On June 21, 2019, the D.C. Circuit split with several other circuits in holding that alleging a heightened risk of identity theft following a data breach is enough to establish standing at the pleadings stage.

• The underlying data breach occurred in 2015 at the U.S. Office of Personnel Management and was allegedly carried out by sophisticated nation-state hackers.
• The plaintiffs alleged that some of the victims had already suffered identity theft, which strengthened the injury showing and potentially distinguishes this case from others.
• Nonetheless, the district court held that because there were no allegations of widespread identity theft or financial fraud, the mere risk of this harm in the future was too speculative to constitute an Article III injury.
• The D.C. Circuit disagreed, distinguishing opinions from the Fourth and Third Circuits, which both held that a bare risk of future identity theft did not confer standing. The D.C. Circuit pointed out that in those cases, the plaintiffs failed to allege that the data at issue had been specifically targeted for illicit use. Instead, the plaintiffs had merely alleged that the data was accessed. But here, the plaintiffs alleged the hackers intentionally targeted the data and misused it, which were “precisely the types of allegations missing” from the Fourth and Third Circuit cases.
• Judge Williams dissented in part, calling the plaintiff’s theory “garden-variety identity theft” that did not state a “plausible” injury. Judge Williams recounted record evidence suggesting that the data breach was carried out for espionage, not identity theft, and thus did not necessarily raise an inference that the plaintiffs were at risk of future harm. The judge also pointed to the lack of any allegations suggesting that identity theft risk was “higher-than-ordinary” for the victims.
• This decision deepens a fracture among the circuits on the issue of data breach standing. The Supreme Court recently declined to take up a case addressing this issue, but the growing split may cause the Court to take up the question soon.

Read the D.C. Circuit’s opinion here.