Data Breach Class Actions: Article III Standing, Negligence Claims, and Forensic Report Privilege

On December 19, 2019, the chief executive of the Wawa convenience store chain announced that malware had been running on the company's payment servers. The first lawsuit was filed on December 20. By January 8, fifteen actions had been consolidated in Philadelphia. The Third Circuit later described this, with a straight face, as a "race to the courthouse" that is common in "class action world." In re Wawa, Inc. Data Security Litigation, 141 F.4th 456 (3d Cir. 2025).

That is the normal pace. A company spends months investigating, then mails a letter that reads like a hostage note written by a compliance department, and within forty-eight hours a half dozen complaints quote the letter back at it. Then, a year or two later, the company learns that the forensic report it commissioned to find out what happened, the one everyone assumed was privileged because a lawyer's name was on the engagement letter, must be produced to the people suing it. In Capital One's case that report had gone to about fifty employees, the board, four regulators, and the outside accountant.

This article is about what happens after the letter. Our companion pieces on notification duties and the fifty-state patchwork and on the first seventy-two hours cover how to get the letter out the door. Here the question is who can sue, on what theory, in which court, with which documents, and how these cases end.

The short answer

• Standing is the main event, and the circuits now openly disagree. Everyone agrees that actual misuse of a plaintiff's data is an injury. The fight is over plaintiffs whose data was stolen and not yet used. The Second, First, Third, and D.C. Circuits are receptive when hackers targeted sensitive data. The Fourth Circuit, in Holmes v. Elephant Insurance Co., 156 F.4th 413 (4th Cir. 2025), demands much more, and it said so.
• Damages and injunctions are separate standing questions. After TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), risk alone can support forward-looking relief but not damages. Yet the injunction is often the first thing to go, because a security upgrade cannot pull stolen data back from the people who have it.
• Winning on standing in federal court may only change the courthouse. State courts are not bound by Article III, and a removed case with no standing gets remanded under 28 U.S.C. § 1447(c), not dismissed.
• On the merits, negligence usually survives a motion to dismiss now. High courts in Pennsylvania and Georgia have rejected the strongest no-duty and no-injury arguments. Implied contract is more fact-dependent and unjust enrichment is the most likely casualty.
• The forensic report is protected only if it is truly different from what the business would have done anyway. Counsel's letterhead has failed repeatedly. Courts look at the prior vendor contract, the scope of work, who paid, who received the report, and whether regulators required it.
• Class certification is hard for plaintiffs, and contracts matter. The Fourth Circuit reversed certification in the Marriott litigation on the strength of one class waiver clause in a loyalty program's terms.
• Most surviving cases settle, typically for reimbursement of documented losses, credit monitoring, security commitments, and fees, at claims rates that would embarrass a coupon mailer.

What a breach is, at the level that matters to a lawyer

Courts now decide standing by asking what the hacker took and what the hacker did next. Those are engineering facts, and they have legal names, so it helps to see them in order.

An intrusion usually begins with a stolen credential, a phishing email, or an unpatched server. CareFirst's breach began with a spear phishing email sent to 48 employees; about half a dozen clicked and five ran the malware. Attias v. CareFirst, Inc., No. 15-cv-882 (D.D.C. Sept. 13, 2023). The attacker then moves laterally through the network, a phase whose length is called dwell time (the period between entry and detection). At Wawa, the malware ran from March 4 until December 2019.

The next distinction drives both statutes and standing. Access means the intruder could see or reach the data. Exfiltration means the intruder copied it off the network. Logs may prove the first and say nothing about the second, and the logs themselves often expire before anyone looks. California's private right of action, for instance, requires "unauthorized access and exfiltration, theft, or disclosure." Cal. Civ. Code § 1798.150(a)(1). A forensic firm that writes "may have been accessed" in a report has written a legal conclusion whether it meant to or not.

Then comes monetization. Payment card thieves may install a skimmer on a point-of-sale system or inject code into a checkout page (a "Magecart" attack, which is what plaintiffs alleged in In re Warner Music Group Data Breach, No. 20 Civ. 7473 (S.D.N.Y. Sept. 3, 2025)). Cards are then sold in bulk on a dark web market. Wawa's turned up on Joker's Stash, and so did the Chili's cards in Green-Cooper v. Brinker International, Inc., 73 F.4th 883 (11th Cir. 2023). Ransomware crews work differently. They encrypt the victim's files and threaten to publish what they copied on their own leak site, which is what the CLOP group did in Clemens v. ExecuPharm Inc., 48 F.4th 146 (3d Cir. 2022). The dark web, as the Fourth Circuit explained, is an anonymous network accessible to anyone with some technical proficiency, and listings there may be free or paywalled.

Finally, data types differ in shelf life. A card number can be cancelled in a phone call. A driver's license number changes when you move or renew. A Social Security number generally stays with you for life, as the Third Circuit noted in Clemens. Every serious standing opinion turns partly on this hierarchy, and a defense lawyer who treats all "personal information" as one thing, or a plaintiff's lawyer who does the same, will lose an argument that was available.

The Supreme Court's three standing cases

Article III limits federal courts to cases and controversies, which means a plaintiff must show an injury in fact (concrete, particularized, and actual or imminent), caused by the defendant, and redressable by the court. Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992). Data breach litigation has produced a mountain of lower court opinions because the Supreme Court has never decided a data breach standing case. Judge Jordan, concurring in a 2021 Eleventh Circuit case discussed below, hoped out loud that the Court would take one. It still has not. Three non-breach cases do the work.

Clapper: future harm and self-inflicted costs

Clapper v. Amnesty International USA, 568 U.S. 398 (2013), was a challenge to foreign surveillance authority by lawyers and activists who feared their calls would be intercepted. The Court held that future injury must be "certainly impending," rejected an "objectively reasonable likelihood" test, and refused to count money spent on precautions because plaintiffs cannot manufacture standing by harming themselves in response to speculative fears. A footnote left room for the "substantial risk" formulation. Defendants have quoted the manufacture line in every breach case since, and the debate has been whether a completed theft by a criminal looks anything like the chain of guesses in Clapper.

The Court has since treated "certainly impending" and "substantial risk" as one idea, using the second phrase, and in Murthy v. Missouri, 603 U.S. 43 (2024), asked whether independent third parties would react in predictable ways. The Fourth Circuit reads that as the current gloss.

Spokeo: a statutory violation is not enough

Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), held that a plaintiff cannot satisfy Article III by alleging a bare procedural violation of a statute. Intangible harm can be concrete, and courts look to history and to Congress's judgment. In breach terms, a violation of a notification statute or a security statute does not by itself open the federal courthouse. The Fourth Circuit applied the same logic to a state privacy statute in O'Leary v. TrustedID, Inc., 60 F.4th 240 (4th Cir. 2023), where a consumer typed six digits of his Social Security number into a website and could connect the statutory violation to identity theft only through what the court called a Rube Goldberg-type chain reaction.

