PRECEDENTIAL
UNITED STATES COURT OF APPEALS FOR THE THIRD CIRCUIT ____________
No. 21-1506 ____________
JENNIFER CLEMENS, Appellant
v.
EXECUPHARM INC.; PAREXEL INT’L CORP. ____________
On Appeal from the United States District Court for the Eastern District of Pennsylvania (Civil No. 2-20-cv-03383) District Judge: Honorable Gerald J. Pappert ____________
Argued December 14, 2021 ____________
Before: GREENAWAY, JR., KRAUSE, and PHIPPS, Circuit Judges.
(Filed: September 2, 2022) Mark S. Goldman Goldman Scarlato & Penny 161 Washington Street 8 Tower Bridge, Suite 1025 Conshohocken, PA 19428
J. Austin Moore [ARGUED] Norman E. Siegel Barrett J. Vahle Caleb J. Wagner Stueve Siegel Hanson 460 Nichols Road Suite 200 Kansas City, MO 64112
Counsel for Appellant
Shifali Baliga Kristine M. Brown Donald M. Houser [ARGUED] Alston & Bird 1201 West Peachtree Street One Atlantic Center, Suite 4900 Atlanta, GA 30309
Mathieu Shapiro Obermayer Rebmann Maxwell & Hippel 1500 Market Street Centre Square West, 34th Floor Philadelphia, PA 19102
Counsel for Appellees
2 ____________
OPINION OF THE COURT ___________
GREENAWAY, JR., Circuit Judge.
In this appeal, Jennifer Clemens asks us to reverse the District Court’s dismissal of her complaint seeking equitable and monetary relief in connection with a data breach that resulted in the publication of her sensitive personal information on the Dark Web. Clemens argues that her injury was sufficiently imminent to constitute an injury-in-fact for purposes of standing. We agree. Accordingly, we will vacate the judgment of the District Court and remand for consideration of the merits.
I. Background1
Clemens is a former employee of ExecuPharm, Inc. (“ExecuPharm” or “the Company”), a subsidiary of the global biopharmaceutical company Parexel International Corp. (“Parexel”). As a condition of her employment, Clemens was required to provide ExecuPharm with sensitive personal and financial information, including her address, social security
1 Where, as here, the challenge to a District Court’s subject matter jurisdiction was made on the face of the pleadings, we accept all “well-pleaded factual allegations as true and draw all reasonable inferences” in favor of the plaintiff. In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 633 (3d Cir. 2017).
3 number, bank and financial account numbers, insurance and tax information, her passport, and information relating to her husband and child. In exchange, Clemens’s employment agreement provided that ExecuPharm would “take appropriate measures to protect the confidentiality and security” of this information. J.A. 41 ¶ 58. Based on the complaint’s allegations, ExecuPharm did not perform its obligation.
After Clemens had left ExecuPharm, a hacking group known as CLOP accessed ExecuPharm’s servers through a phishing attack in March 2020, stealing sensitive information pertaining to current and former employees, including Clemens. Specifically, the stolen information contained social security numbers, dates of birth, full names, home addresses, taxpayer identification numbers, banking information, credit card numbers, driver’s license numbers, sensitive tax forms, and passport numbers. In addition to exfiltrating the data, CLOP installed malware to encrypt the data stored on ExecuPharm’s servers. Then, CLOP held the decryption tools for ransom, threatening to release the information if ExecuPharm did not pay the ransom. Either because ExecuPharm refused to pay or for nefarious reasons unknown, the hackers made good on their threat and posted the data on underground websites located on the Dark Web, which is “a portion of the Internet that is intentionally hidden from search engines and requires the use of an anonymizing browser to be accessed. It is most widely used as an underground black market where individuals sell illegal products like . . . sensitive stolen data that can be used to commit identity theft or fraud.” J.A. 25 ¶ 15. Screenshots by an Israel-based intelligence firm confirm that CLOP made available for download at least one archive containing nearly 123,000 files and 162 gigabytes of
4 data pertaining to ExecuPharm and Parexel, including sensitive employee information.
Throughout March and April of 2020, ExecuPharm provided periodic updates to current and former employees to inform them of the breach and encourage them to take precautionary measures. ExecuPharm appreciated the risks, cautioning current and former employees that “[u]nauthorized access to [the compromised] information may potentially lead to the misuse of [their] personal data to impersonate [them] and/or to commit, or allow third parties to commit, fraudulent acts such as securing credit in [their] name.” J.A. 30 ¶ 28.
To mitigate potential harm, Clemens took immediate action. She conducted a review of her financial records and credit reports for unauthorized activity; placed fraud alerts on her credit reports; transferred her account to a new bank; enrolled in ExecuPharm’s complimentary one-year credit monitoring services; and purchased three-bureau credit monitoring services for herself and her family for $39.99 per month for additional protection. As a result of the breach, Clemens alleges that she has sustained a variety of injuries— primarily the risk of identity theft and fraud—in addition to the investment of time and money to mitigate potential harm.
