In Bohnak v. Marsh & McLennan Companies, the Second Circuit considered how the Supreme Court’s 2021 decision in TransUnion, LLC v. Ramirez impacted earlier Second Circuit precedent as to how to establish Article III standing in data breach cases.
In short, the court held that TransUnion altered its precedent as to whether an injury arising from risk of future harm is sufficiently “concrete” to constitute an injury in fact, but not as to the question whether the asserted injury is “actual or imminent.” Reversing the district court’s dismissal for lack of standing, the court held that the plaintiff sufficiently alleged a concrete injury arising out of a data breach — the increased risk of identity theft — and that that injury was sufficiently imminent, given the allegations that hackers took her name and social security number.