TransUnion: the risk that never materializes

TransUnion is the case every breach brief now starts with. TransUnion's product flagged consumers as potential matches to a Treasury Department list of national security threats, comparing nothing but first and last names. A class of 8,185 won a verdict under the Fair Credit Reporting Act. The Court split the class. The 1,853 members whose reports had been sent to third parties suffered a harm with a close common-law relationship to defamation. The other 6,332, whose misleading alerts sat in internal files, had no concrete harm, because a defamatory letter stored in a desk drawer hurts nobody. "No concrete harm, no standing."

Three passages matter for breaches:

1. The Court named "disclosure of private information" and "intrusion upon seclusion" as intangible harms traditionally recognized. Plaintiffs build on that list.
2. A person exposed to a risk of future harm may seek forward-looking relief if the risk is sufficiently imminent and substantial, but in a suit for damages, the mere risk does not suffice unless the exposure itself caused a separate concrete harm.
3. A footnote took no position on whether emotional harm from knowing about the risk would count. The same opinion reserved whether every class member must show standing before certification.

Each of those three sentences has since become a circuit split or the beginning of one.

How the circuits read it

The early generous line

The Ninth Circuit found a credible threat of harm in 2010 when a laptop holding Starbucks employees' unencrypted names, addresses, and Social Security numbers was stolen. Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir. 2010). After Clapper, it held in In re Zappos.com, Inc., 888 F.3d 1020 (9th Cir. 2018), that Krottner survived, and it treated Zappos's own advice that customers change similar passwords elsewhere as a kind of acknowledgment of the danger. That detail should interest anyone drafting a notice letter.

The Seventh Circuit gave the line its most quoted sentence in Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688 (7th Cir. 2015): "Why else would hackers break into a store's database and steal consumers' private information?" Some 9,200 cards had already seen fraudulent charges, and the plaintiffs' mitigation costs counted because the threat was not hypothetical. The court was openly dubious of the softer theories, such as overpaying for merchandise because the store skimped on security. Lewert v. P.F. Chang's China Bistro, Inc., 819 F.3d 963 (7th Cir. 2016), followed. The D.C. Circuit agreed in Attias v. CareFirst, Inc., 865 F.3d 620 (D.C. Cir. 2017), which distinguished Clapper with the line plaintiffs love: "No long sequence of uncertain contingencies involving multiple independent actors has to occur." It added that traceability does not require the defendant to be the most immediate cause; the hacker's crime does not break the chain for Article III purposes. The same court extended the reasoning to the 21 million people in the OPM hack in In re U.S. Office of Personnel Management Data Security Breach Litigation, 928 F.3d 42 (D.C. Cir. 2019). The Sixth Circuit reached the same place in an unpublished decision, Galaria v. Nationwide Mutual Insurance Co., 663 F. App'x 384 (6th Cir. 2016), reasoning that it would be unreasonable to expect people who know they have lost control of their data to wait for a fraudulent charge before acting, particularly when the defendant told them to act.

The skeptical line

The Third Circuit's Reilly v. Ceridian Corp., 664 F.3d 38 (3d Cir. 2011), involved a payroll processor and an unknown hacker, and the court could not describe the harm without beginning with the word "if." The Fourth Circuit's Beck v. McDonald, 848 F.3d 262 (4th Cir. 2017), involved a stolen laptop and four missing boxes of pathology reports at a veterans' hospital, with no evidence anyone wanted the data. Beck held that even crediting a statistic that 33 percent of affected people would suffer identity theft, that left over 66 percent unharmed, and "falls far short." It also refused to infer risk from an offer of free credit monitoring, reasoning that such an inference would discourage companies from offering it. Hutton v. National Board of Examiners in Optometry, Inc., 892 F.3d 613 (4th Cir. 2018), is Beck's other half: when optometrists around the country discovered fraudulent card accounts opened in their names, using correct Social Security numbers and birth dates, and traced the common source to the licensing board, they had standing.

Card-only breaches fared worst. In Alleruzzo v. SuperValu, Inc. (In re SuperValu), 870 F.3d 763 (8th Cir. 2017), the Eighth Circuit found no substantial risk of identity theft from stolen card data alone, while allowing one plaintiff with a fraudulent charge to proceed. On remand and a second appeal, that plaintiff's claims failed under Rule 12(b)(6) anyway, including an unjust enrichment theory, because he paid no premium for security when he bought groceries. Alleruzzo v. SuperValu, Inc. (In re SuperValu), 925 F.3d 955 (8th Cir. 2019). The Second Circuit found no injury where a card was presented for two attempted charges, the plaintiff alleged no charge she had to pay, and she cancelled the card, in Whalen v. Michaels Stores, Inc., 689 F. App'x 89 (2d Cir. 2017). The Eleventh Circuit agreed in Tsao v. Captiva MVP Restaurant Partners, LLC, 986 F.3d 1332 (11th Cir. 2021), which held that a plaintiff "cannot manufacture standing" by cancelling cards and losing rewards points, and that without some misuse of class members' data the burden will be difficult to meet. In the Second Circuit, McMorris v. Carlos Lopez & Associates, LLC, 995 F.3d 295 (2d Cir. 2021), produced the framework most courts now use, even though the plaintiffs lost: their data had gone out in an errant email to about 65 coworkers, with no one outside the company involved.

The McMorris factors

McMorris asks three non-exhaustive questions: whether the data was exposed through a targeted attempt to obtain it; whether any portion of the dataset has already been misused, even if the plaintiff's has not; and whether the data is sensitive enough to create a high risk of fraud. It also states the rule on mitigation that most circuits accept. Where a substantial risk exists, reasonable mitigation costs are an injury. Where it does not, they are not.

After TransUnion: the four appellate answers

The real action since 2021 is how courts fit the McMorris factors into TransUnion's demand for concreteness.

The Third Circuit (Clemens). CLOP stole an employee's data by phishing, demanded ransom, and posted the files on the dark web. The court adopted guideposts similar to McMorris, though in a footnote it said the inquiry should focus on misuse of the plaintiff's own information, disagreeing with McMorris on that point. On concreteness, it held that a plaintiff suing for damages satisfies TransUnion if the exposure to a substantial risk caused additional, currently felt harms, such as emotional distress or money spent on monitoring. No other circuit has said it so plainly.

The First Circuit. In Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365 (1st Cir. 2023), hackers took 75,000 patients' data. One plaintiff had a fraudulent tax return filed in her name, which the court held plausibly traceable to the breach. Both plaintiffs had standing to seek damages on a risk theory because they lost time taking protective measures, and lost time is equivalent to a monetary injury. The court did not reach emotional distress. It then held that neither had standing for an injunction, since better security cannot retrieve what the thieves already have, and the plaintiffs' own allegation that the pharmacy had improved its safeguards undercut any inference of a second breach.