Seeking redress, Clemens brought suit against ExecuPharm and Parexel in the United States District Court for the Eastern District of Pennsylvania. She sought to represent herself and a class of all others whose personal information was compromised, as well as a subclass of current and former ExecuPharm employees whose employment agreements promised that the Company would take appropriate measures to protect their personal data. She invoked the subject matter
5 jurisdiction of the District Court under the Class Action Fairness Act, 28 U.S.C. § 1332(d).
She asserted claims for negligence (Count I), negligence per se (Count II), and breach of implied contract (Count III) against both Defendants. She also asserted claims for breach of contract (Count IV), breach of fiduciary duty (Count V), and breach of confidence (Count VI) against ExecuPharm. Lastly, she sought a declaratory judgment that Defendants’ existing data security measures fail to comply with their fiduciary duties of care and that instructs them to implement and maintain industry-standard measures.
ExecuPharm and Parexel filed a motion to dismiss the complaint under Federal Rule of Civil Procedure 12(b)(6). The District Court ordered the parties to submit supplemental briefing regarding Clemens’s standing, and, after receiving that briefing, granted the motion to dismiss on February 25, 2021 based on lack of Article III standing. Specifically, the District Court stated that it sought to follow our “bright line” rule providing that allegations of an increased risk of identity theft resulting from a security breach are insufficient for standing. J.A. 9 (quoting In re Rutter’s Inc. Data Sec. Breach Litig., 511 F. Supp. 3d 514, 525 (M.D. Pa. 2021)). Applying our decision in Reilly v. Ceridian Corp., 664 F.3d 38 (3d Cir. 2011), the District Court concluded that Clemens’s risk of future harm was not imminent, but “speculative,” because she had not yet experienced actual identity theft or fraud. J.A. 9-11. This conclusion also meant that any money Clemens spent to mitigate the speculative risk was likewise insufficient to confer standing. The District Court additionally held that, even if ExecuPharm breached the employment agreement, it would not have automatically given Clemens standing to assert her
6 breach of contract claim. Clemens timely appealed and seeks vacatur of the District Court's dismissal of her complaint.
II. Applicable Law2
A. Article III Standing Requirements
Article III standing requires a plaintiff to demonstrate: “(1) that he or she suffered an injury in fact that is concrete, particularized, and actual or imminent, (2) that the injury was caused by the defendant, and (3) that the injury would likely be redressed by the requested judicial relief.”3 Thole v. U.S. Bank N.A., 140 S. Ct. 1615, 1618 (2020) (citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61 (1992)). Only the first two prongs are disputed on appeal.
a. Injury-in-fact: Imminent
2 The District Court had jurisdiction over the underlying putative class action pursuant to 28 U.S.C. § 1332(d). We have jurisdiction pursuant to 28 U.S.C. § 1291. 3 Our concurring colleague suggests that because Clemens “brings causes of action ‘of the sort traditionally amenable to, and resolved by, the judicial process,’” we need not apply the typical tri-partite standing analysis in this case. Concurring Opinion at 5 (quoting Uzuegbunam v. Preczewski, 141 S. Ct. 792, 798 (2021)). We disagree, and apply this tri-partite approach consistent with binding precedent. See, e.g., Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61 (1992) (citations omitted); Thorne v. Pep Boys Manny Moe & Jack Inc., 980 F.3d 879, 885 (3d Cir. 2020) (quoting Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016)).
7 With regard to the injury-in-fact prong, the injury must be “actual or imminent, not ‘conjectural’ or ‘hypothetical.’” Lujan, 504 U.S. at 560 (citations omitted). That “actual or imminent” is disjunctive is critical: it indicates that a plaintiff need not wait until he or she has actually sustained the feared harm in order to seek judicial redress, but can file suit when the risk of harm becomes imminent. This is especially important in the data breach context, where the disclosure of the data may cause future harm as opposed to currently felt harm. In this way, depending on the nature of the data at issue, claims flowing from a data breach can differ from traditional tort claims like defamation or invasion of privacy. While a claim arising from a data breach may share some commonalities with such torts—e.g., in that it may involve the publication of information to a third party or unauthorized access to private information—the latter claims involve actual injury. A claim for defamation, for instance, rests on the “reputational harm” that flows from the publication of a statement “that would subject [the victim] to hatred, contempt, or ridicule.” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2208- 09 (2021) (quoting Milkovich v. Lorain Journal Co., 497 U.S. 1, 13 (1990)). And a claim for invasion of privacy contemplates that the exposure “cause[s] mental suffering, shame or humiliation” to the victim. Pro Golf Mfg., Inc. v. Tribune Rev. Newspaper Co., 809 A.2d 243, 248 (Pa. 2002). By contrast, the type of data involved in a data breach may be such that mere access and publication do not cause inherent harm to the victim. Reilly, 664 F.3d at 42. Even then, however, it can still poise the victim to endure the kind of future harm that qualifies as “imminent.”
