OPINION
JUSTICE BAER
We granted discretionary review in this matter to determine whether an employer has a legal duty to use reasonable care to safeguard its employees' sensitive personal information that the employer stores on an internet-accessible computer system. We also examine the scope of Pennsylvania's economic loss doctrine, specifically whether it permits recovery in negligence for purely pecuniary damages. For the reasons discussed below, we hold that an employer has a legal duty to exercise reasonable care to safeguard its employees' sensitive personal information stored by the employer on an internet-accessible computer system. We further hold that, under Pennsylvania's economic loss doctrine, recovery for purely pecuniary damages is permissible under a negligence theory provided that the plaintiff can establish the defendant's breach of a legal duty arising under common law that is independent of any duty assumed pursuant to contract. As the Superior Court came to the opposite conclusions, we now vacate its judgment.
Barbara A. Dittman, Gary R. Douglas, Alice Pastirik, Joann Decolati, Tina Sorrentino, Kristen Cushman, and Shannon Molyneaux, individually and on behalf of all others similarly situated (collectively, Employees), filed the operative class action complaint in this matter against UPMC d/b/a the University of Pittsburgh Medical Center and UPMC McKeesport (collectively, UPMC) on June 25, 2014. In the complaint, Employees alleged that a data breach had occurred through which the personal and financial information, including names, birth dates, social security numbers, addresses, tax forms, and bank account information of all 62,000 UPMC employees and former employees was accessed and stolen from UPMC's computer systems. Second Amended Class Action Complaint, 6/25/2014, at ¶¶ 21-22, 27, 53. Employees further alleged that the stolen *1039data, which consisted of information UPMC required Employees to provide as a condition of their employment, was used to file fraudulent tax returns on behalf of the victimized Employees, resulting in actual damages. Id. ¶¶ 21, 23, 35.
Based on the foregoing, Employees asserted a negligence claim and breach of implied contract claim against UPMC.1 With respect to their negligence claim, Employees alleged that UPMC had a duty to exercise reasonable care to protect their "personal and financial information within its possession or control from being compromised, lost, stolen, misused, and/or disclosed to unauthorized parties." Id. at ¶ 53. Employees further alleged that UPMC undertook a duty of care to ensure the security of their information in light of the special relationship between Employees and UPMC, whereby UPMC required Employees to provide the information as a condition of their employment. Id. at ¶ 56. Employees averred that this "duty included, among other things, designing, maintaining, and testing its security systems to ensure" that Employees' information was adequately protected, and implementing "processes that would detect a breach of its security systems in a timely manner." Id. at ¶¶ 54-55.
Additionally, Employees claimed that UPMC breached its duty to use reasonable care "by failing to adopt, implement, and maintain adequate security measures to safeguard [Employees'] ... information, failing to adequately monitor the security of its network, allowing unauthorized access to [Employees'] ... information, and failing to recognize in a timely manner that [Employees'] ... information had been compromised." Id. at ¶ 57. Employees further averred that UPMC "violated administrative guidelines" and "failed to meet current data security industry standards," specifically by failing to encrypt data properly, "establish adequate firewalls to handle a server intrusion contingency," and "implement adequate authentication protocol to protect the confidential information contained in its computer network."Id. at ¶¶ 33-34.
Employees also claimed that UPMC's breach of its duties was the direct and proximate cause of the harm to Employees. Id. at ¶¶ 59-60. Finally, Employees alleged that, as a result of UPMC's negligence, Employees "incurred damages relating to fraudulently filed tax returns" and are "at an increased and imminent risk of becoming victims of identity theft crimes, fraud and abuse." Id. at ¶¶ 61-62. Based on the foregoing, Employees sought monetary damages, among other forms of relief. Id. at ¶ 70.
On July 16, 2014, UPMC filed preliminary objections to Employees' complaint arguing that, inter alia , their negligence claim failed as a matter of law. Specifically, UPMC argued that no cause of action exists for negligence because Employees did not allege any physical injury or property damage and, under the economic loss doctrine, "no cause of action exists for negligence that results solely in economic damages unaccompanied by physical injury or property damage." UPMC's Preliminary *1040Objections to Employees' Second Amended Class Action Complaint, 7/16/2014, at ¶¶ 15-17 (quoting Excavation Technologies, Inc. v. Columbia Gas Co. of Pa. , 604 Pa. 50, 985 A.2d 840, 841 n.3 (2009) ). Employees responded in opposition, and UPMC filed a reply to Employees' response. Thereafter, on October 22, 2014, the parties appeared before the trial court for oral argument on UPMC's preliminary objections. Following argument, at the court's direction, both parties filed supplemental briefs addressing whether UPMC owed a duty of care to Employees under the five-factor test set forth in Althaus ex rel. Althaus v. Cohen , 562 Pa. 547, 756 A.2d 1166 (2000).2
On May 28, 2015, the court sustained UPMC's preliminary objections and dismissed Employees' negligence claim.3 Relying upon the general description of the economic loss doctrine quoted from Excavation Technologies above, the trial court observed that, while Employees claimed that UPMC owed them a duty of care, the only losses Employees sustained were economic in nature. Trial Ct. Op., 5/28/2015, at 4. The trial court then briefly examined this Court's decision in Bilt-Rite Contractors, Inc. v. The Architectural Studio , 581 Pa. 454, 866 A.2d 270 (2005), which allowed a negligence action based upon economic loss alone, viewing it as merely creating an exception to the economic loss doctrine for losses incurred as a result of a plaintiff's reliance on advice given by professionals for pecuniary gain.4 Id. at 4-5. The trial court concluded that, because this "case does not involve defendants in the business of supplying information for economic gain," the exception did not apply. Id.