The Eleventh Circuit. Brinker turned the Tsao requirement of "misuse" into something plaintiffs could actually meet. The hackers posted 4.5 million cards for sale on Joker Stash, and that posting was the misuse: a present injury of card data floating around on the dark web and a substantial risk of more. The court also rejected two named plaintiffs whose restaurant visits fell outside the at-risk window, a reminder that traceability can be checked with a calendar. The court also read TransUnion's common-law analogue test as confined to statutory violations and adhered to Tsao, while Clemens, Bohnak, and Holmes all apply the analogy to state common-law claims.

The Second Circuit. Bohnak v. Marsh & McLennan Cos., 79 F.4th 276 (2d Cir. 2023), is the cleanest synthesis: TransUnion governs concreteness, McMorris governs imminence. A former employee whose name and Social Security number were taken in a targeted hack had a concrete injury because exposure to an unauthorized actor "bears some relationship" to the tort of public disclosure of private facts, the analog need not be an exact duplicate, and she had separately incurred out-of-pocket and lost-time harms. The court also held that once she had standing, her damages allegations were enough under Rule 12(b)(6). The Seventh Circuit had said something similar about pleading damages in Dieffenbach v. Barnes & Noble, Inc., 887 F.3d 826 (7th Cir. 2018), calling a contrary dismissal "a new label for an old error."

Holmes: the Fourth Circuit breaks away

Holmes is the most important standing decision of the last several years and the one this article would lead with if it were written only for defendants. The facts are engineering-flavored. Elephant Insurance's online quoting tool auto-populated driver's license numbers once someone typed in a name, address, and birth date. Hackers allegedly fed it public information and harvested nearly 3 million license numbers. Two of the four named plaintiffs found their numbers on the dark web. All four spent time monitoring their finances. Two claimed fear and stress. The panel, through Judge Richardson, reached four holdings.

First, publicity is required. The public-disclosure tort makes concrete the intangible harm when information a person would justifiably keep tightly controlled is released into the open. It need not be embarrassing, so license numbers qualify, and the Fourth Circuit expressly disagreed with the Seventh Circuit's Baysal v. Midvale Indemnity Co., 78 F.4th 976 (7th Cir. 2023), on sensitivity. But the information must be accessible to many. A hacker's private knowledge is different in kind, not degree. So the two plaintiffs whose numbers were on the dark web had a concrete injury, paywall or no paywall, and the two others had none. On that point the panel said it was joining the First, Second, and Third Circuits. Its treatment of the other two plaintiffs is a direct contrast with Bohnak, where access by an unauthorized actor was enough.

Second, future misuse was not imminent even for the dark web plaintiffs. Citing Beck, the court said the probability needed for substantial risk is at least 33 percent and presumably higher, and that plaintiffs must allege facts showing the combined probability of a speculative chain: an identity thief must find this number, combine it with other data, and use it before the license changes. Then the opinion says the quiet part aloud. It lists Bohnak, Webb, Attias, Remijas, and others, says those courts did not run through the chain of independent events, and suggests they implicitly applied the looser standard the Clapper dissent urged. "The plaintiffs may have alleged enough," the panel wrote, before other courts. Not before this one.

Third, no injunction. Applying City of Los Angeles v. Lyons, 461 U.S. 95 (1983), the court saw no imminent second breach.

Fourth, time and distress cannot stand alone. Assuming they are concrete, they support damages standing only when incurred in response to a separate imminent harm. Tort law treats emotional distress as parasitic on another injury, and a plaintiff could otherwise conjure standing from nothing. That collides with Clemens and sits uneasily beside Webb.

The result for the two successful plaintiffs is itself strange: they can seek damages for the publicity injury, but no other relief. Elephant's petition for certiorari (No. 25-1085) was dismissed on May 21, 2026, on the parties' joint motion under Supreme Court Rule 46, so the split stands. Courts are applying it strictly. In In re Drivestream, Inc. Data Breach Litigation, No. 1:26-cv-00713 (E.D. Va. Aug. 21, 2026), the Akira ransomware group announced it was ready to upload 80 gigabytes including Social Security numbers, the plaintiffs alleged publication on information and belief, and the court dismissed because they had not found their own data on the leak site. The company's notice letter, stating no indication of misuse, was attached to the complaint and used against them. In re Healthcare Interactive, Inc. Data Breach Litigation, No. SAG-25-4034 (D. Md. Aug. 27, 2026), reasoned similarly about bare allegations that data will be published imminently.

Compare what happened a few weeks later in Atlanta. In In re Young Consulting Data Breach Litigation, No. 1:24-cv-3938 (N.D. Ga. Sept. 15, 2026), the court held under Brinker that three plaintiffs' dark web alerts supported the risk for the others too. Forum, in other words, can decide the case before anyone reads the complaint's merits counts.

A side-by-side

The smaller injury theories

Lost value of data. Courts are unimpressed unless a plaintiff alleges an actual market loss. Healthcare Interactive rejected the theory because no one alleged trying to sell their information at a depressed price.

Benefit of the bargain and overpayment. Remijas doubted it and Dieffenbach said failing to obtain a gain is not a loss, at least where no particular level of security was promised and paid for. It came closest to working in Marriott, where a court accepted an expert's overpayment model for hotel room rates, discussed below.

Spam. The Fourth Circuit treated an uptick in spam as untraceable where phone numbers were not in the stolen dataset, and Drivestream followed suit. In In re Union Home Mortgage Corp. Data Breach Litigation, No. 1:25-cv-01874 (N.D. Ohio Sept. 28, 2026), by contrast, the court found spam calls and texts an injury in fact, drawing on Sixth Circuit unwanted-call precedent. Plaintiffs in that circuit now plead spam first.

Worked hypothetical: one breach, two forums. Suppose Quillfeather Payroll, a mid-size payroll processor, is hit by a ransomware crew. The crew steals names, Social Security numbers, and bank account numbers for 400,000 workers, then posts a sample on its leak site. Dana, in Baltimore, finds her record in the sample. Luis, in Brooklyn, does not, but he spends twelve hours freezing his credit and pays for a monitoring service. Under Holmes, Dana has a concrete publicity injury and a damages claim limited to it, with no injunction. Luis has nothing in Maryland federal court unless he can show a greater than one-in-three chance of misuse specific to him. Under Bohnak, Luis has a targeted attack, sensitive data, and misuse in the dataset, plus out-of-pocket mitigation, and he clears the bar comfortably. The same complaint, filed the same day, produces two different cases. The lawyers on each side will spend real money on that fact, and Quillfeather's choice to consent or object to an MDL forum suddenly has constitutional stakes.

