RIPPLE, Circuit Judge.
Plaintiffs Luciano Pisciotta and Daniel Mills brought this action on behalf of a putative class of customers and potential customers of Old National Bancorp (“ONB”). They alleged that, through its website, ONB had solicited personal information from applicants for banking services, but had failed to secure it adequately. As a result, a third-party computer “hacker” was able to obtain access to the confidential information of tens of thousands of ONB site users. The plaintiffs sought damages for the harm that they claim to have suffered because of the security breach; specifically, they requested compensation for past and future credit monitoring services that they have obtained in response to the compromise of their personal data through ONB’s website. ONB answered the allegations and then moved for judgment on the pleadings under Rule 12(c). The district court granted ONB’s motion and dismissed the case. The plaintiffs timely appeal. For the reasons set forth in this opinion, we affirm the judgment of the district court.
I
BACKGROUND
A. Facts
ONB operates a marketing website on which individuals seeking banking services can complete online applications for accounts, loans and other ONB banking services. The applications differ depending on the service requested, but some forms require the customer or potential customer’s name, address, social security number, driver’s license number, date of birth, mother’s maiden name and credit card or other financial account numbers. In 2002 and 2004, respectively, Mr. Pisciotta and Mr. Mills accessed this website and entered personal information in connection
with their applications for ONB banking services.
In 2005, NCR, a hosting facility that maintains ONB’s website, notified ONB of a security breach. ONB then sent written notice to its customers. The results of the investigation that followed have been filed under seal in this court; for present purposes, it will suffice to note that the scope and manner of access suggests that the intrusion was sophisticated, intentional and malicious.
B. District Court Proceedings
Mr. Pisciotta and Mr. Mills, on behalf of a putative class of other ONB website users, brought this action in the United States District Court for the Southern District of Indiana. They named ONB and NCR as defendants and asserted negligence claims against both defendants as well as breach of implied contract claims by ONB and breach of contract by NCR. The plaintiffs alleged that:
[b]y failing to adequately protect [their] personal confidential information, [ONB and NCR] caused Plaintiffs and other similarly situated past and present customers to suffer substantial potential economic damages and emotional distress and worry that third parties will use [the plaintiffs’] confidential personal information to cause them economic harm, or sell their confidential information to others who will in turn cause them economic harm.
R.37 at 2.
In pleading their damages, the plaintiffs stated that they and others in the putative class “have incurred expenses in order to prevent their confidential personal information from being used and will continue to incur expenses in the future.”
Id.
at 4. Significantly, the plaintiffs did not allege any
completed direct
financial loss to their accounts as a result of the breach. Nor did they claim that they or any other member of the putative class
already had been
the victim of identity theft as a result of the breach. The plaintiffs requested “[c]ompensation for all economic and emotional damages suffered as a result of the Defendants’ acts which were negligent, in breach of implied contract or in breach of contract,” and “[a]ny and all other legal and/or equitable relief to which Plaintiffs ... are entitled, including establishing an economic monitoring procedure to insure [sic] prompt notice to Plaintiffs ... of any attempt to use their confidential personal information stolen from the Defendants.”
Id.
at 5-6.
NCR moved to dismiss for failure to state a claim; its motion was granted. This ruling has not been appealed. ONB, the remaining defendant, answered the second amended complaint. The plaintiffs moved for class certification. ONB then filed a motion for judgment on the pleadings under Federal Rule of Civil Procedure 12(c) and a memorandum in opposition to class certification.
The district court granted ONB’s motion for judgment on the pleadings and denied the plaintiffs’ motion for class certification as moot. Specifically, the district court concluded that the plaintiffs’ claims failed as a matter of law because “they have not alleged that ONB’s conduct caused them cognizable injury.” R.78 at 3. In support of its conclusion, the court noted that, under Indiana law, damages must be more than speculative; therefore, the plaintiffs’ allegations that they had suffered “substantial
potential
economic damages” did not state a claim.
Id.
(emphasis in original).
The district court looked to five cases from other district courts across the Country that had rejected claims for “the cost of credit monitoring as an alternative
award for what would otherwise be speculative and unrecoverable damages.”
Id.
Finding their reasoning persuasive, the district court concluded that “[t]he expenditure of money to monitor one’s credit is not the result of any present injury, but rather the anticipation of future injury that has not yet materialized.”
