MARKLE, Judge.

Several former and current patients filed a putative class action against the Athens Orthopedic Clinic (“the Clinic”), asserting claims for negligence, breach of implied contract, unjust enrichment, attorney fees, injunctive relief under Georgia’s Uniform Deceptive Trade Practices Act (UDTPA),1 and declaratory judgment stemming from a data breach of their personal information. The trial court dismissed all claims, and we affirmed. Collins v. Athens Orthopedic Clinic, 347 Ga. App. 13, 14-22 (2) (815 SE2d 639) (2018). Our Supreme Court granted certiorari and reversed, holding that the allegations in the complaint sufficiently stated a claim for negligence that was not merely speculative, and thus, it was error to dismiss the negligence asserted in support thereof; and . . . the movant establishes that the claimant could not possibly introduce evidence within the framework of the complaint sufficient to warrant a grant of the relief sought.” (Citation omitted.) Id.; see also Babalola v. HSBC Bank, USA, N.A., 324 Ga. App. 750, 752 (2) (751 SE2d 545) (2013).

The facts are set forth in our prior opinion, but are summarized here: In June 2016, an anonymous hacker known as the “Dark Overlord” stole the personally identifiable information, including social security numbers, birthdates, addresses, and health insurance information, of approximately 200,000 current and former Clinic patients. The hacker demanded ransom, but the Clinic refused to pay, and the hacker sold the information on the “dark web.” The Clinic alerted its patients of the breach in August 2016. Collins, 347 Ga. App. at 13.

Thereafter, Christine Collins, Paulette Moreland, and Kathryn Strickland (collectively, “the plaintiffs”) filed a putative class action. In their complaint, they alleged that the Clinic failed to offer and pay for any credit monitoring or identity theft protection following the data breach despite the “imminent threat” that the stolen information will be used to their detriment now that “criminals are . . . able to assume [the patients’] identity and fraudulently obtain credit cards, issue fraudulent checks, file tax refund returns, liquidate bank accounts, and open new accounts, all in [the patients’] names.”3 Based on these allegations, the plaintiffs asserted claims for negligence, breach of implied contract, unjust enrichment, and violations of the Georgia UDTPA. They requested a declaratory judgment and injunctive relief in the form of monitoring, theft protection, and other prospective corrective measures.

We now consider whether the other claims as alleged above are sufficient to survive a motion to dismiss.

(1) Breach of implied contract.

In our prior opinion, we concluded that this claim failed because the plaintiffs had yet to suffer injury and thus incurred no damages. 347 Ga. App. at 19 (2) (b). The Clinic concedes that this claim must be remanded. See Collins, 307 Ga. at 563 (3); see also In re Arby’s Restaurant Group Inc. Litigation, 2018 WL 2128441, at[*16] (III) (C) (N. D. Ga. 2018) (citing cases from other circuits allowing implied contract claims to survive motion to dismiss and agreeing that “[t]hese decisions are grounded in the recognition that when a customer uses a credit card in a commercial transaction, she intends to provide that data to the merchant only . . . and certainly does not intend . . . the merchant to allow unauthorized third parties to access that data.” (citation and punctuation omitted)); Irwin v. RBS Worldpay, Inc., 2010 WL 11570892, at *6-7 (III) (C) (3) (N. D. Ga. 2010) (plaintiff sufficiently stated claim for breach of implied contract claim based on allegations that he would not have provided his personal financial information without defendant’s implied agreement to protect it). We accept the Clinic’s concession, and therefore reverse the dismissal of this claim, and remand it for further proceedings.

2. Unjust enrichment.

[A] claim for unjust enrichment exists where a plaintiff asserts that the defendant induced or encouraged the plaintiff to provide something of value to the defendant; that the plaintiff provided a benefit to the defendant with the expectation that the defendant would be responsible for the cost thereof; and that the defendant knew of the benefit being bestowed upon it by the plaintiff and either affirmatively chose to accept the benefit or failed to reject it.

