Cybersecurity Implications Of Supreme Court's Spokeo Decision Begin To Emerge

On May 16, 2016, the Supreme Court issued its opinion in Spokeo , Inc. v. Robins, 578 U.S. ____ (2016), holding that Article III standing requires plaintiffs to demonstrate concrete injury in the context of a statutory violation. In the week since the Court's opinion, Spokeo has already been cited in high-profile cybersecurity cases.

1. Khan v. Children's National Health System

In Khan v. Children's National Health System, Children's National was attacked by hackers in a phishing scam that compromised the personal information of approximately 18,000 patients. See Memorandum Opinion, No. 8:15-cv-02125, at 2 (D. Md. May 19, 2016) (ECF 33). The plaintiff filed a proposed class action, alleging violations of consumer protection acts and common law claims. Id. at 2-3. Children's National filed a motion to dismiss, arguing that the plaintiff lacked standing because she had not suffered an injury in fact. Id. at 3. In response, the plaintiff claimed, among other things,