The trial court further opined that the Althaus factors and duty of care "should not be considered where the plaintiff seeks to recover only economic losses," as "the Pennsylvania appellate courts have already balanced the competing interests through adoption of the economic loss doctrine." Id. at 5. This determination notwithstanding, the trial court went on to analyze the Althaus factors and conclude that courts should not impose "a new affirmative duty of care that would allow data breach actions to recover damages recognized in common law negligence actions." Id. The trial court found the controlling factors of the Althaus test to be (1) the consequences of imposing a duty upon the actor, and (2) the overall public interest in the proposed solution. In this regard, the trial court observed that data breaches are widespread and frequent. The trial court further explained that, under Employees' proposed solution of creating a private *1041negligence cause of action to recover actual damages resulting from data breaches, "hundreds of thousands of lawsuits" could result, which would overwhelm the judicial system and require entities to expend substantial resources in defending against those actions. Id. at 6. Additionally, the trial court reasoned that there are no generally accepted reasonable care standards for evaluating one's conduct in protecting data, and that use of expert testimony and jury findings is not a viable method to develop those standards in data breach litigation. Id.
The trial court opined that it could not say with reasonable certainty that the best interests of society would be served through the recognition of a new affirmative duty under these circumstances, noting that the financial impact of doing so could put entities out of business. Id. at 7. The trial court further explained that entities storing confidential information already have an incentive to protect that information because any breach will affect their operations, that an improved system would not necessarily prevent a breach, and that the entities were also victims of the criminal activity involved. Id. at 7-8. Finally, the trial court observed that the Legislature is aware of and has considered the issues that Employees sought the court to consider herein as evidenced by the Breach of Personal Information Notification Act (Data Breach Act), 73 P.S. §§ 2301 - 2329. Specifically, the court explained that, under the Data Breach Act, the Legislature has imposed a duty on entities to provide notice of a data breach only, 73 P.S. § 2303, and given the Office of Attorney General the exclusive authority to bring an action for violation of the notification requirement, id. at § 2308. Trial Ct. Op., 5/28/2015, at 8-10. The court thus reasoned that, as public policy was a matter for the Legislature, it was not for the courts to alter the Legislature's direction.5 Id. at 10.
Employees appealed to the Superior Court. Relevant to the issues before this Court, Employees argued that the trial court erred in finding that UPMC did not owe a duty of reasonable care in its collection and storage of Employees' information, and that the economic loss doctrine barred their claim.
In a split opinion, a three-judge panel of the Superior Court affirmed the order of the trial court sustaining UPMC's preliminary objections and dismissing Employees' claims. Dittman v. UPMC , 154 A.3d 318 (Pa. Super. 2017). As to the issue of duty, the Superior Court applied the Althaus factors, concluding first that the relationship between the parties weighed in favor of imposing a duty on UPMC because the employer-employee relationship "traditionally has given rise to duties on the employer." Id. at 323. The court also reasoned that "[t]here is an obvious social utility" in electronically storing employees' personal information "to promote efficiency," which outweighed the nature of the risk imposed *1042and foreseeability of the harm incurred in so doing. Id. at 323-24. While the court noted that the general risk of storing information electronically increases as data breaches become more common and that data breaches and the ensuing harm were generally foreseeable, "more and more information is stored electronically" in the modern era and "employees and consumers alike derive substantial benefits from" the resulting efficiencies. Id. at 323. The court further observed that "a third party committing a crime is a superseding cause" against which "a defendant does not have a duty to guard ... unless he realized, or should have realized, the likelihood of such a situation."6 Id.
The Superior Court further agreed with the trial court's analysis of the fourth and fifth Althaus factors, the consequences of imposing a duty upon the actor and the overall public interest in the proposed solution, respectively. As to the fourth factor, the Superior Court added to the trial court's reasoning that no judicially created duty of care is needed to incentivize companies to protect their employees' confidential information because there are "statutes and safeguards in place to prevent employers from disclosing confidential information." Id. at 324 (citing, inter alia , the Data Breach Act). The Superior Court also found it "unnecessary to require employers to incur potentially significant costs to increase security measures when there was no true way to prevent data breaches altogether." Id. The court reasoned that "[e]mployers strive to run their businesses efficiently and they have incentive to protect employee information and prevent these types of occurrences." Id.
Thus, upon consideration of all of the Althaus factors, the Superior Court concluded that the trial court properly found that UPMC owed no duty to Employees under Pennsylvania law. Nevertheless, the Superior Court continued to examine whether the economic loss doctrine applied to bar Employees' negligence claim. Reiterating the generalized statement of the doctrine (i.e. , that "no cause of action exists for negligence that results solely in economic damages unaccompanied by physical injury or property damage"), the Superior Court opined that the trial court was correct in noting that the Bilt-Rite decision was meant to provide a narrow exception to the doctrine only when the losses result from the reliance on the advice of professionals. Id. at 325. The Superior Court further agreed with the trial court that the narrow exception did not apply to this case.7 Id.
Judge Stabile filed a concurring statement that Judge Olson, the author of the majority opinion, joined. Judge Stabile reasoned that the court's decision declining to find a legal duty should be limited to the facts as alleged in this case. Id. at 326 (Stabile, J., concurring). He further reasoned that the balance of the Althaus factors may change in favor of employees at some point in the future "with the evolution and increased use of" electronic storage of information. Id. at 327 (Stabile, J., concurring).
*1043Judge Musmanno wrote a dissenting statement concluding that, on balance, the Althaus factors weighed in favor of imposing a duty of reasonable care on UPMC. Specifically, Judge Musmanno challenged the majority's conclusion that the social utility of electronically storing employee information outweighed the risk and foreseeability of the harm, believing it to be "untenable, given the ubiquitous nature of electronic data storage, the risk to UPMC's employees posed by the failure to reasonably protect such information, and the foreseeability of a computer breach and subsequent identify theft." Id. at 328 (Musmanno, J., dissenting). Moreover, Judge Musmanno posited that Employees' "assertions, if proven, would establish that UPMC knew or should have realized that inadequate electronic data protections would create a likelihood that its employees' personal information would be compromised, and that a third party would avail itself of the opportunity to steal this sensitive data." Id. (Musmanno, J., dissenting). Further, Judge Musmanno reasoned that, "[u]nder the circumstances alleged, the criminal acts of third parties do not relieve UPMC of its duty of care in the protection of [Employees'] sensitive personal data." Id. (Musmanno, J., dissenting).