Campbell v. Ailion, 338 Ga. App. 382, 387 (2) (790 SE2d 68) (2016).

“Unjust enrichment is an equitable principle that may be applied when there is no valid written contract between the parties[.]”4 (Citation omitted.) Ga. Dept. of Community Health v. Data Inquiry, 313 Ga. App. 683, 687 (2) (722 SE2d 403) (2012). In other words, if there was no express or implied contract, the plaintiffs can bring a claim for unjust enrichment. See Watson v. Sierra Contracting Corp., 226 Ga. App. 21, 28 (c) (485 SE2d 563) (1997) (physical precedent only). Importantly, however, the plaintiffs in this case “did not plead unjust enrichment as an alternate theory of recovery based on a failed contract.” 347 Ga. App. at 22 (2) (e). Instead, they pled it as a separate tort seeking damages in the form of credit monitoring and a credit freeze in addition to restitution of payments made for security services.^[5] As such, the plaintiffs have alleged unjust enrichment as a separate and distinct cause of action and not as an alternate remedy for a failed contract.^[6] Therefore, this claim fails as a matter of law. See Cash v. LG Electronics, Inc., 342 Ga. App. 735, 742 (2) (804 SE2d 713) (2017); Tolson Firm, LLC v. Sistrunk, 338 Ga. App. 25, 31 (4) (789 SE2d 265) (2016); Wachovia Ins. Svcs. v. Fallon, 299 Ga. App. 440, 449 (6) (682 SE2d 657) (2009); Tidikis v. Network for Med. Communications & Research, LLC, 274 Ga. App. 807, 810-811 (2) (619 SE2d 481) (2005). The Supreme Court’s analysis does not dictate we reach a different result with respect to this claim, and the trial court properly dismissed it. See Shadix v. Carroll County, 274 Ga. 560, 562-563 (1) (554 SE2d 465) (2001); see also Schroeder v. Dekalb County, 350 Ga. App. 82, 82-83 (828 SE2d 108) (2019); Jordan v. Everson, 345 Ga. App. 509, 511 (813 SE2d 600) (2018).

3. UDTPA.

“A person likely to be damaged by a deceptive trade practice of another may be granted an injunction against it under the principles of equity and on terms that the court considers reasonable. Proof of monetary damage, loss of profits, or intent to deceive is not required.” OCGA § 10-1-373 (a). The UDTPA offers only injunctive relief where the plaintiff has established a likelihood of future damage, but it does not address past harm. Catrett v. Landmark Dodge, Inc., 253 Ga. App. 639, 644 (3) (560 SE2d 101) (2002); Moore-Davis Motors, Inc. v. Joyner, 252 Ga. App. 617, 619 (3) (556 SE2d 137) (2001). Thus, to state a claim and to establish standing under the UDTPA, the plaintiffs must allege that they are likely to be damaged in the future by an unfair trade practice.^[7] See OCGA § 10-1-373 (a); Friedlander v. HMS-Pep Products, Inc., 226 Ga. App. 123, 124-125 (1) (a) (485 SE2d 240) (1997).

In their complaint, the plaintiffs alleged that the Clinic engaged “in the unconscionable, deceptive, or unfair acts or practices . . . [by] breaching duties [the Clinic] owes . . . , by failing to provide fair, reasonable, or adequate computer systems and data security practices”; that the Clinic did so knowing it was likely to mislead patients who were acting reasonably under the circumstances; that the Clinic knew or should have known that it kept its lack of adequate safeguards from its patients; and that they would not have obtained care at the Clinic had they known.

Pretermitting whether the plaintiffs have alleged an “unfair trade practice” under the statute, an injunction would serve no purpose at this point because, as alleged, their personal information was already sold and is available on the dark web. As such, the plaintiffs have failed to allege a future harm caused by the unfair practice, as required by the UDTPA, and the trial court properly dismissed this claim. See Catrett, 253 Ga. App. at 644 (3); see also Willingham v. Global Payments, Inc., 2013 WL 440702,[*16] (III) (C) (1) (N. D. Ga. 2013).

