In a seven-page opinion, the U.S. District Court for the Northern District of Illinois granted P.F. Chang’s motion to dismiss claims brought by two of its customers alleging that P.F. Chang’s failed to comply with reasonable security standards. The plaintiffs claimed damages stemming from P.F. Chang’s data breach that affected 33 of its restaurants in 18 states. U.S. District Judge John W. Darrah found that plaintiffs lacked standing and dismissed their claims.

Plaintiffs Lucas Kosner and John Lewert, P.F. Chang’s customers, filed lawsuits in the Northern District of Illinois alleging P.F. Chang’s breached an implied contract to protect their credit card information and violated the Illinois Consumer Fraud and Deceptive Business Practices Act. Plaintiffs alleged that P.F. Chang’s breached an implied contract to comply with industry- standard measures for safeguarding personal information and that, as a result of P.F. Chang’s lax security, plaintiffs overpaid for those services. Plaintiffs alleged damages from monetary losses arising from unauthorized bank account withdrawals and bank fees and lost opportunity costs to earn awards points while their debit cards were reissued. Plaintiffs also alleged damages arising from costs associated with identity theft and the increased risk of identity theft. The two lawsuits were consolidated, and P.F. Chang’s moved to dismiss the complaints on the basis that the plaintiffs failed to demonstrate standing.

The court found that plaintiffs’ lacked standing to claim that they overpaid for goods and services because plaintiffs did not allege that P.F. Chang’s charged a higher price for goods purchased with a credit or debit card. The court also found that in order for the plaintiffs to have suffered an actual injury with respect to fraudulent charges, they “must have had an unreimbursed charge on their credit or debit cards.” Plaintiffs’ allegation that they incurred lost opportunity costs because they were without their debit card for two to three days and could have accrued awards points was not a “cognizable injury.” Finally, the court disposed of plaintiffs’ claims that they were at an increased risk of identity theft as a result of the breach because “[s]peculation of future harm does not constitute actual injury.” Plaintiffs have filed a notice of appeal with the Seventh Circuit. 

For a copy of the December 10, 2014 order (Lewert, et al. v. P.F. Chang’s China Bistro, Inc., No. 14-cv-4923 (Dec. 10, 2014)), please click here.

Reporter, Sarah E. Statz, Atlanta, GA, +1 404 572 2813, sstatz@kslaw.com.