Ruling in a case of first impression, a unanimous Georgia Supreme Court revived a putative class action involving claims by at least 200,000 current and former patients of an Athens clinic whose personal information, including names, addresses, Social Security numbers and insurance information, was stolen in a 2016 data breach.

The hackers demanded a ransom but the Athens Orthopedic Clinic refused to pay, and at least some of the patients' information was later made available on the dark web.

The plaintiff's claimed that the hack made them possible targets of identity theft and fraud, and that they had been damaged by having to place fraud alerts on their credit reports. At least one, plaintiff Christine Collins, actually had fraudulent charges made to her credit card after the breach. 

A trial judge threw out the case in a bare-bones ruling on a motion to dismiss.

In 2018, a divided Court of Appeals panel affirmed the dismissal, with now-Chief Judge Christopher McFadden writing in dissent that the plaintiffs had sufficiently pleaded facts to survive a motion to dismiss, because their "allegations of future injury show a substantial risk that harm will occur."

The Dec. 23 opinion penned by Justice Nels Peterson agreed. Writing for the court, Peterson said that prior appellate rulings dealing with stolen personal data generally held that plaintiffs had to show the information "had actually fallen into criminal hands" and had been used to harm them in order to show a "legally cognizable injury."

"But this case, which was dismissed on the pleadings despite allegations of large-scale criminal activity, falls into a different category of data-exposure cases," Peterson wrote. 

"Here, the plaintiffs allege that criminals are now able to assume their identities fraudulently and that the risk of such identity theft is 'imminent and substantial,'" he said. "This amounts to a factual allegation about the likelihood that any given class member will have her identity stolen as a result of the data breach."

As detailed in the appellate rulings, the incident began when then clinic learned in June 2016 that someone self-identified as "Dark Overlord" hacked its computer system. The clinic informed its patients about the hack in August of that year. 

When the clinic refused to pay the ransom demanded by Dark Overlord, some of the information was offered for sale on the dark web, and some also showed up on Pastebin, a data-storage and sharing website.

Three plaintiffs filed a putative class action in Clarke County Superior Court in January 2017 asserting claims for violation of the Georgia Uniform Deceptive Trade Practices Act, breach of implied contract, unjust enrichment, and negligence.

Their claimed damages included past and future costs for credit monitoring and identity theft protection, credit freezes on their accounts and injunctive relief. 

Cobb County Superior Court Senior Judge Grant Brantley issued a one-paragraph ruling dismissing the case the following June.

In upholding Brantley, then-Court of Appeals Judge William Ray II, who's now on the federal bench, wrote that the plaintiffs claimed damages were too speculative to provide standing.

"While credit monitoring and other precautionary measures are undoubtedly prudent, we find that they are not recoverable damages on the facts before us because the plaintiffs seek only to recover for an increased risk of harm."

With the concurrence of Judge Brian Rickman, Ray wrote that such "prophylactic measures" were "insufficient to state a cognizable claim under Georgia law."

In his dissent, McFadden wrote that neither Georgia appellate courts nor the U.S. Court of Appeals for the Eleventh Circuit "have decided whether a data breach, with little more, amounts to an injury in fact for purposes of standing."

"But federal courts have uniformly applied a rule that a substantial risk of future harm is sufficient to show an injury in fact for purposes of standing," McFadden said. "And applying that rule here, leads to the conclusion that the plaintiffs have standing."

The Supreme Court opinion said that the plaintiffs claims were more than sufficient to survive a motion to dismiss, as they alleged that "all class members now face the 'imminent and substantial risk' of identity theft given criminals' ability to use the stolen data to assume the class members' identities and fraudulently obtain credit cards, issue fraudulent checks, file tax refund returns, liquidate bank accounts, and open new accounts in their names."

"Assuming the truth of these allegations, as we must at this stage, we must presume that a criminal actor has maliciously accessed the plaintiffs' data and has at least attempted to sell at least some of the data to other wrongdoers," Peterson wrote.

The allegations of future injury "show a substantial risk that harm will occur. The allegations thus suffice to establish standing," he said. 

The plaintiffs are represented David Bain of Atlanta's Law Offices of David Bain, and Mark Goldman and Douglas Bench of Goldman, Scarlato & Penny in Conshohocken, Pennsylvania. Bain said there would be no comment on the ruling.

Athens Orthopedic Clinic is represented by Chilivis Cochran Larkins & Bever partner J. "Randy" Dalbey, who did not respond to requests for comment Monday.