Recent data-breach cases illustrate that the viability of claimed injuries often turns less on the categories of harm alleged than on the facts underlying them. Plaintiffs routinely invoke financial losses, mitigation expenses, lost time, diminished data value, and emotional distress in an effort to establish standing and support damages claims. But courts are looking beyond those categorical labels and focusing on a recurring set of more specific factual questions: what information was compromised, what happened to it after the breach, whether concrete harm followed, and whether the alleged harm is traceable to the breach.
The answers to those questions impact outcomes at the pleading stage and create potentially individualized issues at class certification. The circumstances that make an individual plaintiff’s injury concrete enough to survive a motion to dismiss—such as whether the plaintiff experienced misuse, fraud, or other individualized consequences from the breach—may vary significantly across a proposed class. The result is a recurring tension in data-breach litigation: facts that strengthen an individual plaintiff’s showing of injury at the pleading stage also make class-wide proof more difficult. Below, we analyze recent decisions addressing what makes alleged data-breach harms concrete and traceable at the pleading stage and whether those harms, their causal connection to the breach, and any resulting damages can be established through common proof at class certification.
Courts are divided over what must happen after unauthorized access before a plaintiff has suffered a concrete injury, but their rulings typically turn on the sensitivity of the compromised information, whether it was disseminated or misused, and the potential value of that information.
First, the nature and sensitivity of the compromised information can shape whether a court views the alleged risk of identity theft or fraud as substantial or speculative. In Tsao v. Captiva MVP Restaurant Partners, LLC, for example, the Eleventh Circuit held that compromised payment-card information, without actual misuse or more sensitive identifiers, did not establish a sufficiently substantial risk of identity theft.[1] Applying that circuit’s framework to different facts, however, the Middle District of Georgia in In re Aflac Inc. Data Breach Litigation reached the opposite conclusion where the compromised information included Social Security numbers, dates of birth, and medical information, and several plaintiffs alleged that their Social Security numbers had been found on the dark web.[2] The contrast illustrates that, even under the same governing standard, the type of information compromised and the factual indications of misuse can determine whether the alleged risk is substantial or speculative.
Second, courts differ on whether the unauthorized acquisition of personal information must be followed by further dissemination or misuse before a concrete injury arises. In Holmes v. Elephant Insurance Co., the Fourth Circuit distinguished between information merely obtained by hackers and information exposed more broadly. Driver’s license data posted on the dark web supported a concrete privacy injury because it had been “released into the open,” while mere access by a limited number of intruders did not.[3] By contrast, the Central District of California in In re American Ass’n of Critical Care Nurses Breach Litigation concluded that the unauthorized theft of sufficiently sensitive personal information could itself constitute a concrete privacy injury without further publication.[4] For companies facing breach litigation in multiple jurisdictions, that divide matters: the same breach details may establish standing in one jurisdiction but not another.
Third, the potential value of the compromised information can make or break diminished-value injury theories, and courts look for allegations connecting value to an economic loss incurred by the plaintiff. For example, in Manning v. Zumpano Patricios, the Southern District of Florida rejected a diminished-value theory where the plaintiff did not allege any intention to sell his information, reasoning that the absence of such an intention meant a decrease in the information’s market value would not cause him financial harm, even assuming the information had some inherent value in the abstract.[5] By contrast, the District of Montana in In re Snowflake, Inc. Data Security Breach Litigation credited a diminished-value theory supported by allegations that there is an established market in which stolen personal information could be bought and sold at identifiable prices.[6]
Taken together, these decisions demonstrate that concreteness depends on the facts surrounding the compromised data, not merely the label attached to the alleged harm.
Even if a plaintiff identifies a sufficiently “concrete” harm, that is not necessarily enough to establish standing if the plaintiff cannot plausibly connect that alleged harm to the underlying breach. The First Circuit’s decision in Santos-Pagán v. Bayamón Medical Center illustrates this distinction.[7] There, the plaintiff alleged that a fraudulent cellphone account had been opened in her name and that she incurred approximately $800 in mitigation expenses related to the resulting credit issues. The court accepted that the fraudulent account and resulting mitigation costs constituted a concrete injury but found that the plaintiff had not plausibly tied that injury to the breach. In particular, the complaint did not allege when the account was opened, and the record suggested that the plaintiff discovered it more than four years after the breach, leaving other potential sources of exposure difficult to rule out.
That distinction demonstrates that paying close attention to the timeline is critical. A fraudulent transaction may establish that a plaintiff suffered real harm but does not necessarily show that the defendant’s breach caused it. The time between the breach and alleged misuse, whether the compromised data could facilitate the particular type of fraud alleged, and evidence of other potential exposures can all affect the traceability analysis.
