D.C. Circuit Supports Standing in Data Breach Class-Action Suit, Citing Substantial Risk of Future Identity Theft
On August 1, 2017, the U.S. Court of Appeals for the District of Columbia Circuit reversed the dismissal of a putative class action brought after health insurer CareFirst, Inc. suffered a cyberattack. The D.C. Circuit determined that the plaintiffs had standing to sue, because they had plausibly alleged a substantial risk of future identity theft due to the data breach. The decision in Attias, et al., v. CareFirst, Inc. puts the D.C. Circuit in line with the Sixth and Seventh Circuits in upholding standing for plaintiffs claiming injury in a data breach case but at odds with the Second and Fourth Circuit on the issue.