On December 19, 2016, the U.S. District Court for the District of Kansas denied a motion to dismiss, ruling that the named plaintiff for a putative class, approximately two thousand former and current employees whose personal information had been compromised as a result if a phishing attack, had alleged sufficient harm for standing under Spokeo Inc. v. Robins.

The plaintiff alleges that in February 2016, an unauthorized person, posing as a fellow employee, emailed a request for current and former employees’ W-2 forms. One of the employees complied with the request, compromising the named plaintiff’s own information as well as that of up to two thousand people. The defendant notified the plaintiff of the data breach on March 27, 2016 and on April 18, the plaintiff received a letter from the IRS stating that someone had filed a fraudulent tax return in her name. Plaintiff claimed that since receipt of the IRS letter in April 2016, she has “spent multiple hours on telephone conferences with IRS representatives,” experienced delay, expended “costs related to postage and mileage in countering the tax fraud,” and “will continue to be at heightened risk for tax fraud and identity theft.” She also claims that she faces a continuing, real, immediate risk of identity theft and tax fraud.  The plaintiff filed a cause of action for common law negligence, alleging that the defendant had failed to implement reasonable data security measures to protect their employees’ personal information from disclosure.

The court emphasized that because the named plaintiff’s personal information had been fraudulently used to file a false tax return, the plaintiff had suffered some form of “actual, concrete injury,” rejecting the defendant’s arguments that the plaintiff’s claims were too speculative.  The court stated that the fact that her stolen information had already been used had “a direct impact on the plausibility of future harm” for standing purposes, even in light of the bar for standing outlined in Spokeo.  The court here ruled that the plaintiff had adequately pleaded the elements of a negligence claim, holding that “[g]iven plaintiff’s allegations that the harm was foreseeable, defendant had the duty to exercise reasonable care to prevent that harm.”

To view the court’s memorandum and order denying the motion to dismiss, click here.