Court Rules That A Data Breach Does Not Count as Personal Injury.

A malware attack in 2013 resulted in the theft of as many as 1.1 million customers’ payment cards from retailer Neiman Marcus.  That data breach naturally led to fraudulent purchases, and tremendous fear about stolen identities and the potential theft of money. A lawsuit was filed on behalf of about 350,000 people whose data was stolen by the hacking attack. However, earlier this month, a federal court dismissed the claims, citing a failure to demonstrate injury.

Data stolen? “You’ll have to wait till you’re actually injured”

The main argument for dismissing the case, according to the court, is that there is no evidence that there is “certainly impending” risk of future injury.  Typically, there is a well-established principle that harm doesn’t have to have already occured in order to constitute injury-in-fact. It can be clear that harm will occur, and that’s sufficient. Basically, the judge said that it’s not clear that harm will occur, even though 9200 cards had already been used to make fraudulent purchases.

Here’s how the judge puts it:

First, it certainly permits the inference that these 9,200 customers did indeed have their data stolen as a result of the cyber-attack on Defendant. That is an injury in fact… Second, it permits a weaker, though in my view still plausible, inference that others among the 350,000 customers are at a “certainly impending” risk of seeing similar fraudulent charges appear on their credit cards as a result of the cyber-attack on Defendant… I do not believe, however, that this allegation permits a plausible inference that any of the 350,000 customers are at a “certainly impending” risk of the other future injury claimed by Plaintiffs — identity theft.

It is not clear to me that the “fraudulent charge” injury alleged to have been incurred by the 9,200 customers, or, a fortiori, the risk that the same injury may befall others among the 350,000 customers at issue, is an injury sufficient to confer standing. To satisfy their burden to establish standing, plaintiffs must show that their injury is concrete, particularized, and, if not actual, at least imminent.