The remand trap and the state courts

A standing win has a catch that surprises business clients. A dismissal for lack of standing is without prejudice, as Tsao notes. And Article III does not bind state courts. When a defendant removes under the Class Action Fairness Act (CAFA), 28 U.S.C. § 1332(d), and then argues there is no standing, the correct remedy for a removed case is remand, not dismissal. Polo v. Innoventions International, LLC, 833 F.3d 1193 (9th Cir. 2016). For how this plays out in removal practice, see CAFA Jurisdiction and Class Action Removal.

Plaintiffs can use that. They may file in state court on purpose, leaving the defendant to choose between staying there or removing and then asserting federal jurisdiction it may have to prove. State law may be friendlier as well. Georgia's Supreme Court in Collins v. Athens Orthopedic Clinic, P.A., 307 Ga. 555 (2019), held that patients whose data a hacker stole and offered for sale had alleged a legally cognizable injury in negligence, setting the case apart from earlier decisions in which nothing showed the data had reached criminal hands. The Georgia Court of Appeals followed in Bland v. Urology of Greater Atlanta, LLC, No. A25A1133 (Ga. Ct. App. Oct. 6, 2025), reversing a dismissal of negligence and implied contract claims and stressing that Georgia's pleading test is harder on movants than the federal one. The bottom line for defendants is to think about where the case goes after the federal win, because the win is sometimes hollow.

Standing doctrine generally is covered in Article III Standing After TransUnion.

Theories of liability

Complaints usually plead everything: negligence, negligence per se, implied contract, unjust enrichment, invasion of privacy, breach of fiduciary duty, state consumer statutes, and, when California residents are involved, the California Consumer Privacy Act (CCPA). The opinions tend to prune rather than clear-cut.

Negligence: duty

Is there a duty to protect data from criminals? The leading answer is Dittman v. UPMC, 196 A.3d 1036 (Pa. 2018). Hackers stole the data of all 62,000 UPMC employees. The Pennsylvania Supreme Court held that an employer has a legal duty to use reasonable care to safeguard employees' sensitive information stored on an internet-accessible system, because the employer's own conduct in collecting and storing it created the risk. The third-party criminal did not eliminate the duty.

The trial court in Dittman had made the policy objection in its best form: breaches are so common that hundreds of thousands of suits could follow, and no standards exist for judging data security. That argument lost in Pennsylvania. It has sometimes won elsewhere, but the trend is against it. Ramirez v. Paradies Shops, LLC, 69 F.4th 1213 (11th Cir. 2023), reversed a dismissal under Georgia law where a former employee's Social Security number was used for fraudulent unemployment claims. Keeping tens of thousands of people's unencrypted data in an internet-accessible database created a potentially dangerous situation, the court reasoned, and the employment relationship meant the parties were not strangers. It added that summary judgment "may prove a tougher challenge." In re Equifax, Inc. Customer Data Security Breach Litigation, 362 F. Supp. 3d 1295 (N.D. Ga. 2019), found a duty based on foreseeability given earlier well-publicized breaches.

The newest question is vendors. Plaintiffs rarely have a relationship with the cloud provider that was actually hacked. In In re Salesforce Customers Security Incident Litigation, No. 25-cv-07232 (N.D. Cal. Sept. 14, 2026), the court rejected the argument that a special relationship is required under California law, because the claim is that the defendant's own conduct created the risk. The choice-of-law question was deferred, as it often is.

Negligence: the economic loss rule

The economic loss rule generally says purely financial harm is recoverable in contract, not tort. It exists because tort liability for pure economic loss can spread without limit and because parties who can contract should allocate risk themselves. Data breach losses are nearly always economic, so the rule should matter, and sometimes does.

Dittman refused to apply it where the duty arises independently of any contract, rejecting the lower courts' reading of the doctrine as a near-blanket bar. Equifax reached the same result via Georgia's independent duty exception. Texas is less settled; in In re Gulshan Management Services Data Breach Litigation, No. H-26-200 (S.D. Tex. June 29, 2026), the court walked through competing frameworks and also dismissed emotional distress damages without prejudice.

The rule bites hardest when the plaintiffs are businesses. In Community Bank of Trenton v. Schnuck Markets, Inc., 887 F.3d 803 (7th Cir. 2018), card-issuing banks sued a grocery chain for the cost of reissuing cards. The Seventh Circuit, predicting Illinois and Missouri law, affirmed dismissal because banks and merchants sit inside a web of card network contracts that already allocates the risk. It noted a different outcome in Lone Star National Bank, N.A. v. Heartland Payment Systems, Inc., 729 F.3d 421 (5th Cir. 2013), under New Jersey law. So financial institution tracks, like the one in the Wawa litigation, operate under different rules from the consumer track.

Negligence per se, and the private right of action that doesn't exist

HIPAA has no private right of action. Acara v. Banks, 470 F.3d 569 (5th Cir. 2006). Neither does Section 5 of the FTC Act, 15 U.S.C. § 45. Plaintiffs therefore use those statutes as the standard of care in a negligence per se count. Courts divide, often along state lines. Young Consulting rejected every defense argument and sustained negligence per se based on both statutes under Georgia law. Elsewhere the same argument fails because the state does not treat such general statutes as defining a specific duty. Counsel should check the state before spending much effort on it either way.

Implied contract

The theory is that by requiring personal data in exchange for goods, services, or employment, the defendant impliedly promised to protect it. Results vary with the facts pleaded.

• Dismissed: Paradies affirmed dismissal because the former employee alleged no facts showing the employer agreed to any data retention or protection policy. "Labels and conclusions" did not do it. The Georgia Court of Appeals reached the opposite result on a different record in Bland.
• Sustained: Sackin v. TransPerfect Global, Inc., 278 F. Supp. 3d 739 (S.D.N.Y. 2017) (dismissing express contract but sustaining implied contract and negligence for employees); In re Kemper Sports Management Data Breach Litigation, No. 24-CV-8503 (N.D. Ill. Jan. 5, 2026) (employee contract claims); Malvitz v. Fincantieri Marine Group, LLC, No. 24-cv-238 (D.D.C. June 12, 2025); Union Home Mortgage (personal data or money paid can be consideration).
• Express promises: Clemens involved an employment agreement saying the company would "take appropriate measures to protect the confidentiality and security" of data. The privacy policy or the employee handbook is usually what plaintiffs quote.

The Attias litigation shows the theory's staying power. Eight years in, the district court denied summary judgment on contract even though "the evidence on which Plaintiffs rely is thin," holding a jury could find CareFirst breached an implied promise to take reasonable steps. Attias v. CareFirst, Inc., cited above. The same opinion granted summary judgment on consumer protection, because named plaintiffs could not show they relied on or had even seen the privacy notice.

Unjust enrichment

Often the first count to fall, though not always; it survived in Kemper. In Malvitz, the plaintiffs did not allege that the employer derived value from their data or that they paid money earmarked for security. Warner Music treated the claim as duplicative of negligence. Bland affirmed its dismissal while reviving everything else. Plaintiffs do better where a customer paid a premium and the company marketed security; see the comparison in Resnick v. AvMed, Inc., 693 F.3d 1317 (11th Cir. 2012), an early case that allowed unjust enrichment under Florida law where insurance premiums allegedly included payment for data management.

