Data Breach Case Tossed For Lack Of Concrete Harm

On January 7, the District Court for the District of Minnesota tossed a putative class action against SuperValu, Inc., finding that the plaintiffs' claims of possible future harm were too speculative to satisfy Article III standing requirements. 

In this multi-district litigation, sixteen named plaintiffs alleged they were harmed by two 2014 data breaches where hackers gained access to the grocery stores' network for payment card transactions.  Customer data at over 1,000 of SuperValu's stores was accessed.  However, the plaintiffs could only allege a single unauthorized charge on one the plaintiff's credit cards.  Additionally, the Court found that even this incident was not indicative of data misuse that was fairly traceable to the data breaches.  Based on the lack of concrete harm, Judge Ann D. Montgomery held that the case must be dismissed for want of subject matter jurisdiction.