Illinois Supreme Court Says Data Breach Plaintiff’s Increased Risk of Identity Theft Too Speculative for Standing
- January 31, 2025
The Illinois Supreme Court affirmed January 24 the dismissal of a putative class action against a medical provider because the named plaintiff’s allegations of an increased risk of identity theft were too speculative to confer standing.
Plaintiff Rebecca Petta filed a class action complaint against Christie Clinic, where she received medical services from 2019 to 2022, after it informed her by letter that her private personal data, including Social Security number and health insurance information, may have been “exposed” to an unknown third party who gained unauthorized access to one of the provider’s business email accounts. Christe's investigation of the incident reported no evidence of identity theft or misuse of Petta’s personal information, the opinion noted.
The lawsuit alleged the clinic negligently failed to safeguard patients’ private personal data and sought monetary damages for Petta and the proposed class.
A unanimous Illinois Supreme Court found Petta lacked standing because she failed to allege an injury in fact. “In a complaint seeking monetary damages,” the high court said, “an allegation of an increased risk of harm is insufficient to confer standing.”
The high court noted that the letter notifying Petta of the data incident only indicated her personal information may have been exposed, not that it was actually acquired by a third party. And according to the letter, Christie’s investigation revealed that the unauthorized third party was trying to intercept a financial transaction, not steal patient data, the high court added.
Petta’s allegation about an unauthorized loan application using her phone number and city also fell short for standing purposes. Petta did not allege that any of her private personal information, like her Social Security number, was used in the loan application, only information that was publicly available regardless of the data breach.
Quoting the appeals court decision, the high court called Petta’s allegation regarding the loan application “‘purely speculative’ because there is no apparent connection between the purported fraudulent loan attempt and the data breach at issue. Anyone could have committed the fraud using the same readily available public information.”
Petta v. Christie Bus. Holdings Co., 2025 IL 130337 (Ill. Jan. 24, 2025).