Judge Musmanno also disagreed with the majority's conclusion that the imposition of a duty of care is unnecessary to incentivize companies to protect their confidential information. Judge Musmanno noted that, while the majority declined to impose a duty due to the significant costs imposed upon employers and the inability to prevent every data breach, the Althaus test does not require that the proposed duty prevent all harm.8 Id. (Musmanno, J., dissenting). Judge Musmanno continued that, when considered against the cost to employees resulting from the data breach, the factor relating to the consequences of imposing a duty weighed in favor of imposing a duty. Id. (Musmanno, J., dissenting). Finally, Judge Musmanno disagreed with the majority's conclusion that the public interest in imposing a duty weighed in favor of UPMC, opining that, "[w]hile judicial resources may be expended during litigation of data breaches, the public has a greater interest in protecting the personal and sensitive data collected and electronically stored by employers." Id. at 328-29 (Musmanno, J., dissenting).
We granted allowance of appeal to address the following issues, as stated by Employees:
a. Does an employer have a legal duty to use reasonable care to safeguard sensitive personal information of its employees when the employer chooses to store such information on an internet accessible computer system?
b. Does the economic loss doctrine permit recovery for purely pecuniary damages which result from the breach of an independent legal duty arising under common law, as opposed to the breach of a contractual duty?
Dittman v. UPMC , 642 Pa. 572, 170 A.3d 1042 (2017) (per curiam ).
This matter presents pure questions of law, over which our standard of review is de novo , and our scope of review is plenary. Skotnicki v. Insurance Department , --- Pa. ----, 175 A.3d 239, 247 (2017). Further, as Employees' negligence claim was dismissed on preliminary objections in the nature of a demurrer, we must *1044determine "whether, on the facts averred, the law says with certainty that no recovery is possible." Bilt-Rite Contractors , 866 A.2d at 274. Any existing doubt as to whether a demurrer should be sustained should be resolved in favor of overruling it. Id. Additionally, we accept as true all material facts as set forth in the complaint and any inferences reasonably deducible therefrom in conducting our review. Id. at 272.
A. Duty
Employees contend that, in collecting and storing the sensitive personal and financial information it required Employees to provide, UPMC owed a duty to Employees to exercise reasonable care under the circumstances, which includes using reasonable measures to protect the information from the foreseeable risk of a data breach. In support of their position, Employees first argue that resort to the Althaus factors for purposes of determining the existence of a duty in this case is unnecessary. Specifically, Employees argue that the Althaus test applies only when determining whether to impose a new, affirmative duty not yet existing under common law, and not when a longstanding preexisting duty arises in a novel factual scenario. Employees' Brief at 14-15 (quoting Alderwoods (Pennsylvania), Inc. v. Duquesne Light Co. , 630 Pa. 45, 106 A.3d 27, 40 (2014) (explaining that, inter alia , the Althaus factors are "more relevant to the creation of new duties than to the vindication of existing ones") ). Employees contend that the trial court and Superior Court erred in treating their claim as one seeking the creation of a new, affirmative duty requiring application of the Althaus test, and in concluding that UPMC did not owe a duty. As further explained below, Employees claim that they instead seek to impose upon UPMC a duty of care long-established in Pennsylvania law under the novel facts of this case.
In support of their assertion, Employees argue that, as a general rule, "anyone who does an affirmative act is under a duty to others to exercise the care of a reasonable man to protect them against an unreasonable risk of harm to them arising out of the act." Employees' Brief at 17 (quoting Restatement (Second) of Torts § 302, cmt. a (1965) ). Employees claim that this is a broad expression of duty applicable to many forms of activity, even in novel factual scenarios with no direct precedent such as this one. Applying this broad expression of duty to the facts herein, Employees contend that UPMC engaged in the affirmative act of collecting Employees' sensitive personal data and storing it on their internet-accessible computer systems. Employees maintain that, in so doing, UPMC was under a duty to them to exercise reasonable care under the circumstances, which includes taking reasonable measures to protect them from the foreseeable risk that third parties would attempt to access and pilfer that information. Thus, Employees claim that they are alleging misfeasance on behalf of UPMC in collecting and storing Employees' sensitive personal data.
Employees further contend that this broad duty is limited by the concept of foreseeability.9 With respect to foreseeability, Employees argue that troves of electronic data stored on internet-accessible computers held by large entities are obvious *1045targets for cyber criminals and that a reasonable entity in UPMC's position should foresee that a failure to use basic security measures can lead to exposure of the data and serious financial consequences for the victims. Employees thus claim that, in light of the prevalence of electronic data storage in the employment context and the foreseeable risk of breaches of such data, it is appropriate to require employers to use reasonable care when handling and storing employee data in order to protect it from compromise. Employees argue that there is no sound justification for exempting employers from a duty to act with reasonable care when they collect and store employees' sensitive personal information.
Finally, Employees contend that the fact that the ultimate harm in this case resulted from criminal activity does not eviscerate the duty UPMC owed to Employees to handle its collection and storage of employee data with reasonable care. Employees acknowledge that one generally does not owe a duty to others to protect them against criminal conduct. Employees contend, however, that there are many exceptions to this rule and that the duty to take reasonable anticipatory measures against foreseeable criminal conduct in certain scenarios has deep roots in common law. Employees' Brief at 22-24 (relying upon Sections 302 and 302B of the Restatement (Second) of Torts and Comment E thereto, discussed infra ).
In response, UPMC challenges Employees' assertion that it assumed a legal duty to protect against a criminal data breach through commission of an affirmative act. UPMC contends that it merely possessed employee information incident to a general employment relationship, which cannot constitute an affirmative act that entails legal liability for third-party criminal conduct. UPMC notes that it is not in the business of providing data security, was not retained to provide data security, was not otherwise tasked with providing data security, and never pursued such an undertaking.
