Imminent and Substantial: The Third Circuit Holds That the Leak of Personal Information onto the Dark Web is Sufficient to Establish an “Injury-In-Fact”
November 18, 2022
Publications
A recent decision from the Third Circuit suggests that the leak of information onto the Dark Web provides standing to class action plaintiffs in data breach litigation. In Clemens v. ExecuPharm, Inc., 48 F.4th 146 (3d Cir. 2022), the Defendant employer suffered a data breach that permitted a ransomware gang to steal sensitive information pertaining to the Defendant’s current and former employees. Eventually, the hackers posted the data on underground websites located on the Dark Web.
The plaintiff, a former employee whose data was stolen by the hackers, filed a class action lawsuit on behalf of herself and other employees whose information was accessed. However, the plaintiff did not allege that she (or any other employees) suffered any financial losses as a result of the breach. Since showing financial harm is traditionally a required element to establish standing, the District Court dismissed the case.