4. Declaratory judgment.

[A] declaratory judgment may not be granted in the absence of a justiciable controversy. The plaintiff must show facts or circumstances whereby it is in a position of uncertainty or insecurity because of a dispute and of having to take some future action which is properly incident to its alleged right, and which future action without direction from the court might reasonably jeopardize its interest.

(Citation and punctuation omitted.) Effingham County Bd. of Commrs. v. Effingham County Indus. Dev. Auth., 286 Ga. App. 748, 749 (650 SE2d 274) (2007). As we have explained, [t]he object of the declaratory judgment is to permit determination of a controversy before obligations are repudiated or rights are violated. As many times pointed out by this court, its purpose is to permit one who is walking in the dark to ascertain where he is and where he is going, to turn on the light before he steps rather than after he has stepped in a hole.

(Citation omitted.) Oconee Fed. S & L Assn. v. Brown, 351 Ga. App. 561, 566 (2) (a) (831 SE2d 222) (2019). Thus, “when a party seeking declaratory judgment does not show it is in a position of uncertainty as to an alleged right, dismissal of the declaratory judgment action is proper.” (Citation omitted.) SAWS at Seven Hills, LLC v. Forestar Realty, Inc., 342 Ga. App. 780, 783 (1) (805 SE2d 270) (2017); see also U-Haul Co. of Arizona v. Rutland, 348 Ga. App. 738, 747 (1) (824 SE2d 644) (2019).

In their complaint, the plaintiffs sought a declaration that the Clinic is not in compliance with its “existing obligations, and that [the Clinic] must implement specific additional, prudent security practices” and “provide credit monitoring and identity theft protection” to them. They then listed eight specific requirements they wish the court to direct the Clinic to complete, including auditing the system, security testing and monitoring, training, and educating patients about the threats to their personal information. They further alleged that the Clinic remains vulnerable to similar attacks and must take more stringent measures in the future.

Notably, the plaintiffs’ personal information had already been stolen and they have taken measures to protect themselves by placing alerts on their credit reports. They are not operating under any uncertainty, and they “need[ ] no direction” to take steps to protect their information. Effingham County Bd. of Commrs., 286 Ga. App. at 750 (declaratory judgment improper where the declaration sought addressed an act that already occurred). Moreover, “[d]eclaratory judgment will not be rendered based on a possible or probable future contingency,” such as another possible data theft. (Citation omitted.) Id. But that is precisely what the plaintiffs are seeking here.

The fact that we are reviewing this issue on appeal from the grant of a motion to dismiss does not alter our conclusion. A review of the complaint demonstrates that none of the plaintiffs’ allegations show a future uncertainty as to their rights. Therefore, we must conclude that the plaintiffs could prove no set of facts that would entitle them to declaratory relief, and the trial court properly dismissed this claim.^[8] 5. Attorney fees.

Attorney fees and litigation expenses under OCGA § 13-6-11 “are ancillary and recoverable only where other elements of damage are recoverable on the underlying claim[s].” (Citation and punctuation omitted.) Sparra v. Deutsche Bank Nat. Trust Co., 336 Ga. App. 418, 423 (1) (f) (785 SE2d 78) (2016). Because, as stated above, and as the Clinic concedes, the plaintiffs may proceed with their negligence and breach of implied contract claims, it was error to dismiss the claim for attorney fees. Accordingly, we reverse the dismissal of this claim, and remand it for further proceedings.

For the foregoing reasons, we affirm the trial court’s dismissal of the claims for unjust enrichment, declaratory relief, and an injunction under the UDTPA; we reverse the dismissal of the claims for negligence, breach of implied contract, and attorney fees, and we remand the case for further proceedings as to those remaining claims.