Indeed, according to UPMC, Employees are not claiming any affirmative misfeasance on UPMC's part but, rather, nonfeasance in that UPMC failed to prevent the harm incurred or some speculative future harm. In that regard, UPMC notes that there is a "no-duty rule in rescue/protection scenarios where the defendant did not create the risk resulting in harm to the plaintiff." UPMC's Brief at 45 (quoting Seebold v. Prison Health Services, Inc. , 618 Pa. 632, 57 A.3d 1232, 1246 (2012) ). UPMC contends that "[i]t is nonsensical to suggest that [it] created the risk of harm from a criminal data breach[ ] simply by possessing employee data" and its business neither increased the risk of criminal activity nor posed a special danger to the public regarding unshielded data. Id. at 45, 50-51. UPMC contends that third party criminality, not any affirmative conduct on UPMC's part, created the risk of harm and that it cannot be held liable for an external criminal hack merely because of the general prevalence or conceivable risk of data breaches. UPMC further argues that a third-party criminal act is a superseding cause of the resulting harm and should not be deemed "foreseeable by a negligent actor merely because he or she could have speculated that they might conceivably occur." Id. at 51 (citing, inter alia , Ford v. Jeffries , 474 Pa. 588, 379 A.2d 111, 115 (1977), and Mahan v. Am-Gard, Inc. , 841 A.2d 1052, 1061 (Pa. Super. 2003) ).
UPMC thus argues that Employees "are proposing a radical reconstruction of duty" where they seek to impose liability on UPMC for the criminal acts of unknown third parties. Id. at 45. UPMC contends that the decision to impose a legal duty *1046requires a policy determination, made through analysis of the Althaus factors, regarding whether a plaintiff is entitled to recover from a defendant for a particular harm on particular facts. UPMC further claims that, as recognized by the courts below, policy considerations do not permit Employees' recovery in negligence in this case under both an Althaus analysis and the economic loss doctrine, and numerous other jurisdictions have likewise declined to adopt that duty. UPMC contends that, having failed below to establish an exception to the economic loss doctrine or a legal duty under Althaus , Employees now seek to ignore the requisite policy analysis and instead make the specious claim that UPMC owes them a duty under general negligence principles. UPMC contends that no general rule of negligence can subject them to liability for third-party criminal conduct and claims that to subject all Pennsylvania companies that store employee data to liability for criminal data breaches is untenable and against the lower courts' policy determination pursuant to Althaus that no such duty be imposed.10
Having considered the parties' arguments, we agree with Employees that this case is one involving application of an existing duty to a novel factual scenario, as opposed to the imposition of a new, affirmative duty requiring analysis of the Althaus factors. As Employees set forth in their brief, this Court observed in Alderwoods that the Althaus factors are "more relevant to the creation of new duties than to the vindication of existing ones." Alderwoods , 106 A.3d at 40. This Court further explained that it is unnecessary "to conduct a full-blown public policy assessment in every instance in which a longstanding duty imposed on members of the public at large arises in a novel factual scenario. Common-law duties stated in general terms are framed in such fashion for the very reason that they have broad-scale application." Id. at 40-41 ; see also Scampone v. Highland Park Care Center, LLC , 618 Pa. 363, 57 A.3d 582, 599 (2012) ("Like any other cause of action at common law, negligence evolves through either directly applicable decisional law or by analogy, meaning that a defendant is not categorically exempt from liability simply because appellate decisional law has not specifically addressed a theory of liability in a particular context.").
As for the common law duty at issue here, this Court has observed that "[i]n scenarios involving an actor's affirmative conduct, he is generally 'under a duty to others to exercise the care of a reasonable man to protect them against an unreasonable risk of harm to them arising out of the act." Seebold , 57 A.3d at 1246 (quoting Section 302 cmt. a of the Restatement *1047(Second) of Torts). The Seebold Court explained that "[t]his duty appropriately undergirds the vast expanse of tort claims in which a defendant's affirmative, risk-causing conduct is in issue." Id. Indeed, this Court noted that "many judicial opinions on the subject of negligence do not specifically address the duty element," not because they "fail to see duty as an element of negligence, but because they presume the existence of a duty where the defendant's conduct created a risk." Id. at 1246 n.21 (quoting Cardi & Green, Duty Wars , 81 S. CAL. L. REV. 671, 702 (2008) ).
Employees have alleged and, as the case is before us at the preliminary objection stage, we currently must accept as true that, as a condition of employment, UPMC required them to provide certain personal and financial information, which UPMC collected and stored on its internet-accessible computer system without use of adequate security measures, including proper encryption, adequate firewalls, and an adequate authentication protocol. These factual assertions plainly constitute affirmative conduct on the part of UPMC. Additionally, while UPMC is correct that, generally, "there is no duty to protect or rescue someone who is at risk on account of circumstances the defendant had no role in creating," id. at 1246, Employees have sufficiently alleged that UPMC's affirmative conduct created the risk of a data breach. Thus, we agree with Employees that, in collecting and storing Employees' data on its computer systems, UPMC owed Employees a duty to exercise reasonable care to protect them against an unreasonable risk of harm arising out of that act.
Further, to the extent that UPMC argues that the presence of third-party criminality in this case eliminates the duty it owes to Employees, we do not agree. As stated above, UPMC relies on selected portions of Ford and Mahan in support of its position that it cannot be liable for third-party criminal conduct that could "conceivably occur." However, as Ford more fully outlined:
The act of a third person in committing an intentional tort or crime is a superseding cause of harm to another resulting therefrom, although the actor's negligent conduct created a situation which afforded an opportunity to the third person to commit such a tort or crime, unless the actor at the time of his negligent conduct realized or should have realized the likelihood that such a situation might be created, and that a third person might avail himself of the opportunity to commit such a tort or crime.
