You can sue over a data breach, but whether the case survives depends first on standing: you have to show a concrete injury, not just that your data was exposed. In federal court, the Supreme Court has said a bare statutory violation is not enough, and a future risk of harm is not enough for damages unless it has caused something real. Courts disagree on how much a heightened risk of identity theft counts. This guide covers US federal courts, with notes on states, and was checked on October 10, 2026.

Below, the cases are walked through in the order a judge would reach them: the injury, the link to the breach, the available damages, and the practical alternatives to a lawsuit.

Step one: standing, and why most breach suits are fought here

Article III of the Constitution lets federal courts decide only real disputes. Plaintiffs must show an injury, that the defendant caused it, and that a court can fix it. In a breach case, the argument usually turns on injury.

The key modern ruling is TransUnion LLC v. Ramirez, decided June 25, 2021. The Court held that only plaintiffs who suffered a concrete harm from a statutory violation can seek damages in federal court. In that case, 1,853 class members whose misleading credit reports went to third-party businesses had standing. Another 6,332 whose flagged files were never sent out did not. For future harm, the Court said a material risk can support an injunction if it is imminent and substantial, but for damages, a risk alone, without more, falls short.

Earlier, Clapper v. Amnesty International (February 26, 2013) set the baseline: a threatened injury must be certainly impending, and plaintiffs cannot manufacture standing by spending money to guard against a speculative harm. Defense lawyers lean on that line constantly in breach cases. Neither TransUnion nor Clapper was a data breach case, which is why the appeals courts are still sorting out how they apply.

What the appeals courts have said

No single rule governs the whole country. Here is a snapshot of cases I could verify through secondary summaries, listed by decision date.

Case and court Date What it held
Attias v. CareFirst, D.C. Circuit Aug. 1, 2017 Exposure of personal information creating a heightened risk of identity theft was enough to plead injury, per a Fenwick summary.
McMorris v. Carlos Lopez & Associates, Second Circuit Apr. 26, 2021 Increased risk can support standing in some circumstances, using three factors. Credit monitoring costs count only when the risk is substantial.
Clemens v. ExecuPharm, Third Circuit Sept. 2, 2022 For damages, a substantial risk plus a separate present harm, such as emotional distress or mitigation costs.
Green-Cooper v. Brinker, Eleventh Circuit July 11, 2023 Card data posted for sale on the dark web counted as misuse and supported standing; two plaintiffs who had not visited during the breach window lacked it.

The Second Circuit’s three factors are a practical checklist. Was the data taken in a targeted attack? Has any of it been misused already, even by someone else in the group? Is it sensitive enough to create a high risk of fraud? That court denied that a true split exists, though lawyers who follow these cases describe the circuits as leaning in different directions.

Recent district court rulings show how this plays out. In a case reported on May 1, 2026, a Northern District of Georgia judge dismissed a proposed class action against a cryptocurrency ATM operator because the plaintiff did not allege that anyone had misused the stolen data. Applying Eleventh Circuit precedent, the court called the identity-theft risk too speculative, and the mitigation-cost and distress theories fell with it. The dismissal was without prejudice, meaning a better-pleaded complaint could be filed.

Step two: tying the harm to this breach

Even with an injury, you must connect it to the defendant. The Brinker plaintiffs show how that fails: two people who ate at a location outside the affected dates could not trace anything to the incident. In practice, this is why identical breaches produce different outcomes for different plaintiffs.

The causation question also appears when your data has been leaked more than once. If a fraudulent account opening could stem from any of several breaches, a defendant will argue yours is not the cause. Plaintiffs answer with timing, the type of data taken, and whether it was sold or posted.

Myths that send people the wrong way

Common belief What the sources support
Any exposure of my data entitles me to money. Under TransUnion, a violation without concrete harm does not support damages in federal court.
I must wait until identity theft happens. Not necessarily. Some circuits accept a substantial risk, sometimes paired with a present harm such as mitigation costs.
Buying credit monitoring creates an injury by itself. The Second Circuit said those costs count only when the underlying risk is substantial, and Clapper warns against self-inflicted costs.
A breach settlement pays everyone the same sum. The Equifax claims were tied to documented expenses and time, plus free monitoring.

The practical reading is that evidence wins these arguments. A notice letter that arrives with no fraud on your accounts is thin. The same letter, followed by an account opened in your name or your card number showing up for sale, is a different case. Dates matter too: keep the breach notice, and write down when each problem appeared so it can be matched to the incident.

Step three: what damages look like

If a case clears standing, the recoverable losses are usually modest and documented. Typical categories include out-of-pocket fraud losses, the cost of credit monitoring where a court accepts it as reasonable, and time spent fixing problems. Emotional distress is claimed in some cases, as in Clemens, but it is harder to prove.

The Equifax settlement shows the scale for a mega-breach. According to the FTC announcement of July 22, 2019, Equifax agreed to pay at least $575 million, potentially up to $700 million, to the FTC, the CFPB and states. A $300 million consumer fund covered credit monitoring and expenses, with up to $125 million added if needed. The consumer claims were for documented losses and time, not a flat payout for everyone, which is a pattern worth expecting.

What state law adds

All 50 states, plus D.C. and several territories, have breach notification statutes, according to the National Conference of State Legislatures. These require a company to notify people when their personal data is compromised. The NCSL page does not say which of them allow individuals to sue, so check the statute in your state.

California is the best-known exception on private suits. Its consumer privacy law allows a private action for certain breaches in which unencrypted, unredacted personal information was stolen because of a failure to maintain reasonable security. The California Attorney General’s page describes damages of up to $750 per incident in its text, and the California Privacy Protection Agency later raised the range to $107 to $799 per consumer per incident from January 1, 2025. A written notice and a 30-day cure period come first. State consumer-protection and negligence claims also appear in breach complaints, and state courts are not bound by federal standing rules, though I have not surveyed how each state applies its own.

Practical alternatives to filing your own suit

  • Watch for a class action or settlement notice. Most breach litigation is collective. Claims are submitted through an administrator, and deadlines are firm. The Equifax claims window, for example, closed in stages between January 2020 and January 2024.
  • Read the terms you agreed to. Many consumer contracts include arbitration clauses or class waivers. I did not research how courts treat them in breach cases, so ask a lawyer if you have received such a notice.
  • Complain to a regulator. The FTC and state attorneys general bring their own actions, as the Equifax case did.
  • Protect yourself now. The FTC’s IdentityTheft.gov offers a reporting tool and a recovery plan if your data is misused. Keep records of fraud, hours spent, and any costs, since those become evidence of damages.

Related questions

Do I need to have lost money to sue?

Not always, but it helps. Courts such as the Third Circuit want a substantial risk plus a present harm like mitigation costs or distress. Others accept actual misuse, such as data for sale on the dark web.

Does a company owe me notice after a breach?

Under state law, almost certainly, since every state has a notification statute. What triggers notice, the deadline, and exemptions for encrypted data vary by state.

Can I sue the hackers instead?

You can in theory, but they are rarely identifiable or collectible. Claims against the company that held the data are where the case law sits.

Is a settlement offer worth taking?

That depends on the terms, and a settlement notice describes your options and deadlines. Once you accept a class settlement, you typically give up the right to sue separately over the same claims, so read the notice before the deadline.

This is general information, not legal advice.

Sources