An injury theory that is sufficient at the pleading stage may nonetheless present challenges at class certification for plaintiffs and opportunities for defendants. The facts that potentially make an individual plaintiff’s injury concrete—such as actual fraud, misuse, or other individualized consequences of the breach—may also reveal significant differences among proposed class members. Thus, even where common proof exists as to how a breach occurred, certification may turn on whether injury, causation, and a corresponding damages model can be established through class-wide evidence.
In re Accellion, Inc. Data Breach Litigation illustrates this dynamic.[8] There, the Northern District of California found that alleged injuries based on time spent responding to the breach and emotional distress required individualized proof that could not support certification. A disclosure of private information theory, by contrast, could be evaluated more uniformly: once the relevant categories of exposed data were identified, the court could determine injury by matching each class member’s exposed information to those categories. The court therefore certified narrower, customer-specific subclasses on that theory, while requiring any class-wide damages model to correspond to the disclosure injury theory.
The Connecticut Superior Court’s decision in Leary v. Kent School Corp. similarly demonstrates how certification may be specific to different alleged injuries.[9] There, current and former students and employees of a private school alleged that a former IT department employee had accessed and copied their private electronic files, including intimate photographs and videos, without their knowledge or consent. The court concluded that the individualized nature of each plaintiff’s damages, which included, among other things, severe emotional distress and mitigation expenses, would have precluded certification of the negligence, recklessness, and Connecticut Unfair Trade Practices Act (CUTPA) claims entirely, but nevertheless allowed partial class certification as to liability only, with damages reserved for individual proceedings. By contrast, the court declined to certify even an issue class for the invasion-of-privacy, computer-crimes, and negligent-infliction-of-emotional-distress claims, stating without further elaboration that common questions of liability did not predominate over individual questions as to those claims.
Together, Accellion and Leary show that variation in the magnitude of damages incurred does not necessarily foreclose class treatment but may limit certain avenues for class-wide damages. The more fundamental questions are whether the asserted injury and its causal connection to the breach can be established through common proof and whether the proposed damages model corresponds to the injury theory suitable for class-wide adjudication.
Despite differing approaches to standing and the threshold for establishing concrete injury, recent data-breach decisions reflect an emphasis on the facts underlying the asserted harm: what information was compromised, what happened to it, and what consequences plausibly followed. At the pleading stage, courts are examining not simply whether plaintiffs can identify a recognized category of harm, but whether the facts alleged make that harm concrete and plausibly attributable to the breach. At class certification, those same harms raise a different question: how they can be established across the proposed class with common proof.
For companies assessing litigation exposure, that makes the underlying factual record especially important. What information was compromised, what happened to it after the breach, what losses affected individuals actually experienced, and how consistently those losses appear across the proposed class can shape the litigation from the first standing challenge through class certification.
[1] Tsao v. Captiva MVP Rest. Partners, LLC, 986 F.3d 1332, 1343–44 (11th Cir. 2021).
[2] In re Aflac Inc. Data Breach Litig., No. 4:25-cv-00183-CDL, 2026 WL 2333808, at *3 (M.D. Ga. Aug. 12, 2026).
[3] Holmes v. Elephant Ins. Co., 156 F.4th 413, 425–26 (4th Cir. 2025).
[4] In re Am. Ass’n of Critical Care Nurses Breach Litig., No. 8:25-cv-02027-MRA-ADS, 2026 WL 2622441, at *3–4 (C.D. Cal. Sept. 4, 2026).
[5] Manning v. Zumpano Patricios, P.A., No. 25-cv-23184-BLOOM/Elfenbein, 2025 WL 3062563, at *7–8 (S.D. Fla. Nov. 3, 2025).
[6] In re Snowflake, Inc. Data Sec. Breach Litig., No. 2:24-md-03126-BMM, 2025 WL 3023007, at *4–5 (D. Mont. Oct. 29, 2025).
[7] Santos-Pagán v. Bayamón Med. Ctr., 178 F.4th 66, 70–73 (1st Cir. 2026).
[8] In re Accellion, Inc. Data Breach Litig., No. 5:21-CV-01155-EJD, 2025 WL 2799102 (N.D. Cal. Sept. 30, 2025).
[9] Leary v. Kent Sch. Corp., No. (X06) UWY-CV25-6084708S, 2026 WL 751813, at *1–2, *9–10 (Conn. Super. Ct. Mar. 9, 2026) (unpublished).