The D.C. Circuit recently ruled that alleged victims of a data breach have standing to pursue claims, notwithstanding that they have not yet suffered any actual harm as a result of the breach. This ruling adds to the prior circuit court rulings that have reached differing results when addressing the standing issue in data breach cases.
Attias v. CareFirst, Inc., presented a regrettably familiar fact pattern: Plaintiffs were the victims of an alleged data breach at health insurer CareFirst, which exposed their personal and medical data. Plaintiffs filed a class action against CareFirst raising eleven state law causes of action on behalf of a class of all CareFirst customers in Maryland, Virginia, and Washington, D.C.