Indeed, allegations of future injury “suffice if the threatened injury is ‘certainly impending’ or there is a
8 ‘substantial risk’ that the harm will occur.” Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158 (2014) (quoting Clapper v. Amnesty Int’l USA, 568 U.S. 398, 414 n.5 (2013)). A substantial risk means a “‘realistic danger of sustaining a direct injury.’” Pennell v. City of San Jose, 485 U.S. 1, 8 (1988) (quoting Babbitt v. United Farm Workers Nat’l Union, 442 U.S. 289, 298 (1979)). While plaintiffs are not required “to demonstrate that it is literally certain that the harms they identify will come about,” a “possible future injury”—even one with an “objectively reasonable likelihood” of occurring— is not sufficient. Clapper, 568 U.S. at 409-10, 414 n.5 (emphasis omitted).
In Reilly, we considered whether an alleged risk of future identity theft or fraud stemming from a data breach in which an unknown hacker potentially accessed sensitive personal and financial information from a company’s network was sufficiently imminent for purposes of standing. 664 F.3d 38 (3d Cir. 2011). We held that it was not. We observed that the injury alleged was a future injury as opposed to a present injury. Id. at 42. Consistent with Susan B. Anthony List, that an injury will occur in the future is not fatal to standing. 573 U.S. at 158. But where the future injury is also hypothetical, there can be no imminence and therefore no injury-in-fact.
Because the plaintiffs in Reilly alleged a future, hypothetical risk of identity theft or fraud, we concluded that they had not suffered an injury-in-fact. Specifically, the risk was “dependent on entirely speculative, future actions of an unknown third-party.” 664 F.3d at 42. Further, we could not “describe how the [Appellants] will be injured . . . without beginning our explanation with the word ‘if’: if the hacker read, copied, and understood the hacked information, and if the
9 hacker attempts to use the information, and if he does so successfully.” Id. at 43.
In holding that the Reilly plaintiffs lacked standing, we did not create a bright line rule precluding standing based on the alleged risk of identity theft or fraud. Such a rule would require plaintiffs to wait until they had sustained an actual injury to bring suit. This would directly contravene the Supreme Court’s holding in Susan B. Anthony List, which authorizes suits based on a “‘substantial risk’ that the harm will occur.” 573 U.S. at 158 Instead, Reilly requires consideration of whether an injury is present versus future, and imminent versus hypothetical.
Courts rely on a number of factors in determining whether an injury is imminent—meaning it poses a substantial risk of harm—versus hypothetical in the data breach context. These non-exhaustive factors can serve as useful guideposts, with no single factor being dispositive to our inquiry. Among them is whether the data breach was intentional. See, e.g., McMorris v. Carlos Lopez & Assocs., 995 F.3d 295, 301-03 (2d Cir. 2021) (holding that the intentional nature of an attack renders standing more likely); Pisciotta v. Old Nat’l Bancorp, 499 F.3d 629, 632 (7th Cir. 2007) (finding standing where a breach was “sophisticated, intentional and malicious”); In re U.S. Off. of Pers. Mgmt. Data Sec. Breach Litig., 928 F.3d 42, 58-59 (D.C. Cir. 2019) (noting that “hackers targeted—and extracted data”); In re Zappos.com, Inc., 888 F.3d 1020, 1029 n.13 (9th Cir. 2018) (emphasizing that hackers “specifically targeted” the data to distinguish from a case in which there was no substantial risk of identity theft).
10 Courts also consider whether the data was misused.4 See, e.g., McMorris, 995 F.3d at 301-02 (holding that misuse cuts towards standing); Krottner v. Starbucks Corp., 628 F.3d 1139, 1142-43 (9th Cir. 2010) (finding standing where a laptop with personal unencrypted data was stolen and a plaintiff alleged that someone “attempted to open a bank account in his name”); Remijas v. Neiman Marcus Grp., 794 F.3d 688, 692- 94 (7th Cir. 2015) (finding standing where plaintiff alleged that personal data had “already been stolen” and that 9,200 people had “incurred fraudulent charges”).
Of note, misuse is not necessarily required. The Seventh Circuit has found standing despite no allegations of misuse, holding that it was sufficient that a data breach “increas[ed] the risk of future harm that the plaintiff would have otherwise faced, absent the defendant’s actions.” Pisciotta, 499 F.3d at 634.
Further, courts consider whether the nature of the information accessed through the data breach could subject a plaintiff to a risk of identity theft. See, e.g., McMorris, 995 F.3d at 302. For instance, disclosure of social security
4 In accordance with Spokeo, Inc. v. Robins, which provides that “named plaintiffs who represent a class ‘must allege and show that they personally have been injured,’” our inquiry should focus on the misuse of information particular to the plaintiff—not other members of the class. 578 U.S. 330, 338 n.6 (2016) (quoting Simon v. E. Ky. Welfare Rts. Org., 426 U.S. 26, 40 n.20 (1976)); but see McMorris v. Carlos Lopez & Assocs., 995 F.3d 295, 301-02 (2d Cir. 2021) (holding that any misuse of the data, even if the class representative has not yet been affected, cuts towards standing).
