Legal and Economic Analysis of “Risk of Future Economic Harm” Theories in Data Breach Litigation
In data breach litigation, plaintiffs often include allegations that they are facing an increased risk of future harm as a result of the data breach. In other words, plaintiffs allege that one way in which they have been harmed is that the exfiltration of data about them has increased the risk that, in the future, they will suffer some negative outcome (e.g., their identity may be stolen, their accounts may be hacked, they may become the victim of a phishing scam, etc.).
Traditionally, plaintiffs have relied on allegations of an increased risk of future harm, to varying degrees of success, to establish an injury-in-fact sufficient to incur Article III standing or to satisfy the damages element of their substantive claims. Courts acknowledge that “[e]vidence of a mere data breach does not, standing alone, satisfy the requirements of Article III standing.”2 But where a plaintiff plausibly alleges “an imminent and substantial risk of future misuse” of the plaintiff’s personally identifiable information (or “PII”), based on the specific factual allegations made in the complaint, that can satisfy Article III’s injury-in-fact requirement, “at least as to injunctive relief.”3
In recent cases, plaintiffs whose allegations of a sufficiently imminent and substantial risk of future harm advanced beyond a motion to dismiss have attempted to rely heavily on those allegations to support their motions for class certification. They argue that these allegations can support a classwide damages theory that all individuals whose personal information was allegedly involved in the data breach at issue are now facing an increased risk of future harm and should be provided with compensation in the amount of the cost of purchasing commercial identity protection products well into the future to guard against that risk. This damages theory has been offered by Plaintiffs in several large data breach class actions, including a recent case filed against Accellion.
The full piece, co-authored by Gavin Reinke from Alston & Bird, can be found in the July 2026 issue of the CPI TechREG chronicle. The full article can also be read in PDF form here.
CITATIONS
[2] Tsao v. Captiva MVP Restaurant Partners, LLC, 986 F.3d 1332, 1344 (11th Cir. 2021).
[3] Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365, 375-76 (1st Cir. 2023).