Judgment affirmed in part; reversed in part; and case remanded with direction. Rickman, J., concurs. McFadden, C. J., concurs in Divisions 1 and 5; concurs specially in Division 3; and dissents in Divisions 2 and 4.

In the Court of Appeals of Georgia A18A0296. COLLINS et al. v. ATHENS ORTHOPEDIC CLINIC.

MCFADDEN, Chief Judge, concurring in part, concurring specially in part, and dissenting in part.

I concur fully in Divisions 1 and 5 of the majority opinion.

But I do not agree with its holding that the plaintiffs were required to plead a failed contract in order to state a claim for unjust enrichment. No relevant Georgia law imposes such a requirement. And the plaintiffs have made sufficient allegations to give Athens Orthopedic Clinic fair notice of their claim of unjust enrichment. I would reverse the dismissal of that claim. So I dissent from Division 2 of the majority opinion.

I agree with the majority that the trial court was right to dismiss the plaintiffs’ claim under the Uniform Deceptive Trade Practices Act, but for different reasons than the majority. The claim fails because the plaintiffs have not alleged a deceptive trade practice. So I concur specially in Division 3 of the majority opinion.

Finally we should not say, at this stage of the litigation, that the plaintiffs have failed to state a claim for a declaratory judgment. So I would reverse the dismissal of the declaratory judgment claim, and I dissent from Division 4 of the majority opinion.

1. Unjust enrichment.

“On a motion to dismiss for failure to state a claim upon which relief can be granted, the issue is not whether the petition pled a claim in an ideal manner but whether it sufficiently gave [the defendant] fair notice of the claim and a general indication of the type of litigation involved.” Lathem v. Hestley, 270 Ga. 849, 850 (514 SE2d 440) (1999). “A complaint need not set forth a cause of action in order to withstand a motion to dismiss but need only to set forth a claim for relief. In fact, a plaintiff may sue on one theory and recover on another so long as the complaint adequately states a claim for relief.” Walker v. Gowen Stores LLC, 322 Ga. App. 376, 376-77 (745 SE2d 287) (2013) (citations and punctuation omitted).

In support of their unjust enrichment claim, the plaintiffs alleged that they paid fees to Athens Orthopedic for medical services, a portion of the fees were supposed to be used to provide data security, Athens Orthopedic did not provide adequate data security, so the plaintiffs are entitled to a refund of the fees as well as the costs of credit monitoring, identity theft protection, and placing credit freezes. “Unjust enrichment is an equitable concept and applies when as a matter of fact there is no legal contract but when the party sought to be charged has been conferred a benefit by the party contending an unjust enrichment which the benefitted party equitably ought to return or compensate for.” St. Paul Mercury Ins. Co. v. Meeks, 270 Ga. 136, 137 (1) (508 SE2d 646) (1998) (citation and punctuation omitted). The plaintiffs’ allegations are sufficient to state a claim for relief and to put Athens Orthopedic on notice of the basis for the claim. So the claim is not subject to dismissal. Lathem, 270 Ga. at 850; Walker, 322 Ga. App. at 376.

The majority holds that the plaintiffs insufficiently pled their unjust enrichment claim because they did not allege the claim as an alternative remedy for a failed contract, but pled it as a separate tort seeking restitution and damages. Georgia law does not require a plaintiff to plead an unjust enrichment claim as an alternate remedy for a failed contract. Compare OCGA § 9-11-8 (a) (2) (requiring most complaints to contain only facts upon which venue depends,“[a] short and plain statement of the claims showing that the pleader is entitled to relief,” and “[a] demand for judgment”) with OCGA § 9-11-9 & (b) (listing pleading requirements for special matters, including fraud which must “be stated with particularity”). It is true that our court has employed imprecise language in some cases that might be read to imply that unjust enrichment must be pled as an alternative theory of recovery for a failed contract.

