Court Breaks New Ground on ID Theft, but Lack of Risk Dooms Case

The risk of identity theft or fraud after a data breach may be grounds to sue, but an employee of a veteran’s counseling center failed to show she was put at risk by an internal email her employer sent to all employees that included her Social Security number and other personal information, the Second Circuit said Monday.

Ruling on an issue of first impression, the court held that plaintiffs may establish standing based on an increased risk of identity theft or fraud following the unauthorized disclosure of their data.

But plaintiff Devonne McMorris didn’t show that her personally identifiable information ...