Courts Are Still Willing To Dismiss Data Breach Lawsuits for Lack of Standing

Raika Casey and Alexis Opper of BakerHostetler write:

In data breach litigation, courts generally find plaintiffs have standing such that their complaints may proceed past the pleading stage when it is alleged that sensitive information was impacted and there is an allegation of dark web exposure, misuse or fraud. However, a few courts have recently dismissed proposed data breach class actions despite these factors being alleged.

For example, in Maser v. CommonSpirit Health, a Colorado district court dismissed a proposed data breach class action, finding that the plaintiff failed to allege an injury-in-fact fairly traceable to the data breach despite allegations that she experienced bank fraud and a drop in her credit score. No. 1:23-cv-01073-RM-SBP (D. Colo. Dec. 4, 2024). Because the plaintiff’s bank information was not compromised in the breach and “none of the stolen data fields in and of themselves can enable fraud,” the court held that the alleged harms were not fairly traceable to the breach and, therefore, her other injury allegations were insufficient to support standing.