Attorneys said that companies should take note of a novel ruling this week from the U.S. Court of Appeals for the Second Circuit, which held that plaintiffs have constitutional standing to sue over the unauthorized disclosure of their personal information, even if they have not yet been the victims of identity theft or fraud.

The decision, on an issue of first impression for the Manhattan-based appeals court, was generally seen as a win for plaintiffs, who may now establish an injury based on an "increased risk" of harm once their sensitive data has leaked.