Ford , 379 A.2d at 115 (quoting Section 448 of the Restatement (Second) of Torts (1965) ).11 Further, while the Superior *1048Court in Mahan observed that "the wrongful actions of a third party are not deemed to be foreseeable by a negligent actor merely because he or she could have speculated that they might conceivably occur," the court, citing Jeffries , acknowledged that liability could be found if the actor "realized or should have realized the likelihood that such a situation might be created and that a third person might avail himself of the opportunity to commit such a tort or crime." Mahan , 841 A.2d at 1061.12
Again, Employees allege that UPMC, their employer, undertook the collection and storage of their requested sensitive personal data without implementing adequate security measures to protect against data breaches, including encrypting data properly, establishing adequate firewalls, and implementing adequate authentication protocol. The alleged conditions surrounding UPMC's data collection and storage are such that a cybercriminal might take advantage of the vulnerabilities in UPMC's computer system and steal Employees' information; thus, the data breach was "within the scope of the risk created by" UPMC. See Ford , 379 A.2d at 115 (explaining that the dilapidated condition of the appellee's property, which had caught fire and damaged the appellant's neighboring property, "was such that third persons might avail themselves of the opportunity to commit a tort or crime" and that "such acts were within the scope of the risk created by the appellee"). Therefore, the criminal acts of third parties in executing the data breach do not alleviate UPMC of its duty to protect Employees' personal and financial information from that breach.
Based on the foregoing, we conclude that the lower courts erred in finding that UPMC did not owe a duty to Employees to exercise reasonable care in collecting and storing their personal and financial information on its computer systems. This conclusion notwithstanding, Employees' claim cannot proceed if we nonetheless hold that it is barred by the economic loss doctrine. Thus, we turn to our analysis of that doctrine.
B. The Economic Loss Doctrine
The crux of the dispute before us is whether the economic loss doctrine as applied in Pennsylvania precludes all negligence claims that seek to recover for purely economic damages, save for specifically delineated and narrow exceptions, or whether such claims are generally permitted provided that a plaintiff can establish a breach of a legal duty independent of any contractual duties existing between the parties. As evidenced throughout this opinion, much of the dispute in this regard *1049centers on the proper interpretation of our decisions in Bilt-Rite and Excavation Technologies , which form the basis of the parties' arguments and which we analyze in further detail below.
Beginning with the parties' contentions, Employees argue that courts have incorrectly read our decision in Bilt-Rite as merely permitting negligent misrepresentation claims under Section 552 of the Restatement (Second) of Torts, see infra at page 1051 n.17, as a narrow exception to an otherwise broad economic loss doctrine precluding all negligence claims for solely monetary harm. Employees claim that, under Bilt-Rite , the economic loss doctrine does not bar negligence-based tort claims involving purely financial harm, provided that the plaintiff establishes that the defendant owed a common law duty arising independently from any contract between the parties. Employees argue that the holding in Bilt-Rite did not rely or otherwise depend upon the particular legal duty imposed or tort alleged in that case and therefore was not limited in that manner.
Employees contend that Bilt-Rite 's iteration of the rule as they believe it should be interpreted is more coherent and precise than the general statement of the rule, "which fails to explain or reconcile a plethora of obvious 'exceptions.' " Employees' Brief at 51. Employees further argue that their interpretation of the doctrine, which focuses on the source of the duty, is consistent with the definition accepted by many states and scholars, and will reduce confusion and unjust deployment of the rule against legitimate tort claims while serving the rule's purpose of precluding those claims that seek to compensate parties for losses resulting from a breach of contractual duties. Employees thus contend that, here, we need only to reaffirm Bilt-Rite 's enunciation of the rule as stated by them and hold that it does not bar their negligence claim.
UPMC counters that the lower courts correctly held that the economic loss doctrine precludes Employees' negligence claim for monetary damages.13 UPMC argues that the economic loss doctrine is well-settled in Pennsylvania and broadly applies to bar negligence claims that result "solely in economic damages unaccompanied by physical injury or property damage." UPMC's Brief at 12, 14-15 (quoting Excavation Technologies, Inc. , 985 A.2d at 841 n.3 ). Relying upon Excavation Technologies , UPMC further interprets Bilt-Rite 's holding as creating a narrow exception to the broad economic loss doctrine for negligent misrepresentation claims under Section 552 of the Restatement (Second) of Torts that involve design professionals supplying information to others for pecuniary gain. UPMC claims that no Pennsylvania court has applied Employees' interpretation of Bilt-Rite in an action to recover purely economic damages under a common law negligence theory and argues that this Court already declined to expand Bilt-Rite in the manner Employees suggest in Excavation Technologies .
UPMC also claims that Employees, focusing upon "misleading dicta" in Bilt-Rite , argue for an improperly expansive interpretation of that case which would *1050effectively render the economic loss doctrine a nullity by exempting all common law negligence claims from its application.14 Id. at 16-18. UPMC contends that the language Employees rely upon from Bilt-Rite in support of their position "merely recognizes an uncontroversial aspect of tort law": that "financial damages may be recoverable under several specific torts [that include] financial detriment ... as an element of the tort itself." Id. at 18. UPMC argues that Employees' failure to distinguish between common law negligence and specific tort claims highlights the error in their argument.
UPMC argues that Employees' "tortured construction" of the economic loss doctrine "distills to the untenable proposition that our appellate courts have misconstrued the rule since its inception" and that accepting Employees' position would contravene the doctrine's purpose of preventing indeterminate liability. Id. at 12-13, 16 n.4. UPMC further maintains that the Third Circuit has already considered and rejected Employees' arguments regarding the contours of Pennsylvania's economic loss doctrine and Bilt-Rite 's holding, including in the context of computer information theft. Id. at 18-20 (citing, inter alia , Sovereign Bank v. BJ's Wholesale Club, Inc. , 533 F.3d 162, 178 (3d Cir. 2008) (opining that this Court in Bilt-Rite "simply carved out a narrow exception [to the economic loss doctrine] when losses result from the reliance on the advice of professionals") ). Additionally, UPMC claims that a majority of jurisdictions confronting data breach litigation have dismissed negligence claims in accord with the economic loss doctrine.15 ,16
*1051As the parties' arguments focus on this Court's decisions in Bilt-Rite (2005) and Excavation Technologies (2009), we begin with a summary of those cases. In Bilt-Rite , East Penn School District (District) entered into a contract with The Architectural Studio (TAS) for architectural services related to the design and construction of a new school. These services included the preparation of plans, drawings, and specifications that would be submitted to contractors for the purpose of preparing bids for the new school's construction. The District solicited bids from contractors for the project, including TAS's plans, drawings, and specifications in the bid documents supplied to the contractors. The District eventually awarded the contract to Bilt-Rite Contractors, Inc. (Bilt-Rite), and the District and Bilt-Rite entered into a contract for the project. The contract specifically referred to and incorporated by reference the plans, drawings, and specifications from TAS.
