Remijas v. Neiman Marcus Group, LLC

Dist. Ct. erred in dismissing on standing grounds plaintiffs’ class action seeking damages arising out of defendant’s delayed announcement that it was subject to cyber attack that resulted in theft of plaintiffs-customers’ credit card numbers, where plaintiffs alleged, among other things, that they experienced fraudulent purchases on their credit cards as result of defendant’s conduct. While record showed that defendant had remedied any current losses arising out of fraudulent purchases and had given plaintiffs one-year of free credit monitoring services, plaintiffs successfully alleged that instant data breach inflicted other concrete particularized injuries that would support their standing to pursue instant claim in form of alleged lost time and money spent on replacing their credit cards and monitoring their credit scores beyond period of time given by defendant. Ct. rejected defendant’s contention that any alleged future injuries would not support Article III standing to pursue instant claim, where plaintiffs adequately asserted substantial risk of incurring future injuries. Moreover, plaintiffs need not wait until they experienced actual identity theft before they can bring instant lawsuit, and fact that other stores could have compromised plaintiffs’ private credit card information did not negate plaintiffs’ standing in instant case.