The problem started in Tidikis v. Network for Medical Communications & Research, LLC, 274 Ga. App. 807 (619 SE2d 481) (2005), where we affirmed the grant of the defendants’ motion for judgment on the pleadings as to the plaintiff’s unjust enrichment claim because it was undisputed that the parties had a contract. Id. at 810-811 (2). We observed that the plaintiff was “treating the unjust enrichment claim like a tort — e.g., the defendants violated his legal right to property interests.” Id. (footnote omitted). In response, we wrote that “a claim for unjust enrichment is not a tort, but an alternative theory of recovery if a contract claim fails.” Id. at 811 (2). We explained that “[t]he theory of unjust enrichment applies when there is no legal contract and when there has been a benefit conferred which would result in an unjust enrichment unless compensated.” Id. at 811 (2). And because the parties undisputedly had a contract, the plaintiff’s unjust enrichment claim failed as a matter of law. Id.

Relying on the Tidikis dicta that “a claim for unjust enrichment is not a tort, but an alternative theory of recovery if a contract claim fails,” we held in an opinion affirming a grant of summary judgment, Wachovia Ins. Svcs. v. Fallon, 299 Ga. App. 440 (682 SE2d 657) (2009), that “[b]ecause [the plaintiff] asserts unjust enrichment as a separate tort and not an alternative theory of recovery for a failed contract, this claim fails as a matter of law.” Id. at 449 (6). After Fallon, we relied on the statement to hold that unjust enrichment claims failed as a matter of law in two non-precedential cases, American Mgmt. Svcs. E., LLC v. Fort Benning Family Communities, LLC, 333 Ga. App. 664, 692-693 (6) (774 SE2d 233) (2015) (physical precedent only) and Tolson Firm, LLC v. Sistrunk, 338 Ga. App. 25, 31 (4) (789 SE2d 265) (2016) (physical precedent only).

In Cash v. LG Electronics, 342 Ga. App. 735 (804 SE2d 713) (2017), we, perhaps inadvertently, elevated the Tidikis dicta relied on in Fallon to a pleading requirement, holding that because the plaintiff “had an adequate remedy at law[] and did not plead unjust enrichment as an alternate theory of recovery based on a failed contract . . . her claim for such relief cannot succeed.” Id. at 742 (2) (citation omitted).

But Cash also involved summary judgment, not a motion to dismiss or a motion for judgment on the pleadings, and we did not address the requirements for sufficiently pleading a claim. We relied on Cash to affirm the dismissal of the plaintiffs’ unjust enrichment claim in our prior opinion in this case. Collins v. Athens Orthopedic Clinic, 347 Ga. App. 13, 21-22 (2) (e) (815 SE2d 639) (2018) (physical precedent only), reversed on other grounds by Collins v. Athens Orthopedic Clinic, 307 Ga. 555 (837 SE2d 310) (2019).

None of these cases require dismissal of the plaintiffs’ unjust enrichment claim. Some are procedurally distinguishable as they involved summary judgment, not a motion to dismiss for failure to state a claim. Cash, 342 Ga. App. at 735, Fallon, 299 Ga. App. at 440. Some are non-precedential. Tolson, 338 Ga. App. at 25, American Mgmt. Svcs., 333 Ga. App. at 664. And in the one case that concerned a judgment on the pleadings, Tidikis, 274 Ga. App. 807, we held that the plaintiff could not assert an unjust enrichment claim because it was undisputed that the parties’ relationship was governed by a contract. So the questionable language was, at best, dicta.

Although a plaintiff may allege a breach of contract claim and an unjust enrichment claim in the alternative, there is no requirement that he do so. See OCGA § 9-11-8 (e) (2) (“A party may also state as many separate claims or defenses as he has, regardless of consistency and whether based on legal or on equitable grounds or on both.”); Campbell v. Ailion, 338 Ga. App. at 388 (2). This makes sense because unjust enrichment applies not only when there is a failed contract but also when there is no contract at all. St. Paul Mercury, 270 Ga. at 137-38 (unjust enrichment claim stemming from a defendant’s embezzlement; no issue of a failed contract; there simply was no contract at all); Hollifield v. Monte Vista Biblical Gardens, 251 Ga. App. 124, 130-131 (2) (c) (553 SE2d 662) (2001) (addressing merits of unjust enrichment claim when there was no contract between the parties).

