Seventh Circuit Dismisses Security Breach Class Action

Following a data security breach, businesses can frequently look forward to a consumer class action or two.  To date, these class actions have been largely unsuccessful, and several federal district courts have dismissed consumer actions following a breach for failing to state a claim upon which relief can be granted.  See, e.g.,Kahle v. Litton Loan Servicing, LP, 486 F. Supp. 2d 705 (S.D. Ohio 2007); Bell v. Acxiom Corp., 2006 WL 2850042 (E.D. Ark. Oct. 3, 2006); Key v. DSW, Inc., 454 F. Supp. 2d 684 (S.D. Ohio 2006); Guin v. Brazos Higher Educ. Serv. Corp., Inc., 2006 WL 288483 (D. Minn. Feb. 7, 2006).

Now, for the first time, a federal court of appeals has weighed in on the issue as well.  On August 23, 2007, the U.S. Court of Appeals for the Seventh Circuit (“Seventh Circuit”) concluded that present and future identity theft-monitoring costs are not compensable damages under Indiana’s security breach notification statute, affirming the dismissal of a class action