As part of the project, TAS's plans provided for the installation of certain systems that TAS "expressly represented could be installed and constructed through the use of normal and reasonable construction means and methods, using standard construction design tables." Bilt-Rite , 866 A.2d at 272. However, once Bilt-Rite began the work, it discovered that construction of the systems required it to employ special construction means, methods, and design tables, resulting in substantially increased construction costs. It thus "sued TAS on a theory of negligent misrepresentation under Section 552 of the Restatement (Second) of Torts,[17 ] claiming that TAS's specifications were false and/or misleading, and seeking damages for its increased construction costs." Id. at 272-73. TAS filed preliminary objections in the nature of a demurrer, arguing that " 'the economic loss doctrine,' which holds that a tort plaintiff cannot recover for purely economic losses" barred Bilt-Rite 's action and that TAS did not owe a duty to Bilt-Rite, with whom it had no contractual relationship. Id. at 273. The trial court sustained TAS's preliminary objections, and the Superior Court affirmed.
On appeal, this Court was presented with the issue of "whether a building contractor may maintain a negligent misrepresentation claim against an architect for alleged misrepresentations in the architect's plans for a public construction contract, where there was no privity of contract between the architect and the contractor, but the contractor reasonably *1052relied upon the misrepresentations in submitting its winning bid and consequently suffered purely economic damages as a result of that reliance." Id. at 272. In addressing that issue, this Court formally adopted Section 552 of the Restatement (Second) of Torts as the law in Pennsylvania for negligent misrepresentation claims involving those in the business of supplying information to others, such as an architect or design professional.18 Id. at 287. The Court noted that recovery was possible even if the third party had no direct contractual relationship with the supplier of the information, as "Section 552 negates any requirement of privity." Id.
Most importantly for our current purposes, with respect to application of the economic loss doctrine, the Court looked to the "reasoned approach to the rule" expressed by the South Carolina Supreme Court in Tommy L. Griffin Plumbing & Heating Co. v. Jordan, Jones & Goulding, Inc. , 320 S.C. 49, 463 S.E.2d 85 (1995), which observed that its
application of the "economic loss" rule maintains the dividing line between tort and contract while recognizing the realities of modern tort law. Purely "economic loss" may be recoverable under a variety of tort theories. The question, thus, is not whether the damages are physical or economic. Rather, the question of whether the plaintiff may maintain an action in tort for purely economic loss turns on the determination of the source of the duty plaintiff claims the defendant owed. A breach of a duty which arises under the provisions of a contract between the parties must be redressed under contract, and a tort action will not lie. A breach of duty arising independently of any contract duties between the parties, however, may support a tort action.
Id. at 287-88 (quoting Tommy L. Griffin Plumbing , 463 S.E.2d at 88 (footnote and citation omitted) ). The Tommy L. Griffin Plumbing Court listed libel and defamation, accountant malpractice, legal malpractice, and architect liability among the examples of tort actions for which purely economic loss is recoverable. Tommy L. Griffin Plumbing , 463 S.E.2d at 88 & n.2.
This Court in Bilt-Rite explained that, "[l]ike South Carolina, Pennsylvania has long recognized that purely economic losses are recoverable in a variety of tort actions including the professional malpractice actions noted by the South Carolina Supreme Court." Bilt-Rite Contractors , 866 A.2d at 288. It thus agreed that "a plaintiff is not barred from recovering economic losses simply because the action sounds in tort rather than contract law." Id. In so doing, the Court noted that Bilt-Rite had no contractual relationship with TAS and thus, recovery under a contract theory was unavailable. However, because Bilt-Rite stated a viable claim for negligent misrepresentation under Section 552, which did not require privity, "logic dictate[d] that Bilt-Rite not be barred from recovering the damages it incurred, if proven."19 Id. The Court therefore held that the economic loss doctrine was inapplicable *1053to negligent representation claims arising under Section 552. Id.
Following Bilt-Rite , this Court decided Excavation Technologies . In that case, Excavation Technologies, Inc. (Excavation Technologies) requested that Columbia Gas Company of Pennsylvania (Columbia) mark the locations of gas lines around work sites pursuant to the One Call Act.20 Columbia improperly marked some lines and failed to mark others, resulting in Excavation Technologies striking various gas lines, which in turn hampered its work and caused it economic damages. Based on the foregoing, Excavation Technologies sued Columbia on a theory of negligent misrepresentation under Section 552 of the Restatement (Second) of Torts, alleging that Columbia failed to comply with its duties under the One Call Act. In response, Columbia filed preliminary objections in the nature of a demurrer, claiming that the economic loss doctrine precluded liability. The trial court sustained Columbia's preliminary objections, and the Superior Court affirmed.