Negligent misrepresentation

Plaintiffs add this count when a privacy policy or marketing page described security in glowing terms. It tends to fail for the reasons a misrepresentation claim usually fails. New York, for example, requires a special relationship and reasonable reliance, and courts may apply Rule 9(b) where the claim sounds in fraud. Warner Music dismissed the count while sustaining negligence, with leave to seek amendment. Ordinary customers and an online retailer rarely have the kind of relationship that the tort demands.

Consumer protection statutes

State unfair and deceptive practices acts offer multiple damages and fees, but they often require reliance or causation. That is where Attias failed on Maryland's statute, and where Warner Music dismissed New York General Business Law claims for failure to plead causation. The Virginia statute failed in Attias for an additional reason: it exempts insurers regulated by the state. Check exemptions early, because they're the cheapest win available.

The CCPA private right of action

California gave plaintiffs the one thing every other theory lacks: statutory damages for a data breach without proof of harm, at least as a matter of state law. Under § 1798.150, a consumer may sue when:

1. Nonencrypted and nonredacted personal information, as narrowly defined by reference to § 1798.81.5, or an email address with a password or security answer,
2. Is subject to unauthorized access and exfiltration, theft, or disclosure,
3. As a result of the business's violation of the duty to maintain reasonable security.

Damages run from a statutory $100 to $750 per consumer per incident or actual damages if greater, adjusted for inflation; the California Privacy Protection Agency set the range at $107 to $799 starting January 1, 2025, with further adjustments due in odd-numbered years. Multiply by a million Californians and you understand why this count settles cases. The court weighs factors such as seriousness and the defendant's net worth, so the figure is not automatic.

Five points catch people:

• Thirty-day notice. Before seeking statutory damages, individually or on a class basis, the plaintiff must give written notice, and no notice is needed for actual pecuniary damages alone. Young Consulting dismissed the statutory damages claim against Blue Shield because the notice went out July 16 and the complaint seeking those damages followed on July 21, five days later. Actual damages and injunctive relief were not affected by that ruling.
• "Cure" is narrow. The statute says implementing reasonable security after a breach does not cure that breach.
• Who is a "business." This is a live split between two opinions issued one day apart. Salesforce held that a cloud vendor plausibly "collects" and determines the means of processing data. Young Consulting dismissed the claim against a software vendor as a mere "service provider" subject only to administrative enforcement. See also In re Blackbaud, Inc., No. 3:20-cv-02930 (D.S.C. Aug. 12, 2021), an early decision finding a vendor adequately alleged to be a business. § 1798.140 defines the term.
• Pleading "reasonable security." Warner Music collects the split: some courts infer inadequate security from the breach itself, because plaintiffs cannot know the details before discovery, while others require facts showing the breach resulted from specific failures. Pleading specifics is the safer course.
• Article III still applies in federal court. A state cannot hand out federal jurisdiction. O'Leary makes the point about state statutes. A statutory damages claim for a plaintiff without concrete injury belongs in state court, which is exactly where many plaintiffs will happily take it.

For the larger California scheme, see State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork.

Forensic report privilege

Now the part that keeps general counsel awake. After a breach, the company needs to know what happened. Someone will write that down. That document is the best evidence in the case, and plaintiffs will ask for it on the first day of discovery.

The doctrine in brief

Two protections apply, and they do different work.

Work product protects documents prepared in anticipation of litigation by or for a party or its representative, including a consultant. Fed. R. Civ. P. 26(b)(3); Hickman v. Taylor, 329 U.S. 495 (1947). Most federal courts use the "because of" test: could the document fairly be said to have been prepared because of the prospect of litigation? Crucially, a document that would have been created in substantially similar form anyway does not qualify. United States v. Adlman, 134 F.3d 1194 (2d Cir. 1998); United States v. Deloitte LLP, 610 F.3d 129 (D.C. Cir. 2010). The Fourth Circuit asks about the "driving force" behind the document, and some Third Circuit decisions speak of a "primary motivating purpose." Ordinary work product can be overcome by substantial need. The burden is on the party claiming protection.

Attorney-client privilege protects confidential communications made to obtain legal advice. Upjohn Co. v. United States, 449 U.S. 383 (1981), protects those communications but not the underlying facts. A third-party consultant fits only by way of United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), which treats a consultant like a translator who helps the lawyer understand the client's information. Kovel itself warned that if the advice sought is the accountant's rather than the lawyer's, no privilege exists. A forensic firm tells you what happened to your network, in its own expert judgment, and so it sits awkwardly in Kovel.

For the corporate privilege basics, see Attorney-Client Privilege and Work Product for Businesses.

The cases, in order

Target (D. Minn. 2015): the template. Target ran two tracks. One, set up so the company could learn how the breach happened and respond, was nonprivileged and produced in discovery. A separate team, working through counsel, informed the lawyers so they could advise and defend. Litigation was already pending. The court upheld protection for the second track after in camera review. In re Target Corp. Customer Data Security Breach Litigation, MDL No. 14-2522, 2015 WL 6777384 (D. Minn. Oct. 23, 2015). I rely here on how later opinions describe the order, since it is not available on UpLaw. Every later defendant cites Target, and most fail to match it.

Experian (C.D. Cal. 2017): the other win. Outside counsel hired Mandiant, and the full report went to counsel, never to Experian's incident response team. The court held the report was prepared in anticipation of litigation even if that was not Mandiant's only purpose, reasoning that if it were more relevant to remediation, the team would have received it. In re Experian Data Breach Litigation, 2017 WL 4325583 (C.D. Cal. May 18, 2017).

Premera (D. Or. 2017): the amendment that changed nothing. Mandiant was already reviewing Premera's systems under a 2014 agreement when it found malware in January 2015. Premera hired outside counsel, then signed an amended statement of work shifting supervision to counsel. The court observed that the only thing that appeared to change was the identity of Mandiant's direct supervisor and the labels on its communications. In re Premera Blue Cross Customer Data Security Breach Litigation, 296 F. Supp. 3d 1230 (D. Or. 2017). A later order continued the theme: a company cannot shield forensic work by delegating supervision to counsel. 329 F.R.D. 656 (D. Or. 2019).

Dominion Dental (E.D. Va. 2019). The Mandiant agreement predated the discovery of the breach by almost a year, the post-breach description of services was nearly identical, and there was no second report. The company's affidavit saying the report would not otherwise have existed did not carry the burden. In re Dominion Dental Services USA, Inc. Data Breach Litigation, 429 F. Supp. 3d 190 (E.D. Va. 2019).