An unjust enrichment claim is improper only where the existence of a valid contract between the parties is undisputed. See Tidikis, 274 Ga. App. at 810-811 (2); Bogard v. Inter–State Assurance Co., 263 Ga. App. 767 (589 SE2d 317) (2003) (affirming grant of motion for judgment on the pleadings because plaintiff’s unjust enrichment claim was precluded by the existence of a legally valid contract). Because here it is not undisputed that the parties’ relationship is governed by a valid contract, the plaintiffs can pursue their unjust enrichment claim, which they sufficiently pled and which the trial court erred in dismissing.

2. Uniform Deceptive Trade Practices Act.

The plaintiffs alleged that they are entitled to an injunction under the Uniform Deceptive Trade Practices Act, OCGA §§ 10-1-370 through 10-1-375. They have failed to allege acts that amount to deceptive trade practices. So the trial court properly dismissed the claim under the Act.

The Act defines “deceptive trade practice” by enumerating several particular examples followed by a general term of enlargement. OCGA § 10-1-372 (a). But the conduct alleged here is not of the same kind or class as the examples. The statute provides,

(a) A person engages in a deceptive trade practice when, in the course of his business, vocation, or occupation, he: (1) Passes off goods or services as those of another; (2) Causes likelihood of confusion or of misunderstanding as to the source, sponsorship, approval, or certification of goods or services; (3) Causes likelihood of confusion or of misunderstanding as to affiliation, connection, or association with or certification by another; (4) Uses deceptive representations or designations of geographic origin in connection with goods or services; (5) Represents that goods or services have sponsorship, approval, characteristics, ingredients, uses, benefits, or quantities that they do not have or that a person has a sponsorship, approval, status, affiliation, or connection that he does not have; (6) Represents that goods are original or new if they are deteriorated, altered, reconditioned, reclaimed, used, or secondhand; (7) Represents that goods or services are of a particular standard, quality, or grade or that goods are of a particular style or model, if they are of another; (8) Disparages the goods, services, or business of another by false or misleading representation of fact; (9) Advertises goods or services with intent not to sell them as advertised; (10) Advertises goods or services with intent not to supply reasonably expectable public demand, unless the advertisement discloses a limitation of quantity; (11) Makes false or misleading statements of fact concerning the reasons for, existence of, or amounts of price reductions; or (12) Engages in any other conduct which similarly creates a likelihood of confusion or of misunderstanding.

OCGA § 10-1-372 (a).

We have explained that the statute generally bars “deceptive trade practices involving fraudulent misrepresentations as to the origin, approval, quality, or description of goods or services; false advertising and factual statements about goods or services, and false or misleading statements about the reasons for, existence of, or amounts of price reductions.” Morrell v. Wellstar Health System, 280 Ga. App. ^[1], 6 (3) (633 SE2d 68) (2006). And the catch-all language of subsection (a) (12) “means a trade practice that creates confusion or misunderstanding in a manner similar to the conduct prohibited in subsections (a) (1) thru (a) (11) of OCGA § 10-1-372.” Id. See also York v. RES-GA LJY, LLC, 300 Ga. 869, 872 (2) (799 SE2d 235) (2017) (“When a statute or document enumerates by name several particular things, and concludes with a general term of enlargement, this latter term is to be construed as being ejusdem generis (i.e., of the same kind or class) with the things specifically named, unless, of course, there is something to show that a wider sense was intended.”) (citation and punctuation omitted).

