Federal Court Decision Demonstrates Ongoing Challenges Faced By Plaintiffs In Data Breach Litigation

On February 11, 2015, the U.S. District Court for the Southern District of Texas dismissed a class action complaint against the St. Joseph Health System arising out of a data security breach that occurred after hackers allegedly infiltrated the St. Joseph computer network in December 2013. In her complaint, the plaintiff alleged violations of the Fair Credit Reporting Act as well as various state and common law claims sounding in tort and contract. U.S. District Judge Kenneth M. Hoyt granted the defendants' motion to dismiss, holding that the plaintiff failed to allege a cognizable Article III injury and therefore lacked standing to bring her federal claims. The St. Joseph decision highlights the emerging majority view in data security breach cases that the mere heightened risk of future misuse of stolen data is too speculative to create standing for the purposes of Article III.