Id.
at 4 (citing
Forbes v. Wells Fargo Bank, N.A.,
420 F.Supp.2d 1018, 1021 (D.Minn.2006)). The court also concluded that, although not enumerated as a separate cause of action in the complaint, the plaintiffs had made allegations that could relate to a claim for negligent infliction of emotional distress; the court dismissed this claim as well. It noted that, as a matter of Indiana law, any such action was dependent on an underlying negligence claim.
Id.
at 5. Finally, the court concluded that there could be no action for breach of contract under Indiana law in the absence of an allegation of cognizable damages.
The plaintiffs then timely appealed the entry of judgment for ONB on the claims for negligence and breach of implied contract
and further asked that this court vacate the order denying class certification as moot.
II
DISCUSSION
We review a district court’s decision on a 12(c) motion de novo.
Moss v. Martin,
473 F.3d 694, 698 (7th Cir.2007). We take the facts alleged in the complaint as true, drawing all reasonable inferences in favor of the plaintiff.
Thomas v. Guardsmark, Inc.,
381 F.3d 701, 704 (7th Cir.2004). We review the judgment for the defendants by employing the same standard that we apply when reviewing a motion to dismiss under Rule 12(b)(6).
Guise v. BWM Mortgage, LLC,
377 F.3d 795, 798 (7th Cir.2004). The complaint must contain only “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed.R.Civ.P. 8(a)(2);
see also Conley v. Gibson,
355 U.S. 41, 47, 78 S.Ct. 99, 2 L.Ed.2d 80 (1957). There is no need for detailed factual allegations.
Conley,
355 U.S. at 47, 78 S.Ct. 99. However, the statement must “give the defendant fair notice of what the ... claim is and the grounds upon which it rests.”
Id.
“Factual allegations must be enough to raise a right to relief above the speculative level.”
Bell Atl. Corp. v. Twombly,
— U.S. -, 127 S.Ct. 1955, 1965, 167 L.Ed.2d 929 (2007);
see also Jennings v. Auto Meter Prods., Inc.,
495 F.3d 466, 472 (7th Cir.2007).
A. Jurisdiction
The plaintiffs filed this action in the district court under the Class Action Fairness Act of 2005, Pub.L. 109-2, § 4, 119 Stat. 4, 9 (codified at 28 U.S.C. § 1332(d)) (“CAFA”), on behalf of a putative class that includes residents of Indiana, Illinois, Kentucky, Missouri, Ohio and Tennessee. Under CAFA, the district court had jurisdiction over this action because “the matter in controversy exceeds the sum or value of $5,000,000, exclusive of interest and costs,” 28 U.S.C. § 1332(d)(2), and because at least one member of the proposed class is a citizen of a State different from ONB.
Id.
§ 1332(d)(2)(A). In short, subject to limitations not relevant here, CAFA allows for incomplete diversity.
Id:, cf. Strawbridge v. Curtiss,
3 Cranch 267, 7 U.S. 267, 2 L.Ed. 435 (1806) (interpreting the language of the general federal diversity statute to require complete diversity). In calculating the requisite amount in controversy, CAFA requires that the claims of
all the plaintiffs be aggregated. 28 U.S.C. § 1332(d)(6);
cf. In re Brand Name Prescription Drugs Antitrust Litig.,
123 F.3d 599, 607 (7th Cir.1997) (noting the otherwise applicable rule that aggregation is not permitted and, therefore, at least one plaintiff in a particular class must satisfy the jurisdictional minimum).
We have, of course, an independent responsibility to examine our subject matter jurisdiction.
See Steel Co. v. Citizens for a Better Env’t,
523 U.S. 83, 95, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998). As we have noted, in reaching the conclusion that dismissal was appropriate, the district court in this case relied on several cases from other district courts throughout the Country. Many of those cases have concluded that the federal courts lack jurisdiction because plaintiffs whose data has been compromised, but not yet misused, have not suffered an injury-in-fact sufficient to confer Article III standing.
We are not persuaded by the reasoning of these cases. As many of our sister circuits have noted, the injury-in-fact requirement can be satisfied by a threat of future harm or by an act which harms the plaintiff only by increasing the risk of future harm that the plaintiff would have otherwise faced, absent the defendant’s actions.
We concur in this view.
Once the plaintiffs’ allegations establish at least this level of injury, the fact that the plaintiffs anticipate that some greater potential harm might follow the defendant’s act does not affect the standing inquiry.
B. Availability of Credit Monitoring Damages Under Indiana Law
With the issue of jurisdiction resolved, we now turn to the merits of the plaintiffs’ claim for damages. This case, invoking CAFA’s special rules for diversity jurisdiction, alleges causes of action under Indiana law. Our duty, therefore, as in every diversity case, is to apply state substantive law, as we believe the highest court of the state would apply it.