Capital One (E.D. Va. 2020): the one everyone remembers. The facts are worth reading slowly, because Capital One did what a careful lawyer would have told it to do. It had a master services agreement with Mandiant from 2015 and a statement of work dated January 7, 2019, to ensure fast incident response, paid from a fund labeled "business critical." When it confirmed the breach in July 2019, it retained Debevoise & Plimpton on July 20, and on July 24 a three-party letter agreement provided that Mandiant would work at counsel's direction and deliver reports to counsel. The scope was the same. So were the payment terms. Mandiant was paid from the retainer, then from the Cyber budget, and those payments were later re-designated as legal expenses. The September 4 report went to counsel first and then to the legal department, the board, about 50 employees, four regulators, and the accountant.

Magistrate Judge Anderson ordered production, and Judge Trenga affirmed. In re Capital One Consumer Data Security Breach Litigation, 2020 WL 2731238 (E.D. Va. May 26, 2020), aff'd, 2020 WL 3470261 (E.D. Va. June 25, 2020). The first prong of the test was easy: litigation was very likely. Capital One lost on the second. It had to show the report would not have been prepared in substantially similar form but for litigation, and with identical contract terms it could not. The company argued that the ruling punished keeping a vendor on retainer. The court's answer, in a footnote that became a how-to guide, was that the argument ignored the alternatives "either through different vendors, different scopes of work and/or different investigation teams." It also rejected reliance on a short internal report as the "real" business track, because nothing suggested that report was what Mandiant would otherwise have produced.

Clark Hill (D.D.C. 2021): the two-track claim that nobody swore to. A law firm that was hacked hired a litigation firm, which hired Duff & Phelps two days after the attack began. It said its usual vendor, eSentire, handled business continuity on the other track. Judge Boasberg read the report in camera and found otherwise. Wengui v. Clark Hill, PLC, 338 F.R.D. 7 (D.D.C. 2021). No sworn statement said eSentire ran a separate investigation. Clark Hill's own interrogatory answers said its understanding of the incident rested "solely" on counsel and counsel's consultants. The trail on eSentire's work went cold at the moment Duff & Phelps arrived. The report was shared with leadership, IT, and the FBI, and it contained pages of remediation recommendations. Kovel failed too, because what Clark Hill sought was cybersecurity expertise rather than legal advice. Read together, the last two defects are devastating. If you tell the court all your knowledge comes through counsel, you have just told it the privileged report is your only investigation.

Rutter's (M.D. Pa. 2021): the word "whether." The convenience chain got two endpoint alerts on May 29, 2019, hired BakerHostetler that day, and Kroll the next. The order is short and brutal. In re Rutter's Data Security Breach Litigation, No. 1:20-CV-382 (M.D. Pa. July 22, 2021). The statement of work said the purpose was "to determine whether unauthorized activity" had compromised data, so the company could not have believed litigation would result before knowing if a breach occurred. The executive who signed the contract testified he was not contemplating lawsuits. Kroll worked "alongside" IT and delivered its report to the company. The executive's declaration tying the report to notification obligations did not help, because notification is not litigation. Privilege failed because the report conveyed facts.

Marriott (D. Md. 2021): a win worth studying. Courts do still protect some of this. Marriott retained IBM to assist BakerHostetler specifically in providing legal advice, and documents about that work were protected, as a later court described the ruling. In re Marriott International Inc. Customer Data Security Breach Litigation, 2021 WL 2660180 (D. Md. June 29, 2021).

Morrill (S.D. Fla. 2025): the regulator as the decisive fact. This is the newest and most instructive reversal. A mortgage company had kept Mandiant on a standby retainer since 2019. Four days after discovering a December 2021 breach, its outside counsel engaged Mandiant to investigate, and Protiviti, which counsel had engaged in 2019 for unrelated privacy and security work, produced a second report. In June 2024 Magistrate Judge Torres held the reports protected under the dual-purpose test. Then the record improved. The company had voluntarily given both reports to a multistate mortgage regulator to rebut criticism that it lacked a root cause report. A consent order imposing a $19,629,400 penalty recited that "assessment and root cause reports" were records the regulators were entitled to under state law. On reconsideration, the court vacated its own order and compelled production, holding that the reports' predominant purpose was regulatory compliance and that a federal statute preserving privilege in materials shared with mortgage regulators (12 U.S.C. § 5111) cannot create a protection that never existed. Morrill v. Lakeview Loan Servicing, LLC, No. 1:22-cv-20955 (S.D. Fla. Mar. 27, 2025). It tabled the question of waiver. If your regulator requires a root cause report, you may be producing the very document you hoped to protect, unless you have prepared a separate one.

What the courts actually weigh

One distinction is easy to miss. Showing work product to an independent auditor did not waive it in Deloitte, because an auditor is not an adversary. Capital One used distribution for a different purpose, as evidence of why the report existed in the first place. A disclosure that does not waive anything can still prove the document was a business record.

Two uncomfortable conclusions follow. First, a company that truly needs one comprehensive explanation for operations, regulators, the board, and lawyers will probably not be able to protect that document, and it shouldn't pretend. The honest structure produces a nonprivileged business report that is written for disclosure, plus a narrower counsel-directed workstream, and it accepts that the facts are discoverable anyway. Second, none of this hides the underlying facts. Logs, forensic images, and the people who looked at them remain discoverable under Upjohn. The privilege fight determines whether plaintiffs get the expert's synthesis, conclusions, and candid recommendations.

A separate caution comes from standing itself. In Union Home Mortgage, the defendant filed its expert's supplemental report to support a factual attack on jurisdiction, offering further assurance that the data had not spread. The court accepted the filing for that limited purpose, while warning that untested evidence is persuasive at best. It reasoned from the factual-attack rule and did not address waiver. A defendant who uses forensic conclusions as a sword should expect the argument that the rest of the workstream is no longer a shield, and should plan for it. A Rule 502(d) order under Fed. R. Evid. 502 helps with disclosures in the litigation, but it does nothing to create protection that never attached.

Worked hypothetical: Bramblewood's two reports. Suppose Bramblewood Credit Union detects an intrusion on a Friday. It has a standing incident response contract with a vendor. Its outside counsel retains a second firm, one with no prior relationship, under a letter stating that counsel needs help assessing legal exposure from anticipated claims, and asking for an analysis of what a plaintiff's expert would say about causation. The standing vendor contains the attack and writes the root cause report, which goes to IT, the board, and the state regulator. Counsel's firm reports orally and then in a short memo to outside counsel only, with no remediation advice. Bramblewood's budget records show the second firm as a legal expense from the first invoice, and its general counsel signs a declaration describing all this with dates. That looks like Target and Experian, and the first report will be produced. Now change one fact: the CISO asks to see the second firm's memo "just to make sure we fixed everything," and it goes in an email to twelve people. Bramblewood has given plaintiffs the Capital One and Clark Hill argument, and an hour of convenience may cost it the protection.

