Ninth Circuit Finds Data Breach Customers Have Initial Standing To Sue

In Short

The Situation: Relating to a 2012 data breach lawsuit against Zappos.com, a district court had found that a certain group of plaintiffs lacked standing to sue because they "failed to allege instances of actual identity theft or fraud."

The Development: In reversal of the lower court's decision, a unanimous Ninth Circuit panel has resurrected claims against Zappos.com, finding that the "imminent" risk of identity theft from the breach was enough to establish standing to sue.

Looking Ahead: Ninth Circuit litigants should consider the decision in determining how to respond to a data breach complaint.

A unanimous Ninth Circuit panel recently revived a data breach lawsuit against Zappos.com by holding that plaintiffs, whose personal information was stolen but not actually misused, had standing to sue, at least in the context of a motion to dismiss, because they faced a "substantial risk of identity theft." See In re Zappos.com, Inc., 884 F.3d 893 (9th