State Farm Mut. Auto. Ins. Co. v. Pate,
275 F.3d 666, 669 (7th Cir.2001).
The principal claims in this case are based on a negligence theory. The elements of a negligence claim under Indiana law are: “(1) a duty owed to plaintiff by defendant, (2) breach of duty by allowing conduct to fall below the applicable standard of care, and (3) a
compensa-ble injwy
proximately caused by defendant’s breach of duty.”
Bader v. Johnson,
732 N.E.2d 1212, 1216-17 (Ind.2000) (emphasis added). The plaintiffs’ complaint also alleges that ONB has breached an implied contract. Compensable damages are an element of a breach of contract cause of action as well.
See McCalment v. Eli Lilly & Co.,
860 N.E.2d 884, 894 (Ind. Ct.App.2007).
As this case comes to us, both the negligence and the contractual issues can be resolved, and the judgment of the district court affirmed,
if
the district court was correct in its determination that Indiana law would not permit recovery for credit monitoring costs incurred by the plaintiffs. We review de novo the district court’s determination of the content of state law.
Hinc v. Lime-O-Sol Co.,
382 F.3d 716, 720 (7th Cir.2004);
see also Salve Regina Coll. v. Russell,
499 U.S. 225, 231-32, 111 S.Ct. 1217, 113 L.Ed.2d 190 (1991) (rejecting a rule of deference to district court determinations of state law). We must determine whether Indiana would consider that the harm caused by identity information exposure, coupled with the attendant costs to guard against identity theft, constitutes an existing
com-pensable injury and consequent damages
required to state a claim for negligence or for breach of contract. Neither the parties’ efforts nor our own have identified any Indiana precedent addressing this issue. Nor have we located the decision of any court (other than the district court in this case) that examines Indiana law in this context. We are charged with predicting, nevertheless, how we think the Supreme Court of Indiana would decide this issue.
See Dumas v. Infinity Broad. Corp.,
416 F.3d 671, 680 n. 11 (7th Cir.2005).
When faced with a novel question of state law, federal courts sitting in diversity have a range of tools at their disposal. First, when the intermediate appellate courts of the state have spoken to the issue, we shall give great weight to their determination about the content of state law, absent some indication that the highest court of the state is likely to deviate from those rulings.
See Woidtke v. St. Clair County, Illinois,
335 F.3d 558, 562 (7th Cir.2003). We also shall consult a variety of other sources, including other “relevant state precedents, analogous decisions, considered dicta, scholarly works, and any other reliable data tending convincingly to show how the highest court in the state would decide the issue at hand.”
McKenna v. Ortho Pharm. Corp.,
622 F.2d 657, 663 (3d Cir.1980);
see generally
Dolores K. Sloviter,
A Federal Judge Looks at Diversity Jurisdiction,
78 Va. L.Rev. 1671 (1992) (discussing the challenges facing federal courts in applying uncharted areas of state law). In the absence of any authority from the relevant state courts, we also shall examine the reasoning of courts in other jurisdictions addressing the same issue and applying their own law for whatever guidance about the probable direction of state law they may provide.
See Allstate Ins. Co. v. Tozer,
392 F.3d 950, 952 (7th Cir.2004).
In the end, however, the plaintiffs must come forward with
some
authority to support their view that they have a right to the relief they seek because, as we have stated, we have “limited discretion ... with respect to untested legal theories brought under the rubric of state law.” A.W.
Huss Co. v. Cont’l Cas. Co.,
735 F.2d 246, 253 (7th Cir.1984). Without state au
thority to guide us, “[w]hen given a choice between an interpretation of [state] law which reasonably restricts liability, and one which greatly expands liability, we should choose the narrower and more reasonable path (at least until the [state] Supreme Court tells us differently).”.
Todd v. Societe Bic, S.A.,
21 F.3d 1402, 1412 (7th Cir.1994) (en banc);
see also Insolia v. Philip Morris Inc.,
216 F.3d 596, 607 (7th Cir.2000) (“Federal courts are loathe to fiddle around with state law. Though district courts may try to determine how the state courts would rule on an unclear area of state law, district courts are encouraged to dismiss actions based on novel state law claims.”);
Home Valu, Inc. v. Pep Boys,
213 F.3d 960, 965 (7th Cir.2000) (adopting an interpretation of state law which, between two possible options, “take[s] the approach that is restrictive of liability”).