The plaintiffs alleged that Athens Orthopedic violated the Act “by failing to provide fair, reasonable, or adequate computer systems and data security practices to safeguard” their personally identifiable information and by failing to inform the plaintiffs that it did not have adequate computer systems and data security practices. The plaintiffs did not allege, however, that Athens Orthopedic knew its computer systems and data security practices were inadequate. Indeed, they alleged that this is a question of fact. Nor did they allege that Athens Orthopedic falsely told them in any communication that it had adequate computer systems and data security practices. As a matter of law, the acts alleged by the plaintiffs are not the kinds of acts that amount to deceptive trade practices within the meaning of OCGA § 10-1-372 (a). So the trial court properly dismissed the plaintiffs’ claims under the Act. See In re Michaels Stores Pin Pad Litigation, 830 FSupp2d 518, 525 (II) (A) (N.D. Ill. 2011) (plaintiffs’ allegations that they were deceived by defendant’s “failure to disclose that it had not implemented adequate security measures” and their failure to identify a “communication by [defendant] which contained this allegedly deceptive omission” failed to state a claim of a deceptive practice under the Illinois Consumer Fraud and Deceptive Business Practices Act). See also OCGA § 10-1-375 (the Act “shall be construed to effectuate its general purpose to make uniform the law of those states which enact it”).

3. Declaratory Judgment.

In the declaratory judgment count of their complaint, the plaintiffs alleged that Athens Orthopedic still possesses their personally identifiable information and that the prior data breach has made Athens Orthopedic’s systems even more vulnerable to an attack. The plaintiffs thus sought a declaration that Athens Orthopedic is currently not in compliance with its existing obligations to protect the plaintiffs’ personally identifiable information, and that to meet that compliance, Athens Orthopedic must implement and maintain a variety of security measures. At the motion-to-dismiss stage, this is sufficient to state a claim for a declaratory judgment. So I would reverse the trial court’s dismissal of the claim.

“The State Declaratory Judgment Act gives superior courts the power to declare rights and other legal relations of any interested party in ‘cases of actual controversy’ under OCGA § 9-4-2 (a) and ‘in any civil case in which it appears to the court that the ends of justice require that the declaration should be made.’ OCGA § 9-4-2 (b).” Leitch v. Fleming, 291 Ga. 669, 670 (1) (732 SE2d 401) (2012). “Basically, the question in each case is whether the facts alleged, under all the circumstances, show that there is a substantial controversy, between parties having adverse legal interests, of sufficient immediacy and reality to warrant the issuance of a declaratory judgment.” MedImmune, Inc. v. Genentech, 549 U. S. 118, 127 (127 SCt 764, 166 LE2d 604) (2007). Although a “[d]eclaratory judgment will not be rendered based on a possible or probable future contingency,” Baker v. City of Marietta, 271 Ga. 210, 215 (1) (518 SE2d 879) (1999) (citation omitted), here the plaintiffs alleged that Athens Orthopedic is currently not in compliance with its existing obligations to protect the plaintiffs’ personally identifiable information, subjecting the information to further risk.

The plaintiffs’ “allegations that they would be harmed without declaratory relief because [Athens Orthopedic] has not taken steps to address their allegedly inadequate security system . . . is enough to survive a motion to dismiss.” In re Arby’s Rest. Grp. Litig., No. 1:17-cv-0514-AT, 2018 U.S. Dist. LEXIS 131140, at[*50] -51 (N.D. Ga. Mar. ^[5], 2018) (cited with approval in Collins, 307 Ga. at 564 (4)). Further, the plaintiffs’ request for injunctive relief to require Athens Orthopedic to implement security measures is proper incident to the request for a declaratory judgment because “the Declaratory Judgment Act empowers the superior court in which a petition for declaratory judgment is filed to grant injunctive or other interlocutory extraordinary relief in connection with the petition. OCGA § 9-4-3 (b)[.]” James B. Beam Distilling Co. v. State, 263 Ga. 609, 613 (5) (437 SE2d 782) (1993). So the trial court erred in dismissing the claim for declaratory judgment.