11 numbers, birth dates, and names is more likely to create a risk of identity theft or fraud. Id. (citing Attias v. CareFirst, Inc., 865 F.3d 620, 628 (D.C. Cir. 2017)). By contrast, the disclosure of financial information alone, without corresponding personal information, is insufficient. See, e.g., In re SuperValu, Inc., 870 F.3d 763, 770-71 (8th Cir. 2017); Tsao v. Captiva MVP Rest. Partners, 986 F.3d 1332, 1343 (11th Cir. 2021). This is because financial information alone generally cannot be used to commit identity theft or fraud. See In re SuperValu, Inc., 870 F.3d at 770-71.
b. Injury-in-fact: Concrete
The injury-in-fact prong of the standing analysis also requires that the alleged injury be “concrete,” meaning “real, and not abstract.” Spokeo, Inc. v. Robins, 578 U.S. 330, 340 (2016) (internal quotation marks omitted); see Lujan, 504 U.S. at 560
The Supreme Court recently clarified in TransUnion LLC v. Ramirez that “[c]entral to assessing concreteness is whether the asserted harm has a ‘close relationship’ to a harm traditionally recognized as providing a basis for a lawsuit in American courts—such as physical harm, monetary harm, or various intangible harms.” 141 S. Ct. at 2200 (citing Spokeo, 578 U.S. at 340-41). The fact that an injury is intangible—that is, it does not represent a purely physical or monetary harm to the plaintiff—does not prevent it from nonetheless being concrete, as various intangible harms have been “traditionally recognized as providing a basis for lawsuits in American courts.” Id. at 2204 (citing Spokeo, 578 U.S. at 340-41). For example, certain privacy harms, like the disclosure of private information and intrusion upon seclusion, though intangible, have long given rise to tort claims. Id.
12 The first step in assessing concreteness is to ask whether the asserted harm is adequately analogous to a harm traditionally recognized as giving rise to a lawsuit. In the data breach context, there are several potential parallels to harms traditionally recognized at common law, depending on the precise theory of injury the plaintiff puts forward. For example, if the theory of injury is an unauthorized exposure of personally identifying information that results in an increased risk of identity theft or fraud, that harm is closely related to that contemplated by privacy torts that are “well-ensconced in the fabric of American law.” In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 638-39 (3d Cir. 2017) (quoting David A. Elder, Privacy Torts § 1:1 (2016)).5 Though such an injury is intangible, it is nonetheless concrete.
5 At argument, ExecuPharm contended that any analogies to the traditional privacy torts fail because the stolen data here was not the sort of inherently private information that could have given rise to a successful privacy claim at common law. For example, the “private facts” contemplated in the tort of public disclosure of private facts would not include the transactional employee data that was exposed here.
Even if we were to accept the premise that this particular combination of stolen information could not form the basis for common law privacy tort liability—and we have no occasion to address that issue here—this mistakes the nature of the inquiry required for an assessment of Article III standing. In looking for a common law analog to an asserted theory of harm, “we do not require an exact duplicate.” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2209 (2021). Indeed, in TransUnion itself, the Supreme Court cites Davis v. Fed. Election Comm’n, in which the information disclosed was only
13 TransUnion also made clear, though, that the mere existence of a common law analog for the asserted harm does not necessarily end our inquiry. In a suit premised on the “mere risk of future harm”—that is, where the alleged injury- in-fact is “imminent” rather than “actual”—we must also consider the type of relief sought. TransUnion LLC, 141 S. Ct. at 2210-11. Where the plaintiff seeks injunctive relief, the allegation of a risk of future harm alone can qualify as concrete as long as it “is sufficiently imminent and substantial.” Id. at 2210 (citing Clapper, 568 U.S. at 414 n.5). However, where the plaintiff seeks only damages, something more is required. Specifically, that plaintiff can satisfy concreteness where “the exposure to the risk of future harm itself causes a separate concrete harm.” Id. at 2211.
the fact that the plaintiff had spent a certain amount of personal funds in his campaign, 554 U.S. 724, 733 (2008), as a case in which the asserted intangible harm was concrete because it was closely related to the “disclosure of private information.” TransUnion LLC, 141 S. Ct. at 2204.
Likewise, we are content for now that the exposure of the type of information that was alleged here—information employees would normally choose to keep to themselves and would reasonably not want to make publicly available—and the resulting substantial risk of identity theft or fraud is a harm that bears at least a “close relationship” to harms traditionally recognized in privacy torts. Id. at 2208 (citing Spokeo, 578 U.S. at 341). Accordingly, the asserted injury supports Article III standing—and whether a plaintiff has successfully made out claims under a particular cause of action is a separate question.