With these principles in mind, we turn to our consideration of whether Indiana would recognize a cause of action for a data exposure injury. Specifically, we shall examine whether Indiana would compensate victims who undertake credit monitoring to guard against identity theft that might follow.
1.
We begin our inquiry with the Indiana authority most closely addressed to the issue before us. On March 21, 2006, the Indiana legislature enacted a statute that applies to certain database security breaches. Specifically, the statute creates certain duties when a database in which personal data, electronically stored by private entities or state agencies, potentially has been accessed by unauthorized third parties. I.C. § 24-4.9
et seq.
The statute took effect on July 1, 2006,
see
Ind. Pub.L. 125-2006, § 6 (Mar. 21, 2006), after the particular incident involved in this case; neither party contends that the statute is directly applicable to the present dispute.
We nevertheless find this enactment by the Indiana legislature instructive in our evaluation of the probable approach of the Supreme Court of Indiana to the allegations in the present case.
The provisions of the statute applicable to private entities storing personal information require only that a database owner
disclose
a security breach to potentially affected consumers; they do not require the database owner to take any other affirmative act in the wake of a breach. If the database owner fails to comply with the only affirmative duty imposed by the statute — the duty to disclose — the statute provides for enforcement
only
by the Attorney General of Indiana. It creates no private right of action against the database owner by an affected customer. It imposes no duty to compensate affected individuals for inconvenience or potential harm to credit that may follow.
The plaintiffs maintain that the statute is evidence that the Indiana legislature believes that an individual has suffered a compensable injury at the moment his personal information is exposed because of a security breach. We cannot accept this view. Had the Indiana legislature intended that a cause of action should be available against a database owner for failing to protect adequately personal information, we believe that it would have made some more definite statement of that intent. Moreover, given the novelty of the legal questions posed by information exposure and theft, it is unlikely that the legislature intended to sanction the development of common law tort remedies that would apply to the same factual circumstances addressed by the statute. The narrowness of the defined duties imposed, combined with state-enforced penalties as the exclusive remedy, strongly suggest that Indiana law would not recognize the costs of credit monitoring that the plaintiffs seek to recover in this case as com-pensable damages.
2.
The plaintiffs further submit that cases decided by the Indiana courts in analogous areas of the law instruct that they suffered an immediate injury when their information was accessed by unauthorized third parties. Specifically, the plaintiffs claim that Indiana law acknowledges special duties on the part of banks to prevent the disclosure of the personal information of their customers; they further claim that Indiana courts have recognized explicitly
the significant harm that may result from a failure to prevent such a loss.
See Indiana Nat’l Bank v. Chapman,
482 N.E.2d 474 (Ind.Ct.App.1985);
American Fletcher Nat’l Bank & Trust Co. v. Flick,
146 Ind.App. 122, 252 N.E.2d 839 (1969). In
Indiana National Bank v. Chapman,
482 N.E.2d 474 (Ind.Ct.App.1985), the Court of Appeals of Indiana considered a claim that, in the course of an investigation into possible financial motives for an arson, the bank, intentionally and without authorization, had disclosed to law enforcement that an account of one of its customers had been marked for repossession. The court held that the bank had contracted impliedly with its customers not to reveal financial information to law enforcement, absent a public duty.
Id.
at 482. In
American Fletcher National Bank & Trust Co. v. Flick,
146 Ind.App. 122, 252 N.E.2d 839 (1969), the Court of Appeals considered liability based on a bank’s erroneous dishonor of a customer’s check when a third-party attempted to cash it. The appellate court concluded that the plaintiff, whose creditors had been told that the plaintiffs business account had insufficient funds to cover the checks the plaintiff had written, had suffered a presumptive present harm to his business reputation and credit.
Id.
at 846.
Whatever these cases say about the relationship of banks and customers in Indiana, they are of marginal assistance to us in determining whether the present plaintiffs are entitled to the remedy they seek as a matter of Indiana law. The reputational injuries suffered by the plaintiffs in
American Fletcher
and
Indiana National Bank
were direct and immediate; the plaintiffs sought to be compensated for that harm, rather than to be reimbursed for their efforts to guard against some future, anticipated harm. We therefore do not believe that the factual circumstances of the cases relied on by the plaintiffs are sufficiently analogous to the circumstances that we confront in the present case to instruct us on the probable course that the Supreme Court of Indiana would take if faced with the present question.