This Court granted review to decide "whether [Section] 552 of the Restatement (Second) of Torts [see supra at page 1051 n.17] imposes liability for economic losses to a contractor caused when a gas utility company fails to mark or improperly marks the location of gas lines." Excavation Technologies , 985 A.2d at 842. In answering this question, the Court distinguished the case from Bilt-Rite on the basis that Columbia was "not in the business of providing information for pecuniary gain" and therefore concluded that Section 552(1) and (2) of the Restatement (Second) of Torts were inapplicable. Id. at 843. Additionally, the Court declined Excavation Technologies' invitation to impose liability under Section 552(3) of the Restatement (Second) of Torts, which was not at issue and thus not addressed by Bilt-Rite . The Court rejected the argument that Section 552(3) applied because Columbia was under a duty to provide accurate information as to the location of its underground lines. In support of its conclusion, the Court reasoned that: (1) the Act's purpose was to protect against physical harm and property damage, not economic losses; (2) excavators, and not utility companies, ultimately retained the duty to identify the precise location of facilities pursuant to the Act; and (3) public policy weighed against imposing liability, as the costs would inevitably be passed to the consumer if utility companies were exposed to liability for an excavators' economic losses.21 Id. at 844.
In addition to its analysis above, the Court concluded that there was no statutory basis to impose liability for economic losses. It is at this point the Court discussed the economic loss doctrine, which the Court previously defined in a footnote as providing that "no cause of action exists for negligence that results solely in economic damages unaccompanied by physical injury or property damage." Id. at 841 n.3 (quoting Adams v. Copper Beach Townhome Communities. L.P. , 816 A.2d 301, 305 (Pa. Super. 2003) ). The Court reasoned that the "economic loss doctrine was well-established in tort law when the [One Call] Act was enacted" and later amended. Id. at 842 (citing *1054Aikens v. Baltimore and Ohio Railroad Co. , 348 Pa.Super. 17, 501 A.2d 277 (1985), which noted that the roots of the economic loss doctrine were first recognized in Robins Dry Dock & Repair Co. v. Flint , 275 U.S. 303, 48 S.Ct. 134, 72 L.Ed. 290 (1927) ). The Court continued by explaining that "[t]he legislature was presumably aware of the economic loss doctrine when it established the statutory scheme governing the relationship among the entities required to participate under the Act," and found that "our legislature did not intend utility companies to be liable for economic harm caused by an inaccurate response under the Act, because it did not provide a private cause of action for economic losses." Id. at 842-43. In the context of this discussion, the Court cited In re Rodriguez , 587 Pa. 408, 900 A.2d 341, 345 (2003), for the proposition that "courts must assume [that the] legislature understands [the] legal landscape on which it enacts laws, and when [the] common law rule is not abrogated, they must assume it persists." Id. at 843.
Having set forth our decisions in Bilt-Rite and Excavation Technologies , we hold that those cases do not stand for the proposition that the economic loss doctrine, as applied in Pennsylvania, precludes all negligence claims seeking solely economic damages. Indeed, the Bilt-Rite Court unequivocally stated that "Pennsylvania has long recognized that purely economic losses are recoverable in a variety of tort actions" and that "a plaintiff is not barred from recovering economic losses simply because the action sounds in tort rather than contract law." Bilt-Rite , 866 A.2d at 288. In so doing, the Court set forth a "reasoned approach" to applying the economic loss doctrine that "turns on the determination of the source of the duty plaintiff claims the defendant owed." Id. (quoting Tommy L. Griffin Plumbing , 463 S.E.2d at 88 ). Specifically, if the duty arises under a contract between the parties, a tort action will not lie from a breach of that duty. However, if the duty arises independently of any contractual duties between the parties, then a breach of that duty may support a tort action. Id.
As stated above, the Bilt-Rite Court took this approach from the Supreme Court of South Carolina in the case of Tommy L. Griffin Plumbing. Notably, in Tommy L. Griffin Plumbing , the Supreme Court of South Carolina observed that "some states use the 'economic loss' rule to prohibit all recovery of purely economic damages in tort." Tommy L. Griffin Plumbing , 463 S.E.2d at 88. The South Carolina Supreme Court, however, rejected that approach in light of the fact that "[t]he law in South Carolina ... has long recognized tort actions when the damages are purely economic." Id. at 88 & n.2 (citing cases involving tort actions for purely economic damages, including architect liability, legal malpractice, accountant malpractice, and libel and defamation). In recognizing that Pennsylvania similarly "has long recognized that purely economic losses are recoverable in variety of tort actions," Bilt-Rite , 866 A.2d at 288, and accepting South Carolina's annunciation of the economic loss doctrine, this Court likewise rejected that approach.
As for UPMC's argument that Bilt-Rite merely created a narrow exception to the otherwise broad economic loss doctrine for negligent misrepresentation claims falling under Section 552 of the Restatement, we find that argument unpersuasive. The Bilt-Rite Court set forth the general approach to the economic loss doctrine as gleaned from the South Carolina Supreme Court above and noted that Pennsylvania permits recovery of purely economic losses in a variety of tort actions. The Bilt-Rite Court concluded that, because Bilt-Rite had stated a viable claim for negligent misrepresentation *1055under Section 552 of the Restatement, the economic loss doctrine did not bar its claim. In other words, Bilt-Rite held that a negligent misrepresentation claim made under Section 552 of the Restatement is one among many tort claims in Pennsylvania for which the economic loss doctrine does not act as a bar for recovery of purely economic losses.
Our reading of Excavation Technologies does not compel a different conclusion. As noted, the issue in that case was whether, under a theory of negligent misrepresentation pursuant to Section 552 of the Restatement (Second) of Torts, a utility is liable to a contractor for economic losses sustained when the utility fails to mark or improperly marks the location of gas lines pursuant to the One Call Act. In deciding that issue in the negative, the Court held that the contractor's claim did not fall under Section 552(1) and (2) of the Restatement (Second) of Torts and declined to impose liability under Section 552(3) of the Restatement. Thus, the Excavation Technologies Court did not hold that the economic loss doctrine barred Excavation Technologies' claim. Rather, it held that Excavation Technologies failed to state a viable claim for negligent misrepresentation under Section 552 of the Restatement in the first instance.
