The U.S. District Court for the District of Columbia dismissed for lack of Article III standing, finding that the risk of future injury to the plaintiffs was too speculative to establish injury in fact. The district court did not read the plaintiffs' complaint to allege the theft of Social Security numbers or credit card numbers, and concluded that the plaintiffs had “not suggested, let alone demonstrated, how the CareFirst hackers could steal their identities without access to their [S]ocial [S]ecurity or credit card numbers.”

The plaintiffs appealed to the U.S. Court of Appeals for the District of Columbia Circuit.

The Circuit Court's Decision

The circuit court reversed, concluding that the plaintiffs had “cleared the low bar to establish their standing at the pleading stage.”

In its decision, the circuit court explained that the plaintiffs had alleged that the data breach at CareFirst had exposed them to a heightened risk of identity theft.

The circuit court then pointed out that it had “frequently” upheld claims of standing based on allegations of a “substantial risk” of future injury, and that under its precedent, the proper way to analyze an increased-risk-of-harm claim was to consider the ultimate alleged harm, which in this case was identity theft, “as the concrete and particularized injury and then to determine whether the increased risk of such harm ma[de] injury to an individual citizen sufficiently 'imminent' for standing purposes.”

According to the circuit court, “[n]obody doubt[ed] that identity theft, should it befall one of these plaintiffs, would constitute a concrete and particularized injury.” It then ruled that, keeping in mind the “light burden of proof” the plaintiffs had at the pleading stage, the complaint plausibly alleged that the plaintiffs faced a substantial risk of identity theft as a result of CareFirst's alleged negligence in the data breach.

Contrary to the district court, the District of Columbia Circuit Court decided that the complaint alleged the theft of Social Security or credit card numbers in the data breach. The circuit court pointed out that the complaint alleged that CareFirst, as part of its business, collected and stored its customers' personal identification information, personal health information, and other sensitive information, all of which the plaintiffs referred to collectively as “PII/PHI/Sensitive Information.” This category of “PII/PHI/Sensitive Information,” as plaintiffs defined it, included “patient credit card . . . and [S]ocial [S]ecurity numbers.” Moreover, the circuit court continued, the plaintiffs' complaint also asserted that “the cyberattack [on CareFirst] allowed access to PII, PHI, ePHI, and other personal and sensitive information of [p]laintiffs” and that “[i]dentity thieves can use identifying data – including that accessed on [d]efendants' servers – to open new financial accounts[,] incur charges in another person's name,” and commit various other financial misdeeds. The circuit court noted that the plaintiffs asserted that the CareFirst breach exposed “all of the information wrongdoers need” for appropriation of a victim's identity.

According to the allegations, the circuit court found, CareFirst collected and stored “PII/PHI/Sensitive Information,” a category of information that included credit card and Social Security numbers; that PII, PHI, and sensitive information had been stolen in the breach; and that the data “accessed on [d]efendants' servers” placed the plaintiffs at a high risk of financial fraud. It then found that the complaint “plausibly” alleged that the CareFirst data breach had exposed customers' Social Security and credit card numbers.

The circuit court also pointed out that the plaintiffs' complaint separately alleged that the “combination of members' names, birth dates, email addresses and subscriber identification number[s] alone qualifie[d] as personal information, and the unauthorized access to said combination of information create[d] a material risk of identity theft,” adding that this allegation of risk based solely on theft of health insurance subscriber ID numbers was “plausible when taken in conjunction with the complaint's description of a form of 'medical identity theft' in which a fraudster impersonate[d] the victim and obtain[ed] medical services in her name.” These portions of the complaint, the circuit court ruled, made up, at the very least, a “plausible allegation” that the plaintiffs faced a substantial risk of identity fraud, even if their Social Security numbers had never been exposed to the data thief.

Accordingly, the circuit court concluded that a substantial risk of harm existed already, “simply by virtue of the hack and the nature of the data” that the plaintiffs alleged had been taken.

The case is Attias v. CareFirst, Inc., No. 16-7108 (D.C. Cir. Aug. 1, 2017). Attorneys involved include: Jonathan B. Nace argued the cause for appellants. With him on the briefs was Christopher T. Nace. Marc Rotenberg and Alan Butler were on the brief for amicus curiae Electronic Privacy Information Center (EPIC) in support of appellants. Tracy D. Rezvani was on the brief for amicus curiae National Consumers League in support of appellants. Matthew O. Gatewood argued the cause for appellees. With him on the briefs was Robert D. Owen. Andrew J. Pincus, Stephen C.N. Lilley, Kathryn Comerford Todd, Steven P. Lehotsky, and Warren Postman were on the brief for amicus curiae The Chamber of Commerce of the United States of America in support of appellees.