## Facts

- Hackers breached Neiman Marcus’s payment-card systems in 2013 and stole customers’ credit and debit card data.
- Neiman Marcus learned in mid-December 2013 that customers were experiencing fraudulent charges, identified potential malware on January 1, 2014, and publicly announced the breach on January 10, 2014.
- Neiman Marcus disclosed that malware attempted to collect card data between July 16 and October 30, 2013; approximately 350,000 cards were potentially exposed; and 9,200 were known to have been used fraudulently.
- Customers who used payment cards at Neiman Marcus during the relevant period filed a putative class action asserting negligence, invasion of privacy, and statutory data-protection claims.
- Plaintiffs alleged injuries including fraudulent charges (even if reimbursed), time spent addressing fraud and monitoring accounts, costs of credit monitoring/identity-theft protection, and increased risk of future fraud and identity theft.
- The district court dismissed the complaint without prejudice for lack of Article III standing.

## Issues

1. Whether plaintiffs plausibly alleged an injury in fact based on a substantial risk of future fraudulent charges or identity theft after a confirmed theft of payment-card data.
2. Whether reasonable time and money spent to mitigate that risk (e.g., credit monitoring and account monitoring) constitutes a concrete injury in fact.
3. Whether plaintiffs plausibly alleged traceability and redressability for Article III standing at the pleading stage.

## Decision

- The Seventh Circuit reversed the dismissal and remanded.
- The court held plaintiffs plausibly alleged Article III standing based on at least some asserted injuries.
- The court found the confirmed theft and known fraudulent use of some cards supported a substantial risk of future harm.
- The court held mitigation costs and time spent responding to the breach were concrete, particularized injuries.
- The court concluded traceability and redressability were sufficiently alleged at the pleading stage.

## Legal Principles

- A substantial risk of future harm can satisfy Article III injury-in-fact when the risk is supported by concrete facts rather than a speculative chain of possibilities.
- Following a confirmed theft of payment-card data, a plausible substantial risk of future fraudulent charges or identity theft is a cognizable injury in fact.
- Reasonable expenditures of time or money to mitigate a substantial risk of harm qualify as injury in fact.
- Reimbursement of fraudulent charges does not eliminate standing where plaintiffs plausibly allege other concrete burdens, such as time spent resolving fraud and monitoring accounts.
- At the pleading stage, allegations that plaintiffs used cards at the defendant’s stores during the breach window, combined with the defendant’s breach disclosures and resulting fraud, can suffice for traceability; damages and prospective relief can satisfy redressability.

## Conclusion

The Seventh Circuit held that customers affected by a confirmed retail payment-card data breach plausibly alleged Article III standing because the theft and documented fraudulent use supported a substantial risk of future harm, and plaintiffs’ reasonable mitigation efforts and time spent addressing the breach constituted concrete injuries.


Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688 (7th Cir. 2015)