On September 12, 2016, the US Court of Appeals for the Sixth Circuit held in Galaria v. Nationwide Mutual Insurance Co., Nos. 15-3386/15-3387 (6th Cir. Sept. 12, 2016) that the plaintiffs in two related lawsuits properly alleged standing to pursue claims arising from a 2012 attack on the defendant insurance company’s computer network. The court’s unpublished opinion addressed two questions that are frequently litigated in data breach cases: whether the plaintiffs had alleged an injury-in-fact required for constitutional standing; and whether any such alleged injury was fairly traceable to the acts of the defendants and thus sufficient to establish the requisite causation. The court decided both questions in favor of the plaintiffs. It did so over a dissent that concluded that it was unnecessary for the panel to weigh in on the “existing circuit split regarding whether an increased risk of identity theft is an Article III injury” because the plaintiffs had alleged no facts indicating that the company was responsible for the acts of third-party criminal hackers. Defendant has filed a petition asking the Sixth Circuit to review this decision en banc.
