P.F. Chang's Data Hack Case Revived by 7th Circuit

A class action suit against ersatz-Chinese food chain P.F. Chang's is allowed to proceed, said the Seventh Circuit, because two separate plaintiffs had alleged "enough" to meet the Twombly standards of standing in this breach of data case.
The circuit's ruling upholds the 2014 finding that a breach and increased risk of identity theft is "injury" enough for justiciability.
Data Breaches Abound
P.F. Chang's was one of the many businesses that was afflicted in recent years by the 2014-2015 data hack attacks. Others include Target, Home Depot, and of course, Sony. In 2014, the company publicly announced that it had been hacked and that customers' personal credit card data was compromised. The breach occurred somewhere between late 2013 and mid 2014, and was first discovered by the U.S. Secret Service.
Two separate plaintiffs sued the restaurant, claiming that the hack presented an unreasonable and increased risk of future identify theft. Their cases were consolidated into Lewart v. P.F. Changs China Bistro, a case that also attempted to certify a class other customers whose data was compromised by the hack. But the district court dismissed the case because it opined that Lewart and others had failed to prove standing for lack of requisite injury.
Circuit Applies Another Hacking Case: Neiman Marcus
But the circuit disagreed. Fortunately, the very same court had earlier decided another data hacking case, Remijas v. Neiman Marcus. In there, substantially similar events took place. Hackers broke their way into the network, stole credit and debit card numbers and made off with the data. In that case, the court determined that standing existed because the plaintiffs had suffered a "real and immediate" increased risk of harm via identity theft. Though the hacking itself might not have been injurious to the plaintiffs, the increased risk was.
Indeed, Lewart alleged increased trouble with his account since 2013, about the time the P.F. Chang's attack took place. Though he could not prove that these attacks were causally linked with the original attack on the bistro, the court found that his allegations still passed the "plausible" standard outlined in Twombly. And besides, Lewart pushed the injury quite past the line when he alleged another injury he suffered: mitigation of loss. The poor guy went out, used his time, and bought a credit monitoring service to watch his accounts. His out-of-pocket expense for that service? About $100.
Related Resources:
- Data Breach Class Action Brought Against P.F. Chang's can Continue, Seventh Circuit Rules (LegalNewsLine.com)
- Indianapolis Horse Racing Track Was a Business, 7th Cir. Rules (FindLaw's U.S. Seventh Circuit Blog)
- 7th Cir. Revives Challenge to Wisconsin Voter ID Law (FindLaw's U.S. Seventh Circuit Blog)
- Indiana's Child Services Is Immune From FLSA Suit (FindLaw's U.S. Seventh Circuit Blog)