14 The Supreme Court did not reach the question of what separate harms might qualify as concrete to support a substantial-risk theory of future harm in an action for damages, but it did indicate that “a plaintiff’s knowledge that he or she is exposed to a risk of future . . . harm could cause its own current emotional or psychological harm,” which could be sufficiently analogous to the tort of intentional infliction of emotional distress. Id. at 2211 n.7.
Following TransUnion’s guidance, we hold that in the data breach context, where the asserted theory of injury is a substantial risk of identity theft or fraud, a plaintiff suing for damages can satisfy concreteness as long as he alleges that the exposure to that substantial risk caused additional, currently felt concrete harms. For example, if the plaintiff’s knowledge of the substantial risk of identity theft causes him to presently experience emotional distress or spend money on mitigation measures like credit monitoring services, the plaintiff has alleged a concrete injury.
III. Analysis
We exercise de novo review over the District Court’s dismissal of a complaint for lack of subject matter jurisdiction. Horizon Healthcare, 846 F.3d at 632.
Clemens’s complaint asserts contract, tort, and secondary contract claims—each based on the same underlying facts. “[A] plaintiff must demonstrate standing for each claim he seeks to press.” DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 352 (2006). Accepting the well-pleaded factual allegations in Clemens’s complaint as true, we hold that Clemens has standing to assert her contract, tort, and secondary
15 contract claims. Her alleged injuries are sufficiently imminent and concrete to qualify as injuries-in-fact.
A. Contract Claims
The District Court erred in dismissing Clemens’s contract claims, which are raised in Counts III (breach of implied contract) and IV (breach of contract). These claims arise from her employment agreement with ExecuPharm. When Clemens provided ExecuPharm with her sensitive personal information upon hire, ExecuPharm expressly contracted to “take appropriate measures to protect the confidentiality and security” of this information in Clemens’s employment agreement. J.A. 40-41 ¶¶ 57-58. Clemens alleged that ExecuPharm breached this express provision when it failed to adequately protect her information, allowing CLOP to steal sensitive employee information, hold it for ransom, and publish it on the Dark Web. Moreover, Clemens has alleged an injury stemming from the breach—the risk of identity theft or fraud—that is sufficiently imminent and concrete.6
As employment agreements have become routine, information security provisions like the one in the instant case have assumed a new prominence. Likewise, the failure to uphold these provisions—particularly in the digital age—can yield uniquely drastic consequences. Namely, victims of a data breach must live with the perpetual, well-founded fear and risk
6 Because Clemens has alleged an injury separate and apart from the breach of contract itself, we have no occasion to reach her additional argument that the breach of contract alone is a sufficiently imminent and concrete injury that confers standing for her to raise her contract claims.
16 that hackers will misuse their data. The only way to allay those concerns is to invest time and money into precautionary measures that could mitigate the potential misuse, like changing one’s banking information. But there is no guarantee that mitigative measures will be effective—especially given that some information, such as our names and social security numbers, generally stay with us for life.
In Reilly, we had occasion to discuss the contours of the injury-in-fact requirement in the data breach context. This time, the alleged injury-in-fact is far more imminent. Whereas Reilly involved an unknown hacker who potentially gained access to sensitive information, 664 F.3d at 42-43; here, a known hacker group named CLOP accessed Clemens’s sensitive information. CLOP is a sophisticated ransomware group that is notorious for encrypting companies’ internal data and placing in every digital folder a text file called “ClopReadMe.txt” that contains a message demanding ransom. J.A. 24-25 ¶ 14. These attacks are particularly threatening given that, according to a data specialist, there are “no known decryption tools for CLOP ransomware.” J.A. 35 ¶ 40.
In this instance, CLOP launched its signature attack against ExecuPharm: it encrypted ExecuPharm’s information and held it for ransom. Further, while the injury to the plaintiffs in Reilly depended upon a string of hypotheticals being borne out, 664 F.3d at 43, CLOP has already published Clemens’s data on the Dark Web, a platform that facilitates criminal activity worldwide. Clemens has alleged that the Dark Web is “most widely used as an underground black market where individuals sell illegal products like drugs, weapons, counterfeit money, and sensitive stolen data that can be used to commit identity theft or fraud.” J.A. 25 ¶ 15.
17 Because we can reasonably assume that many of those who visit the Dark Web, and especially those who seek out and access CLOP’s posts, do so with nefarious intent, it follows that Clemens faces a substantial risk of identity theft or fraud by virtue of her personal information being made available on underground websites. This set of facts clearly presents a more imminent injury than the ones we deemed to establish only a hypothetical injury in Reilly.
