Last week, the Eighth Circuit affirmed dismissal of a putative class action data breach lawsuit, holding that the named plaintiff failed to allege standing based on a single fraudulent charge to his credit card. A copy of the opinion can be found here.

In 2014, hackers accessed customer financial information from hundreds of retail grocery stores operated by SuperValu, Inc., AB Acquisition, LLC, and New Albertsons, Inc. The hackers acquired customers’ credit and debit card information but did not obtain personal information such as Social Security numbers, birth dates, or driver’s license numbers. Following the data incident, a group of customers sued the stores, alleging that the stores failed to properly safeguard their personal information.

The Eighth Circuit previously affirmed dismissal of all but one of the plaintiffs’ claims, holding that the risk of identity theft was not sufficient to confer standing. The Eighth Circuit allowed the claims of one named plaintiff, David Holmes, who had alleged a fraudulent charge to his credit card, to move forward but noted that his failure to allege certain details could be fatal to the complaint. On remand, the District Court dismissed Holmes’ claims.

On appeal, the Eighth Circuit upheld the lower court’s decision, holding that Holmes could not state a cause of action under Illinois consumer protection laws because he did not adequately allege “actual damage.” Specifically, the Court held that Holmes’ “alleged injuries—the expenditure of time monitoring his account, the single fraudulent charge to his credit card, and the effort expended replacing his card—do not constitute actual damage.” In addition, the time he spent “protecting himself against the threat of future identity theft does not amount to an out-of-pocket loss.” The Court further explained that Holmes’ allegation relating to the fraudulent credit card charge did not suffice because he failed to explain whether he paid the fraudulent charge out-of-pocket or his bank reimbursed him. The Court stated that Holmes “does not directly allege that the fraudulent charge to his credit card resulted in any pecuniary loss. Instead, he asserts that we must presume that he was required to pay the fraudulent charge even though he has not directly alleged that fact.”

Based on a 2018 Seventh Circuit decision, which held that retailers have no duty under Illinois law to protect the financial information of their customers, the Eighth Circuit also dismissed Holmes’ claim for negligence. In addition, the Court dismissed an unjust enrichment claim, holding that Holmes’ had not paid a premium for data security, reasoning that the price he paid for groceries would have been the same whether he paid with cash or credit.

In data breach litigation, standing is a key hurdle for consumers to overcome – often tied to whether they suffered actual injuries. Troutman Sanders will continue to monitor this important area of law and report on developments.