Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

In data breach litigation, courts generally find plaintiffs have standing such that their complaints may proceed past the pleading stage when it is alleged that sensitive information was impacted and there is an allegation of dark web exposure, misuse or fraud. However, a few courts have recently dismissed proposed data breach class actions despite these factors being alleged.

core/paragraph

For example, in Maser v. CommonSpirit Health, a Colorado district court dismissed a proposed data breach class action, finding that the plaintiff failed to allege an injury-in-fact fairly traceable to the data breach despite allegations that she experienced bank fraud and a drop in her credit score. No. 1:23-cv-01073-RM-SBP (D. Colo. Dec. 4, 2024). Because the plaintiff’s bank information was not compromised in the breach and “none of the stolen data fields in and of themselves can enable fraud,” the court held that the alleged harms were not fairly traceable to the breach and, therefore, her other injury allegations were insufficient to support standing. Similarly, an Arizona federal judge recently dismissed a proposed data breach class action, finding the plaintiffs failed to state a claim despite allegations that they suffered various specific damages, such as out-of-pocket losses and attempted or actual identity theft or fraud. Johnson et al. v. Yuma Regional Medical Ctr., No. CV-22-01061-PHX-SMB (D. Ariz. Nov. 15, 2024). The court held that the plaintiffs failed to allege they suffered cognizable injuries as a result of the breach and the defendant’s privacy policy made no promise to absolutely defend against such attacks.

Likewise, the Illinois Supreme Court recently issued its decision in Petta v. Christie Business Holding Co., P.C. affirming the appellate court’s dismissal for lack of standing, even though the plaintiff had alleged that an unauthorized loan application was made in her name using her phone number, city and state sometime after the data breach, because the plaintiff did not allege that any of her private, personally identifiable information (PII), such as her Social Security number, was used in the loan application or that it was impacted in the data breach. 2025 IL 130337 (2025). The court further found that the unsuccessful loan application was not “fairly traceable” to the defendant’s alleged misconduct, given that the information used in the loan application (the plaintiff’s phone number and city) could be found in a publicly available phone directory. Id.

This trend is not limited to these cases; rather, courts across the country have issued full dismissals where plaintiffs, despite alleging fraud or misuse, fail to allege a connection between the data incident and the alleged harm. See Stern v. Acad. Mortg. Corp., No. 2:24-CV-00015-DBB-DAO, 2025 WL 239036 (D. Utah Jan. 17, 2025) (dismissed for lack of standing despite allegations of a fraudulent loan made using the plaintiff’s PII because the plaintiff failed to show traceability between the data incident and the injury); Williams v. Bienville Orthopaedic Specialists, LLC, 737 F. Supp. 3d 411 (S.D. Miss. 2024) (no traceability and thus no standing despite allegations of actual fraud and data misuse, including unauthorized charges totaling around $17,000, reasoning “[d]ata breaches and other forms of data theft are so prevalent that it is seemingly impossible to trace the misuse of personal information to one particular breach”); McGowan v. Core Cashless, LLC, No. 2:23-CV-00524-MJH, 2024 WL 488318 (W.D. Pa. Feb. 8, 2024) (dismissed for lack of standing because injury was not imminent despite allegations that “card numbers [are] for sale on the Dark Web whose common purchase point was [defendant]” where the plaintiff failed to “plausibly show that her payment card information was misused by the unknown hackers.”); In re Samsung Data Sec. Breach Litig., No. 1:23-MD-03055, 2025 WL 271059 (D.N.J. Jan. 3, 2025) (dismissed for lack of standing despite the plaintiffs’ allegation that “they have been notified that their data is on the Dark Web,” because the plaintiffs did so “without specifying that it was the specific information that was obtained in this data breach versus information obtained elsewhere”). Thus, despite arguments from the plaintiffs’ bar, the motion to dismiss is very much alive and well in data breach litigation.

Courts Are Still Willing To Dismiss Data Breach Lawsuits for Lack of Standing