for failure to state a cause of action under CPLR 3211 (a) (7), a court must "accept the facts as alleged in [a] complaint as true, accord [the] plaintiffs the benefit of every possible favorable inference, and determine only whether the facts as alleged fit within any cognizable legal theory" (Leon v Martinez, 84 NY2d 83, 87-88 [1994]). "At the same time, however, allegations consisting of bare legal conclusions . . . are not entitled to any such consideration" (Simkin v Blank, 19 NY3d 46, 52 [2012] [internal quotation marks omitted]). "Dismissal of the complaint is warranted if the plaintiff{**85 Misc 3d at 30} fails to assert facts in support of an element of the claim, or if the factual allegations and inferences to be drawn from them do not allow for an enforceable right of recovery" (Connaughton v Chipotle Mexican Grill, Inc., 29 NY3d 137, 142 [2017]).

The fifth cause of action alleged violations of General Business Law § 349. To state a cause of action under General Business Law § 349, "[a] plaintiff must allege that: (1) the defendant's conduct was consumer-oriented; (2) the defendant's act or practice was deceptive or misleading in a material way; and (3) the plaintiff suffered an injury as a result of the deception" (Himmelstein, McConnell, Gribben, Donoghue & Joseph, LLP v Matthew Bender & Co., Inc., 37 NY3d 169, 176 [2021]). Here, plaintiff did not sufficiently plead the injury element of the claim, warranting dismissal of the fifth cause of action pursuant to CPLR 3211 (a) (7) (see Ovitz v Bloomberg L.P., 18 NY3d 753, 759 [2012]; Ballas v Virgin Media, Inc., 60 AD3d 712, 713 [2d Dept 2009]; Vigiletti v Sears, Roebuck & Co., 42 AD3d 497, 498 [2d Dept 2007]; Smith v Chase Manhattan Bank, USA, 293 AD2d 598, 599 [2d Dept 2002]; cf. HSBC Bank USA, N.A. v Lien Thi Ngo, 197 AD3d 1102, 1104 [2d Dept 2021]; Wilner v Allstate Ins. Co., 71 AD3d 155, 167 [2d Dept 2010]).

The seventh cause of action alleged negligence per se. "[V]iolation of a State statute that imposes a specific duty constitutes negligence per se" (Elliott v City of New York, 95 NY2d 730, [*4]734 [2001]). "Negligence per se is not liability per se, however, because the protected class member still must establish that the statutory violation was the proximate cause of the occurrence" (Dance v Town of Southampton, 95 AD2d 442, 445 [2d Dept 1983]; see Basso v Miller, 40 NY2d 233, 242 [1976]). Since plaintiff failed to allege an occurrence that was proximately caused by defendant's alleged negligence per se, the seventh cause of action should have been dismissed pursuant to CPLR 3211 (a) (7) (see Basso v Miller, 40 NY2d at 242; Dance v Town of Southampton, 95 AD2d at 445).

The eighth cause of action alleged negligence. To state a claim for negligence, a plaintiff must allege "(1) a duty owed by the defendant to the plaintiff, (2) a breach thereof, and (3) injury proximately resulting therefrom" (Pasternack v Laboratory Corp. of Am. Holdings, 27 NY3d 817, 825 [2016] [internal quotation marks omitted]; see Moore Charitable Found. v PJT Partners, Inc., 40 NY3d 150, 157 [2023]). Since plaintiff failed to assert facts in support of the injury element of the claim, the eighth cause of action should have been dismissed pursuant to{**85 Misc 3d at 31} CPLR 3211 (a) (7) (see Connaughton v Chipotle Mexican Grill, Inc., 29 NY3d at 142; cf. O'Toole v Greenberg, 64 NY2d 427, 431-432 [1985]; Becker v Schwartz, 46 NY2d 401, 410 [1978]).

The ninth cause of action alleged negligent misrepresentation. To state a claim for negligent misrepresentation, a plaintiff must allege "(1) the existence of a special or privity-like relationship imposing a duty on the defendant to impart correct information to the plaintiff; (2) that the information was incorrect; and (3) reasonable reliance on the information" (Mandarin Trading Ltd. v Wildenstein, 16 NY3d 173, 180 [2011] [internal quotation marks omitted]; see J.A.O. Acquisition Corp. v Stavitsky, 8 NY3d 144, 148 [2007]). The reasonable reliance element includes the requirement that the plaintiff "act[ed] or failed to act [on the information] to their damage" (White v Guarente, 43 NY2d 356, 363 [1977]). As plaintiff failed to allege how she "act[ed] or failed to act [on the information] to [her] damage" (id.), the ninth cause of action should have been dismissed pursuant to CPLR 3211 (a) (7).

Accordingly, the order, insofar as appealed from, is reversed and defendant's motion to dismiss the complaint is granted.

Garguilo, P.J., Driscoll and Walsh, JJ., concur.