Adopting and applying the factors that our Sister Circuits consider in determining imminence in the data breach context confirms this point. CLOP intentionally gained access to and misused the data: it launched a sophisticated phishing attack to install malware, encrypted the data, held it for ransom, and published it. See McMorris, 995 F.3d at 301-03; Remijas, 794 F.2d at 693-94; Attias, 865 F.3d at 628-29. The data was also the type of data that could be used to perpetrate identity theft or fraud. Not only did it contain financial information— which, on its own, could subject the breach victims to credit card fraud—but it also contained social security numbers, dates of birth, full names, home addresses, taxpayer identification numbers, banking information, credit card numbers, driver’s license numbers, sensitive tax forms, and passport numbers. This combination of financial and personal information is particularly concerning as it could be used to perpetrate both identity theft and fraud. See McMorris, 995 F.3d at 302; cf. In re SuperValu, Inc., 870 F.3d at 770-71 (noting that financial information, without accompanying personally identifying information, is unlikely to give rise to identity theft).
Together, these factors show that Clemens has alleged a “‘substantial risk’ that the harm will occur” sufficient to establish an “imminent” injury. Anthony List, 573 U.S. at 158
18 (quoting Clapper, 568 U.S. at 414 n.5).7 Further, that injury is concrete, because the harm involved is sufficiently analogous to harms long recognized at common law like the “disclosure of private information.” TransUnion LLC, 141 S. Ct. at 2204. And although the substantial risk of identity theft is a risk of future harm and this is a suit for damages, which may under other circumstances pose a problem for concreteness, id. at 2210-11, Clemens has alleged several additional concrete harms that she has already experienced as a result of that risk (that is, her emotional distress and related therapy costs and the time and money involved in mitigating the fallout of the data breach). Thus, her injury is also “concrete.”
In addition to proving injury-in-fact, standing also requires Clemens to prove traceability and “that the injury would likely be redressed by the requested judicial relief.” Thole, 140 S. Ct. at 1618. Traceability means that the injury was caused by the challenged action of the defendant as opposed to an independent action of a third party. Lujan, 504 U.S. at 560. We have yet to articulate a single standard for establishing this “causal relationship.” See Khodara Env’t, Inc. v. Blakely, 376 F.3d 187, 195 (3d Cir. 2004). Instead, we have held that but-for causation is sufficient to satisfy traceability. See, e.g., Edmonson v. Lincoln Nat’l Life Ins. Co., 725 F.3d 406, 418 (3d Cir. 2013). So, too, is concurrent
7 At Oral Argument, ExecuPharm agreed that, in the abstract, facts satisfying the imminence inquiry yet falling short of actual harm could confer standing in a data breach case. However, it was unable to articulate such a scenario. If the facts in this case—which fall short of actual harm—do not meet the test for imminence, we would be hard pressed to conjure up a set of facts that would.
19 causation. See, e.g., Const. Party of Pa. v. Aichele, 757 F.3d 347, 366 (3d Cir. 2014).
Here, Clemens has alleged facts that establish traceability, at least at the pleading stage. Specifically, she has identified her injuries as “a direct and proximate result of Defendants’ breach” of contract: ExecuPharm’s failure to safeguard her information enabled CLOP to publish it on the Dark Web as part of the stolen dataset of ExecuPharm and Parexel employee information. J.A. 65 ¶ 141, J.A. 66 ¶ 146. Likewise, Clemens satisfied redressability. As we observed in Reilly, the injuries caused by a data breach are “easily and precisely compensable with a monetary award,” 664 F.3d at 45-46, and Clemens is seeking those damages to compensate for her losses here. This traceability and redressability analysis applies with equal force to the tort and secondary contract claims as well.
We will vacate the District Court’s dismissal regarding these claims and remand for a consideration of the merits of these claims.
B. Tort Claims
In addition, the District Court erred in dismissing Clemens’s tort claims, which are raised in Counts I (negligence) and II (negligence per se). The tort claims have the same factual genesis as the contract claims: namely, that ExecuPharm breached its duty to adequately safeguard sensitive employee information, which allowed CLOP to steal and misuse the data, and subjected Clemens to a substantial risk of identity theft or fraud.
20 In an increasingly digitalized world, an employer’s duty to protect its employees’ sensitive information has significantly broadened. Information security is no longer a matter of keeping a small universe of sensitive, hard-copy paperwork under lock and key. Now, employers maintain massive datasets on digital networks. In order to protect the data, they must implement appropriate security measures and ensure that those measures continue to comply with ever- changing industry standards.
Failure to satisfy this duty could leave employer networks vulnerable to data breach, subjecting data breach victims to a unique kind of harm: the perpetual risk of identity theft or fraud, necessitating the investment of time and money to hopefully mitigate that risk. With rare exception, where multiple pieces of personally identifying information about a given consumer are stolen and then publicized, one can draw a reasonable inference that the victims of the data breach face an imminent risk of identity theft or fraud. When that information is made available for download on the Dark Web—a platform that exists primarily to facilitate illegal activity—the risk that a criminal will access it and use it for a nefarious purpose is particularly acute.
