The U.S. Court of Appeals for the Second Circuit held for the first time that plaintiffs have Article III standing to sue over the unauthorized disclosure of their personal information, even if they have not yet been the victims of identity theft or fraud.

Monday's unanimous ruling, while still ultimately a loss for plaintiffs in the underlying case, brought the Second Circuit in line with other federal appeals courts, which have held that plaintiffs may establish an injury based on an "increased risk" of identity theft or fraud once their data has been leaked.

In a 21-page decision, the three-judge panel noted that while some courts have suggested there was a circuit split on the issue, "no court of appeals has explicitly foreclosed plaintiffs from establishing standing based on a risk of future identity theft."