## Facts

- Jennifer Clemens, a former ExecuPharm employee, provided the company sensitive personal and financial information as a condition of employment.
- ExecuPharm promised in her employment agreement to take appropriate measures to protect the confidentiality and security of that information.
- A ransomware group accessed ExecuPharm’s servers through a phishing attack, exfiltrated employee personal data, and encrypted server data.
- After ExecuPharm did not satisfy the ransom demand, the attackers posted the stolen information on dark-web sites.
- ExecuPharm notified employees and former employees that sensitive information had been accessed and shared on the dark web and that Clemens might be among those affected.
- Clemens alleged she spent time reviewing accounts and credit reports, placed fraud alerts, changed her bank account, and purchased ongoing credit monitoring for herself and her family.
- Clemens did not allege completed identity theft or fraudulent charges, but alleged a substantial risk of future identity theft and costs and time spent mitigating that risk.
- She filed a putative class action asserting contract and tort claims; the district court dismissed under Rule 12(b)(1) for lack of Article III standing.

## Issues

1. Whether a plaintiff whose personal data was intentionally stolen and published on the dark web, but who has not yet suffered completed identity theft or financial loss, plausibly alleges an “injury in fact” that is concrete and sufficiently imminent for Article III standing.
2. Whether alleged mitigation time and expenses undertaken in response to a substantial risk of identity theft can constitute a concrete injury at the pleading stage.

## Decision

- The Third Circuit vacated the dismissal and remanded.
- The court held Clemens plausibly alleged Article III injury in fact based on a substantial risk of future identity theft arising from intentional theft and dissemination of sensitive data on the dark web.
- The court further held that reasonable mitigation measures and associated costs and time, taken in response to that substantial risk, could qualify as concrete harms at the pleading stage.
- The court distinguished earlier circuit precedent that found no standing where allegations did not show exfiltration, misuse, or other facts making future harm substantially likely.

## Legal Principles

- Article III standing requires an injury in fact that is concrete, particularized, and actual or imminent, plus traceability and redressability.
- A substantial risk of future harm may satisfy injury in fact where the pleaded facts make misuse of stolen information materially likely rather than speculative.
- In data-breach cases, intentional exfiltration of sensitive identifiers and public dissemination to criminal markets (such as the dark web) can support an inference of substantial risk of identity theft or fraud.
- Mitigation expenses and time may be cognizable injuries when they are reasonable responses to a substantial risk created by the defendant’s alleged failure to safeguard data, rather than voluntary costs aimed at a merely speculative threat.
- Alleged invasion of informational privacy and impairment of contractual data-security promises may reinforce concreteness where closely tied to recognized privacy or confidentiality harms.

## Conclusion

The Third Circuit held that a targeted ransomware theft followed by dark-web publication of sensitive personal data plausibly creates a substantial risk of identity theft sufficient for Article III standing, and that reasonable mitigation costs and time taken in response may constitute concrete injury, warranting remand for merits consideration.


Clemens v. ExecuPharm Inc., 48 F.4th 146 (3d Cir. 2022)