We acknowledge that the Excavation Technologies Court concluded that there was no statutory basis to impose liability on utility companies for economic losses under the One Call Act and, in so doing, included a broad definition and brief discussion of the economic loss doctrine. However, we find these observations to be ancillary not only to the Court's conclusion that the One Call Act did not provide for recovery of economic losses, but also to the Court's central holding that, in contrast to Bilt-Rite , the contractor failed to state a claim for negligent misrepresentation under Section 552 under the Restatement. Further, the Court supported its comments on the economic loss doctrine by citing nonbinding cases from the Superior Court that pre-date this Court's approach to the doctrine in Bilt-Rite . See Excavation Technologies , 985 A.2d at 841-43 & n.3 (quoting Adams , 816 A.2d at 305, and citing Aikens , 501 A.2d at 278-79 ).22 Indeed, *1056the Excavation Technologies Court did not discuss Bilt-Rite 's approach to the doctrine, set forth above, at all. Thus, to the extent Excavation Technologies can be interpreted as having any impact on the Court's expression of the rule under Bilt-Rite as we have now reaffirmed, we reject that interpretation.
Here, Employees have asserted that UPMC breached its common law duty to act with reasonable care in collecting and storing their personal and financial information on its computer systems. As this legal duty exists independently from any contractual obligations between the parties, the economic loss doctrine does not bar Employees' claim.
C. Conclusion
Based on the foregoing, we conclude that the courts below erred in determining that UPMC did not owe a duty to Employees to use reasonable care to safeguard their sensitive personal data in collecting and storing it on an internet-accessible computer system. We further hold that the lower courts erred in concluding that Pennsylvania's economic loss doctrine bars Employees' negligence claim. Accordingly, we vacate the judgment of the Superior Court, reverse the order of the trial court, and remand the matter to the trial court for further proceedings consistent with this opinion.
Justices Dougherty, Wecht and Mundy join the opinion.
Chief Justice Saylor files a concurring and dissenting opinion in which Justice Todd joins.
Justice Donohue did not participate in the consideration or decision of this matter.
I agree with the majority that Employees' negligence claim should not have been dismissed upon a demurrer, at the preliminary objection stage, contesting the legal sufficiency of the complaint. I respectfully differ, however, with material aspects of the majority's reasoning.
From my point of view, the claim in issue sounds in both contract and tort, thus presenting a hybrid scenario. In this regard, Employees' claim is expressly premised on the discrete relationship between employers and employees relative to confidential personal and financial information provided as a condition of employment . See Second Amended Class Action Complaint at ¶ 56. This suggests that the claim should be viewed through a contract lens. Nevertheless, Section 302B of the Second Restatement -- addressing the risk of intentional or criminal acts -- recognizes that duties arising out of contractual relationships may form the basis for tort liabilities. See Restatement (Second) § 302B, cmt. e (1965) ("There are ... situations in *1057which the actor, as a reasonable man, is required to anticipate and guard against the intentional, or even criminal, misconduct of others[,] ... including "[w]here, by contract or otherwise, the actor has undertaken a duty to protect the other against such misconduct"). See generally Snoparsky v. Baer , 439 Pa. 140, 145-46, 266 A.2d 707, 710 (1970) (referencing Section 302B favorably).1
Ultimately, I find that an employer who collects confidential personal and financial information from employees stands in such a special relationship to those employees with respect to that information, and I have no difficulty concluding that such a relationship should give rise to a duty of reasonable care to ensure the maintenance of appropriate confidentiality as against reasonably foreseeable criminal activity.2
This brings me to the economic loss doctrine. Initially, I respectfully differ with the majority's position that the doctrine should be essentially removed from the tort arena so long as the duty involved can be categorized as "existing independently from any contractual obligations between the parties." Majority Opinion, at 1056.3 In this regard, I note that the economic loss doctrine serves as a bulwark against uncontrolled liability. See, e.g. , Ultramares Corp. v. Touche , 255 N.Y. 170, 174 N.E. 441, 444 (1931) (Cardozo, C.J.) (warning against imposing liability "an indeterminate amount for an indeterminate time to an indeterminate class"). See generally Catherine M. Sharkey, Can Data Breach Claims Survive the Economic Loss Rule? , 66 DEPAUL L. REV. 339, 348-60 (2017) (depicting the application of the economic loss rule in the "stranger paradigm," where the actor has no preexisting contractual or special relationship with an injured victim). From my point of view, a proclamation negating the operation of the economic loss doctrine in the tort law arena is both unnecessary to the resolution of the present case and imprudent. Instead, particularly because of the hybrid nature of Employees' claim, I find that the applicability of the economic loss doctrine should be determined more by way of a discrete social policy assessment than as a matter of mere categorization.4
*1058In this regard, I am sympathetic to UPMC's concerns about exposure to litigation and the scale of the potential liability involved. Nevertheless, I would also be reluctant to hold that employers should be absolutely immune from liability for any sort of economic damages occasioned by negligent conduct on their part relative to the safeguarding of confidential personal and financial data. Along these lines, I note that some other courts have applied the economic loss doctrine to impose limitations on the scope of damages without foreclosing economic damages entirely. See, e.g. , Anderson v. Hannaford Bros. Co. , 659 F.3d 151, 162 (1st Cir. 2011) (discussing the availability, in Maine, of recovery for economic losses in the form of "mitigation damages," i.e. , recovery for costs and harms incurred during a reasonable effort to mitigate losses occasioned by computer data breaches). Although any such limitations are not directly in issue here, I strike the balance here in favor of permitting recovery of at least mitigation damages -- in the data breach context -- in instances in which an employee or employees prove that the employer has violated the duty to exercise reasonable care in protecting confidential personal and financial data.5
Finally, I appreciate that this matter of substantive tort law is more properly the domain of the Legislature. Nevertheless, I agree with the majority -- in the broadest frame -- that a pre-existing, traditional tort framework can be applied to the claim involved, and, again, I find that the economic loss doctrine, and other rational constraints, can be assessed in terms of the damages calculation for proven, wrongful conduct on an employer's part.6
In summary, while I concur in the majority's determination that Count I of the complaint should be reinstated, I respectfully dissent concerning the legal principles by which the majority undertakes to curtail the economic loss doctrine.
Justice Todd joins this concurring and dissenting opinion.