As discussed supra in Section III Part A, Clemens’s alleged risk of identity theft or fraud is sufficiently imminent. Compared to Reilly, the risk is not hypothetical: a known hacking group intentionally stole the information, misused it, ultimately published it on the Dark Web, and the sensitive information is the type that could be used to perpetrate identity theft or fraud. Consistent with Anthony List, Clemens cannot be required to wait until she has experienced actual identity theft or fraud before she can sue; the “substantial risk” that she has established is enough. 573 U.S. at 158. Her asserted injury
21 is also concrete, as intangible harms like the disclosure of private information qualify as concrete. See TransUnion LLC, 141 S. Ct. at 2204.
Because Clemens has sufficiently asserted her standing to bring her tort claims, we will vacate the District Court’s dismissal and remand for a consideration of the merits of those claims.
C. Secondary Contract Claims
Finally, the District Court erred in dismissing Clemens’s secondary contract claims which are raised in Counts V (breach of fiduciary duty) and VI (breach of confidence). The breach of the duties underlying these claims and the resulting harm are based on the same facts as the contract and tort claims. As with the prior claims, the District Court identified the failure to allege an imminent injury as fatal to standing.
Because we have rejected the contention that a risk of identity theft or fraud cannot qualify as sufficiently imminent, and hold that Clemens has alleged an injury-in-fact, we likewise will vacate the District Court’s decision and remand for a determination of the merits of these claims.
IV. Conclusion
Clemens has standing to assert her contract, tort, and secondary contract claims. For all claims, she has alleged a future injury—the risk of identity theft or fraud—that is sufficiently imminent. The breach was conducted by a known hacking group CLOP, which intentionally stole the information, held it for ransom, and published it to the Dark
22 Web, thereby making it accessible to criminals worldwide. The nature of the information—a combination of personal and financial data—is the type that can be used to perpetrate identity theft or fraud. Given that intangible harms like the publication of personal information can qualify as concrete, and because plaintiffs cannot be forced to wait until they have sustained the threatened harm before they can sue, the risk of identity theft or fraud constitutes an injury-in-fact. Accordingly, we will vacate the judgment of the District Court on all counts and remand for consideration of the merits.
23 Clemens v. ExecuPharm Inc., No. 21-1506 PHIPPS, Circuit Judge, concurring in the judgment
The Majority Opinion labors through the modern tripartite test for Article III standing and concludes that Jennifer Clemens has standing to assert common-law claims for negligence, breach of contract, breach of confidence, and breach of fiduciary duty. The modern test for Article III standing, however, typically governs claims seeking to vindicate constitutional or statutory rights.1 It has always been the rule that a litigant has standing in federal court to pursue a cause of action that was recognized as well suited for judicial resolution at the time of the Constitution’s ratification:
When a suit is made of “the stuff of the traditional actions at common law tried by the courts at Westminster in 1789” and is brought within the bounds of federal jurisdiction, the responsibility for deciding that suit rests with Article III judges in Article III courts.
1 See, e.g., Spokeo, Inc. v. Robins, 578 U.S. 330, 338–39 (2016); Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013); Summers v. Earth Island Inst., 555 U.S. 488, 493 (2009); Friends of the Earth, Inc. v. Laidlaw Env’t Servs. (TOC), Inc., 528 U.S. 167, 180–81 (2000); Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992); Allen v. Wright, 468 U.S. 737, 751 (1984); Valley Forge Christian Coll. v. Ams. United for Separation of Church & State, Inc., 454 U.S. 464, 472 (1982); see also 20 Charles Alan Wright & Mary Kay Kane, Federal Practice and Procedure: Federal Practice Deskbook § 14 (2d ed. Apr. 2022 update) (“The law of standing is almost exclusively concerned with public-law questions involving determinations of constitutionality and review of administrative or other governmental action.”). Stern v. Marshall, 564 U.S. 462, 484 (2011) (citation omitted) (quoting N. Pipeline Constr. Co. v. Marathon Pipe Line Co., 458 U.S. 50, 90 (1982) (Rehnquist, J., concurring in judgment)); see also Ariz. Christian Sch. Tuition Org. v. Winn, 563 U.S. 125, 132 (2011) (“[Article III] restricts the federal judicial power ‘to the traditional role of the Anglo-American courts.’” (quoting Summers v. Earth Island Inst., 555 U.S. 488, 492 (2009))); Commodity Futures Trading Comm’n v. Schor, 478 U.S. 833, 854 (1986) (“[P]rivate, common law rights were historically the types of matters subject to resolution by Article III courts.”); N. Pipeline Constr. Co., 458 U.S. at 86 n.39 (plurality opinion) (stating that, “in the Framers’ view, the tasks of [Article III] courts, for which independence was an important safeguard, included . . . matters of common law”); Tenn. Elec. Power Co. v. Tenn. Valley Auth., 306 U.S. 118, 137 (1939) (holding that litigants have standing when “the right invaded is a legal right,” such as “one of property, one arising out of contract, [or] one protected against tortious invasion”); Murray’s Lessee v. Hoboken Land & Improvement Co., 59 U.S. 272, 284 (1855) (explaining that “any matter which, from its nature, is the subject of a suit at the common law, or in equity” is within “judicial cognizance”).2
The modern test builds on that principle by using traditionally recognized causes of action as a foundation for its comparative analysis. The premise of the test is that litigants
2 See also Erwin Chemerinsky, Federal Jurisdiction 74 (8th ed. 2020) (“Injury to rights recognized at common law – property, contracts, and torts – are sufficient for standing purposes.”); Cass R. Sunstein, Standing and the Privatization of Public Law, 88 Colum. L. Rev. 1432, 1439 (1988) (explaining that “the existence of an interest protected at common law [has been] sufficient to confer standing”).