Although not raised by the parties, we separately note that in the somewhat analogous context of toxic tort liability,
the
Supreme Court of Indiana has suggested that compensable damage requires more than ,an exposure to a future potential harm. Specifically, in
AlliedSignal, Inc. v. Ott,
785 N.E.2d 1068 (Ind.2003), the Supreme Court of Indiana held that no cause of action accrues, despite incremental physical changes following asbestos exposure, until a plaintiff reasonably could have been diagnosed with an actual exposure-related illness or disease.
Id.
at 1075. In its decision that no compensable injury occurs at the time of exposure, the court relied on precedent from both state and federal courts in general agreement with the principle that exposure alone does not give rise to a legally cognizable injury.
Id.
at 1075 n. 8.
Although some courts have allowed medical monitoring damages to be recovered or have created a special cause of action for medical monitoring under similar circumstances,
see Badillo v. American Brands, Inc.,
117 Nev. 34, 16 P.3d 435, 438-39 & nn. 1-2 (2001) (citing cases interpreting the law of seventeen states to allow medical monitoring in some form), no authority from Indiana is among them. Indeed, its recent holding in
AlliedSignal
indicates a contrary approach. To the extent the decision of the Supreme Court of Indiana in that matter provides us with guidance on the likely approach that court would adopt with respect to the information exposure injury in this case, we think it supports the view that no cause of action for credit monitoring is available.
3.
Finally, without Indiana guidance directly on point, we next examine the reasoning of other courts applying the law of other jurisdictions to the question posed by this case.
Allstate Ins. Co.,
392 F.3d at 952. In this respect, several district courts, applying the laws of other jurisdictions, have rejected similar claims on their merits. In addition to those cases in which the district court held that the plaintiff lacked standing,
a series of cases has rejected information security claims on their merits. Most have concluded that the plaintiffs have not been injured in a manner the governing substantive law will recognize.
See, e.g., Kahle v. Litton Loan Servicing, LB,
486 F.Supp.2d 705, 712-13 (S.D.Ohio 2007) (entering summary judgment for the defendant because the plaintiff had failed to demonstrate an injury);
Guin v. Brazos Higher Educ. Serv. Corp., Inc.,
2006 WL 288483 (D.Minn. Feb.7, 2006) (unpublished) (same);
Stollenwerk v. Tri-West Healthcare Alliance,
2005 WL 2465906, at *5 (D.Ariz. Sept.6, 2005) (unpublished) (granting summary judgment for defendants because the plaintiffs had failed to provide evidence of injury);
see also Hendricks v. DSW Shoe Warehouse,
444 F.Supp.2d 775, 783 (W.D.Mich.2006) (dismissing an action where “[tjhere is no existing Michigan statutory or case law authority to support plaintiffs position that the purchase of credit monitoring constitutes either actual damages or a cognizable loss”).
Although some of these cases involve different types of information losses, all of the cases rely on the same basic premise: Without more than allegations of increased risk of future identity theft, the plaintiffs have not suffered a harm that the law is prepared to remedy. Plaintiffs have not come forward with a single case or statute,
from any jurisdiction, authorizing the kind of action they now ask this federal court, sitting in diversity, to recognize as a valid theory of recovery under Indiana law. We decline to adopt a “substantive innovation” in state law,
Combs v. Int’l Ins. Co.,
354 F.3d 568, 578 (6th Cir.2004), or “to invent what would be a truly novel tort claim” on behalf of the state,
Insolia,
216 F.3d at 607, absent some authority to suggest that the approval of the Supreme Court of Indiana is forthcoming.
See Todd,
21 F.3d at 1412 (noting that federal courts should be wary of broadening untested theories of liability under state law);
see also Insolia,
216 F.3d at 607 (noting that we would neither recognize independently nor certify a question to the state regarding “every creative but unlikely state cause of action that litigants devise from a blank slate”);
Birchler v. Gehl Co.,
88 F.3d 518, 521 (7th Cir.1996) (favoring narrow interpretation of undecided issues of liability under state law);
Ry. Express Agency, Inc. v. Super Scale Models, Ltd.,
934 F.2d 135, 138 (7th Cir.1991) (noting that “recent opinions of this court have strongly encouraged district courts to dismiss actions based on novel state law claims”).
In sum, all of the interpretive tools of which we routinely make use in our attempt to determine the content of state law point us to the conclusion that the Supreme Court of Indiana would not allow the plaintiffs’ claim to proceed.
Conclusion
Because we conclude that the damages that the plaintiffs seek are not compensa-ble as a matter of Indiana law, we affirm the judgment of the district court.
Affirmed