Consolidation and the MDL

If cases land in several districts, the Judicial Panel on Multidistrict Litigation may centralize them for pretrial purposes under 28 U.S.C. § 1407, often, though not always, in a district with the defendant's headquarters or a strong connection. Examples include In re Target Corp. Customer Data Security Breach Litigation, 11 F. Supp. 3d 1338 (J.P.M.L. 2014); In re Sonic Corp. Customer Data Security Breach Litigation, 276 F. Supp. 3d 1382 (J.P.M.L. 2017), where five actions were pending in three districts, Sonic opposed centralization, and the Panel chose the Northern District of Ohio over Sonic's home district in Oklahoma; and In re Marriott International, Inc., 363 F. Supp. 3d 1372 (J.P.M.L. 2019). When suits land in one district, Rule 42 does the job, as in Wawa. Transferred cases remain separate and go back for trial under Lexecon Inc. v. Milberg Weiss Bershad Hynes & Lerach, 523 U.S. 26 (1998), unless the parties settle or consent, and most do settle.

Fed. R. Civ. P. 16.1, effective December 1, 2025, is the first civil rule specifically on MDLs. It calls on transferee courts to hold an early management conference and on parties to report on subjects such as leadership counsel and early exchange of information about the basis for claims. Amendments to Rule 16(b) and Rule 26(f), effective the same day, require early attention to how privilege claims will be logged, which matters when the forensic workstream will generate a contested log. See Practicing in an MDL for the mechanics.

Leadership is its own contest. Before certification, a court may appoint interim class counsel under Rule 23(g)(3), considering the work done investigating claims, experience, knowledge of the law, and resources. In re Geisinger Health Data Security Incident Litigation, No. 4:24-cv-01071 (M.D. Pa. Jan. 30, 2025), shows the form: two well-qualified groups with little daylight between them. That is why the race to file exists, and why the complaint filed 24 hours after the letter tends to be 80 percent boilerplate. Getting on file early is part of a bid for leadership.

Forum selection in the MDL now carries standing consequences. A transferee court generally applies its own circuit's law on federal questions, and Article III is a federal question. A defendant headquartered in Virginia may welcome centralization in the Fourth Circuit. Plaintiffs, knowing this, may prefer to stay in state court or argue for a different home. Note also the Fourth Circuit's holding, discussed next, that agreeing to an MDL does not waive a contractual class waiver.

Class certification

Few breach cases reach this stage. The ones that do have made an outsized mark on the law.

Marriott: three trips and a clause

Hackers accessed Starwood's guest database, later Marriott's, affecting about 133.7 million guest records. The MDL went to Maryland. The district court certified state-specific damages classes on contract and consumer claims, relying on an expert's "overpayment" model (customers paid more for rooms than they would have with knowledge of poor security), and certified Rule 23(c)(4) issue classes on the duty and breach elements of negligence against Marriott and its IT vendor Accenture. In re Marriott International, Inc., Customer Data Security Breach Litigation, 341 F.R.D. 128 (D. Md. 2022). An issue class certifies only part of a claim and leaves injury, causation, and damages for later individual proceedings.

The problem was a line in the Starwood Preferred Guest terms, § 13.21: disputes "will be handled individually without any class action." The district court had deferred the issue. In Maldini v. Accenture LLP (In re Marriott), 78 F.4th 677 (4th Cir. 2023), the Fourth Circuit vacated, holding that the time to address a class waiver is before certification. On remand, a newly assigned judge recertified everything, finding that Marriott had waived the clause by agreeing to an MDL and that such clauses conflict with Rule 23. 345 F.R.D. 137 (D. Md. 2023).

The Fourth Circuit reversed in full. Maldini v. Marriott International, Inc., 140 F.4th 123 (4th Cir. 2025). Marriott had preserved the defense by raising it in its answer, motion to dismiss, discovery, and opposition to certification. Applying the waiver test from Morgan v. Sundance, Inc., 596 U.S. 411 (2022), it held that joining pretrial MDL proceedings does not conflict with a promise not to bring class actions, because the constituent cases remain separate actions. Parties who want to bar coordination too can say so, as Uber's terms did in Uber Technologies, Inc. v. United States Judicial Panel on Multidistrict Litigation, 131 F.4th 661 (9th Cir. 2025). And under American Express Co. v. Italian Colors Restaurant, 570 U.S. 228 (2013), Rule 23 does not create a nonwaivable entitlement to class procedure, even outside arbitration. Without the damages classes, the Accenture issue classes lost their only superiority rationale and fell as well.

The opinion expressly takes no view on the rest of the certification ruling, so whether an overpayment model satisfies Comcast Corp. v. Behrend, 569 U.S. 27 (2013), remains open in that circuit. The takeaway for drafters is plain enough. The classes that fell were ones the district court had limited to program members, all of whom had agreed to the clause. A class waiver helps only as to signatories. It sits comfortably in a loyalty program, an app, or a subscription, but won't reach the employee whose data the company got from an acquired vendor.

Brinker: damages averages and who counts

Brinker reviewed a certified consumer class from a restaurant card breach. Only one of three named plaintiffs survived the standing analysis. The panel noted that every class member must have standing to recover damages, that courts have to sort uninjured members out before damages are awarded, and that the class definitions needed another look on remand, so it vacated in part. It left the district court's acceptance of a common damages methodology alone, finding no abuse of discretion. Judge Branch dissented on that point. She would have rejected an averaging model that could compensate people for rewards they never held and time they never spent, reading Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442 (2016), narrowly. The case is a road map for both sides. Our class certification article covers the damages model law in depth.

Uninjured class members

The Supreme Court granted review on whether a damages class can include uninjured members, then dismissed the case as improvidently granted, with Justice Kavanaugh dissenting. Laboratory Corp. of America Holdings v. Davis, No. 24-304 (U.S. June 5, 2025). The question stays open, and a breach class is the textbook example. Everyone had data stolen, few suffered fraud, and in a Holmes forum most have no standing. See also Cordoba v. DIRECTV, LLC, 942 F.3d 1259 (11th Cir. 2019), which Brinker relies on.

What settlements actually contain

Because certification and proof of causation are hard for plaintiffs, and discovery and notoriety are hard for defendants, most cases that survive the pleadings settle, often after one mediation. Rule 23(e)(2) requires a finding that the deal is fair, reasonable, and adequate. Here is a sampling drawn from opinions we read.

The recurring components are reimbursement of documented out-of-pocket losses, some payment for lost time at a modest hourly rate, credit monitoring, a security commitment, and fees. Reversion and clear sailing clauses draw objectors. Wawa took two appeals to decide that a court may measure a percentage fee by funds made available rather than claimed, that fee agreements are not per se improper though they are red flags, and that a settlement's terms should be scrutinized for side deals. In re Wawa, Inc. Data Security Litigation, 85 F.4th 712 (3d Cir. 2023). In the second appeal, fifteen state attorneys general appeared as amici to support the objector, which tells you the attention these settlements now attract. Security commitments deserve scrutiny of their own. The relief in Wawa continued a $25 million program the board had authorized before settlement, though the Third Circuit still found real value in making it enforceable.