2 have standing for claims traditionally recognized as well suited for judicial resolution. See TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2204 (2021) (explaining that the concreteness component of the injury-in-fact element requires that a statutory cause of action bear a “close relationship” to a “historical or common-law analogue”).3 Thus, the modern test for Article III standing operates as a supplement to, not a substitute for, the rule that a litigant has Article III standing to bring a traditionally recognized cause of action in federal court.4
3 See also Hollingsworth v. Perry, 570 U.S. 693, 700 (2013) (“As used in the Constitution, [‘case’ and ‘controversy’] do not include every sort of dispute, but only those ‘historically viewed as capable of resolution through the judicial process.’” (quoting Flast v. Cohen, 392 U.S. 83, 95 (1968))); DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 342 (2006) (“[W]e must find that the question is presented in a ‘case’ or ‘controversy’ that is, in James Madison’s words, ‘of a Judiciary Nature.’” (quoting 2 Records of the Federal Convention of 1787 430 (Max Farrand ed., 1966))); Schlesinger v. Reservists Comm. to Stop the War, 418 U.S. 208, 220–21 (1974) (explaining that federal courts can resolve only disputes that take “a form traditionally capable of judicial resolution”). 4 See F. Andrew Hessick, Standing, Injury in Fact, and Private Rights, 93 Cornell L. Rev. 275, 277 (2008) (“The purpose of the factual injury requirement is to ensure that plaintiffs are asserting their own private rights. The requirement therefore is superfluous in cases alleging the violation of a private right.”); 20 Charles Alan Wright & Mary Kay Kane, Federal Practice and Procedure: Federal Practice Deskbook § 14 (2d ed. Apr. 2022 update) (“The person suing for breach of contract or for a tort must be found to be the real party in interest, but in practice those suits are brought only by a person harmed by the supposed wrong, and standing to sue is self-evident. It is
3 The claims that Clemens pursues here – for negligence, breach of contract, breach of confidence, and breach of fiduciary duty – are traditional causes of action that were recognized as well suited for judicial resolution at the time of the Constitution’s adoption.5 She therefore has standing. Yet by applying the modern test for Article III standing when it is unnecessary to do so, the Majority Opinion gives the mistaken impression that the modern test replaces the original understanding of what constitutes a case or controversy subject to resolution in federal court.6
only when the question is of a public nature that the interested bystander is likely to attempt suit.”). 5 See Robert J. Kaczorowski, The Common-Law Background of Nineteenth-Century Tort Law, 51 Ohio St. L.J. 1127, 1129 (1990) (explaining that some negligence claims were “in the common law for centuries,” while others “primarily emerged in the last quarter of the seventeenth century”); Harold J. Berman & Charles J. Reid, Jr., The Transformation of English Legal Science: From Hale to Blackstone, 45 Emory L.J. 437, 460–61 (1996) (stating that “the common-law courts in the late seventeenth and early eighteenth centuries expanded the forms of action to cover . . . obligations arising from breach of contract”); Neil M. Richards & Daniel J. Solove, Privacy’s Other Path: Recovering the Law of Confidentiality, 96 Geo. L.J. 123, 136 (2007) (describing how “[l]egal remedies for divulging . . . confidential information began to emerge as early as the eighteenth century,” when “English courts of equity . . . fashion[ed] an action for breach of confidence”); Leonard I. Rotman, Fiduciary Law’s “Holy Grail”: Reconciling Theory and Practice in Fiduciary Jurisprudence, 91 B.U. L. Rev. 921, 922 (2011) (“Fiduciary law has been a part of the common law tradition since its crystallization in the landmark case of Keech v. Sandford in 1726.”). 6 In footnote three, the Majority Opinion asserts that its approach is consistent with binding precedent, but despite the
4 I cannot join that analysis, and I respectfully concur in the judgment only. It suffices for her Article III standing that Clemens brings causes of action “of the sort traditionally amenable to, and resolved by, the judicial process.” Uzuegbunam v. Preczewski, 141 S. Ct. 792, 798 (2021) (quoting Vt. Agency of Nat. Res. v. United States ex rel. Stevens, 529 U.S. 765, 774 (2000)); see also Stern, 564 U.S. at 494 (stating that “the most prototypical exercise of judicial power” is a court’s adjudication of “a common law cause of action”). Nothing more is needed.
abundance of precedent on Article III standing, the Majority Opinion identifies no Supreme Court case applying the modern test to a traditionally recognized cause of action.