A recent decision from the United States Court of Appeals may usher in a new wave of data breach class-action litigation. In Remijas v. Neiman Marcus Group, the Seventh Circuit held that consumer victims of a data breach have standing to assert claims based on the imminent risk of future use of the information for identity theft and fraudulent transactions. No. 14-3122, 2015 WL 4394814, 2015 U.S. App. LEXIS 12487 (7th Cir. July 20, 2015). Although not the first decision to find standing to assert claims arising from a data breach, the Seventh Circuit's decision rests on a potentially broader form of standing, and one defendants may find more difficult to challenge. In light of the Remijas decision, it is all the more important that businesses potentially susceptible to a data breach take steps to mitigate their risk and potential liability.

For more than a year, news of data breaches and subsequent class-action litigation has been a regular occurrence. Every sector, whether it is health care, hospitality and service, retail, media and even government, has been targeted and victimized by massive data breaches. Although hackers can and will steal almost any piece of information, all of which can be monetized to some extent in the darker corners of the Internet, the hackers typically target personal consumer information, such as Social Security numbers, credit card and other account information, and addresses and telephone numbers. This information is then used to facilitate fraudulent transactions and identity theft.

Adding insult to injury, almost every victim of a data breach has also been subject to consumer class-action litigation purporting to seek astronomical sums of compensatory damages on behalf of those whose personal information was accessed. Less publicized is the fact that these class actions have found little success, due largely to the putative plaintiffs' lack of standing. That is, the majority of the consumers whose data was accessed typically cannot identify any actual use of the data, financial loss or attempt at identity theft. Without evidence of any actual injury, courts have generally dismissed these lawsuits for lack of standing.