Claims rates are low. The Third Circuit compared Wawa's 2.56 percent with other breach settlements at well under 2 percent and viewed that as ordinary for low-harm settlements. Readers who want a sanity check on deal size should look at per-class-member numbers, which in these cases may be measured in single-digit dollars.

Regulators in the same room

The class action is rarely the only proceeding, and what's said in one forum ends up in the others.

FTC. Section 5 authority over data security survived a fair notice challenge in FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015). In LabMD, Inc. v. FTC, 894 F.3d 1221 (11th Cir. 2018), the Eleventh Circuit vacated an order as too vague to enforce. The Safeguards Rule at 16 C.F.R. Part 314 applies to covered financial institutions.

HHS. The HIPAA Security and Breach Notification Rules at 45 C.F.R. Part 164 produce investigations and resolution agreements, and penalties under 42 U.S.C. § 1320d-5. Plaintiffs quote resulting findings as evidence of breach of duty.

State attorneys general and sector regulators. Multistate actions are common, and Morrill shows how a sector regulator's demand can reshape the privilege fight. Notice letters, like those quoted in Salesforce, and the copies posted on state attorney general websites are often the source of the first complaint's facts.

SEC. Public companies must report a material cybersecurity incident on Form 8-K, Item 1.05, within four business days of determining materiality, and describe risk management annually under Regulation S-K Item 106, 17 C.F.R. Part 229. The agency's most aggressive enforcement theory receded: after a district court dismissed most of its claims, the SEC and SolarWinds stipulated to dismissal of the rest with prejudice in November 2025. Private investors and shareholders fare poorly too. The Fourth Circuit affirmed dismissal of the securities suit over the Starwood breach in Construction Laborers Pension Trust v. Marriott International, Inc., 31 F.4th 898 (4th Cir. 2022), because the challenged statements were not false when made, and the Delaware Court of Chancery dismissed the derivative suit in Firemen's Retirement System of St. Louis v. Sorenson, C.A. No. 2019-0965-LWW (Del. Ch. Oct. 5, 2021). A regulatory disclosure still gets quoted in every consumer complaint. The regulatory overview is in Cybersecurity Regulation for Businesses, and insurance coverage in Directors and Officers and Cyber Insurance.

One worked example of the overlap. Suppose Marlowe Street Pharmacy, a regional chain, discovers exfiltration of 200,000 patients' records. HHS asks for its risk analysis. A state attorney general asks for the root cause. Its notice letter says "we have no evidence of misuse." Three months later, plaintiffs in the class action quote the letter's advice to monitor accounts (Galaria, Zappos), obtain the regulator correspondence in discovery, and move to compel the forensic report on the theory that it was the document given to regulators (Capital One, Morrill). Yet the same letter may help on standing in Fourth Circuit courts (Drivestream), and the offer of credit monitoring is not a concession there (Beck). Each statement needs to be written with all three audiences in mind.

Where the law is unsettled

• Is hacker possession alone concrete? Bohnak says yes in substance; Holmes says no. Certiorari has not resolved it.
• Does "substantial risk" have a number? Holmes reads Beck as requiring at least 33 percent. No other circuit has adopted that bar, and the panel itself flagged that risk might vary with the gravity of harm.
• Do time and distress count on their own? Clemens and Webb lean yes; Holmes says no; TransUnion reserved it.
• Are service providers suable under the CCPA? Salesforce and Young Consulting came out differently within a day of each other.
• Can a damages class include uninjured people? Labcorp left it open.
• Does giving a protected report to a regulator waive protection? Morrill tabled it. Rule 502 does not adopt selective waiver.
• Can one engagement ever do it all? Decisions lean no, yet Experian and the Marriott order show carefully built tracks can succeed.

For deeper secondary reading, two American Law Reports annotations are helpful starting points: "Injury-in-Fact and Federal Court Standing Under Article III of the U.S. Constitution in Data Breach Cases: Medical Information," 74 A.L.R. Fed. 3d Art. 7, and "Liability of Businesses to Governments and Consumers for Breach of Data Security for Consumers' Information," 1 A.L.R.7th Art. 2. Wright, Miller, and Marcus, Federal Practice and Procedure § 2024, states the "because of" standard the Capital One court quoted. For quick searching of these opinions, UpLaw (uplaw.us) carries most of the reported authority discussed here.

This article gives general information about a fast-moving area, and it should not stand in for advice from a lawyer who knows your data, your contracts, and your forum. If you are sorting out a notice letter or a complaint and want to talk through the options, we're glad to have that conversation.

Related Documents

Related Articles

• Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation: the notification duties this article assumes.
• Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims: standing doctrine beyond data breach cases.
• Attorney-Client Privilege and Work Product for Businesses: Upjohn, In-House Counsel, and the Common Interest: corporate privilege basics.
• Rule 502 and Inadvertent Production: Waiver, Clawback Agreements, and Why Every Case Needs a 502(d) Order: protecting what has already been produced.
• Class Certification and the Expert Battle: Comcast, Predominance, and Daubert Before the Merits: damages models and predominance.
• CAFA Jurisdiction and Class Action Removal: Amount in Controversy, Exceptions, and Mass Actions: how these cases reach federal court.
• State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork: the statute behind § 1798.150.
• Cybersecurity Regulation for Businesses: The FTC Safeguards Rule, NYDFS Part 500, SEC Cyber Disclosure, and State Laws: the regulators.
• Directors and Officers and Cyber Insurance: Towers, Triggers, Allocation, and the Claim You Must Notice: who pays.
• Preparing a Witness for Deposition: What Is Proper, What Is Coaching, and What the Other Side Can Discover: preparing the corporate designee, whose testimony sank Rutter's.

Related Guides

• Defending or Bringing a Data Breach Class Action: A Practical Guide: the step-by-step companion for both sides.
• Responding to a Data Breach: The First Seventy-Two Hours: what comes before the first complaint.
• Practicing in an MDL: A Practical Guide for Plaintiff and Defense Counsel: consolidated pretrial mechanics.
• Pleading and Attacking Standing in Federal Court: A Practical Guide: how to frame standing motions generally.

Related Checklists

• Data Breach Litigation Readiness Checklist: A Practical Checklist: the tasks before and after an incident.

Related Toolkits

• Data Breach Litigation Toolkit: Privileged Investigation Protocols, Standing Motions, and Settlement Terms: engagement letters, protocols, and term sheets to copy.
• Clawback Toolkit: 502(d) Orders, Clawback Notices, and Privilege Review Protocols: the order to have in place before forensic materials are produced.