{"id":2290,"date":"2025-07-11T14:21:45","date_gmt":"2025-07-11T18:21:45","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=2290"},"modified":"2025-07-11T14:21:46","modified_gmt":"2025-07-11T18:21:46","slug":"north-carolina-federal-court-dismisses-data-breach-class-action-in-finding-bare-assertions-are-insufficient-to-confer-standing","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2025\/07\/11\/north-carolina-federal-court-dismisses-data-breach-class-action-in-finding-bare-assertions-are-insufficient-to-confer-standing\/","title":{"rendered":"North Carolina Federal Court Dismisses Data Breach Class Action In Finding Bare Assertions Are Insufficient To Confer Standing"},"content":{"rendered":"
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

By Gerald L. Maatman, Jr., George J. Schaller, and Bernadette M. Coyle<\/strong><\/p>\n\n\n\n

Duane Morris Takeaways<\/em><\/strong>:<\/strong><\/p>\n\n\n\n

On June 30, 2025, in Panighetti, et al. v. Intelligent Business Solutions, Inc., No. 1:23-CV-209, 2025 U.S. Dist. LEXIS 123406 (M.D.N.C. June 30, 2025), Judge Loretta C. Biggs of the U.S. District Court for the Middle District of North Carolina granted <\/a>Intelligent Business Solution\u2019s (\u201cIBS\u201d) motion to dismiss a data breach class action and found that Plaintiff did not have standing under Article III because he failed to plead a concrete injury. Plaintiff alleged on behalf of himself, and over 11,000 other individuals, that IBS invaded his privacy and negligently failed to protect his personal informal following a data breach in 2022.\u00a0\u00a0 <\/em><\/p>\n\n\n\n

The decision in Panighetti shows a growing trend among federal courts finding claims based on future and\/or speculative harm in data breach class actions are insufficient \u2013 without any concrete instance of personal information being stolen or misused  \u2013to establish Article III standing. <\/em><\/p>\n\n\n\n

Case Background<\/strong><\/p>\n\n\n\n

IBS, a health information company, collects and maintains personal identifiable information and protected health information for healthcare entities.  Plaintiff, a hospital patient that IBS provided services for, alleged that his personal information was part of a 2022 data breach.  Id.  <\/em>at 1.  Plaintiff further alleged the data breach exposed the names, Social Security numbers, medical treatment information, and health insurance information of an estimated 11,595 individuals.  Id. <\/em>at 2. <\/p>\n\n\n\n

After IBS became aware of the data breach, it notified impacted individuals.  Plaintiff maintained that by issuing this notification, IBS \u201ccreated a present, continuing, and significant risk of suffering identity theft.\u201d  Id<\/em>.  On March 7, 2023, Plaintiff filed suit against IBS, alleging seven causes of action including negligence, invasion of privacy, unjust enrichment, and violation of the North Carolina Unfair Trade Practices Act.  Id.<\/em><\/p>\n\n\n\n

IBS moved to dismiss and asserted Plaintiff lacked Article III standing to bring his claims.  IBS argued Plaintiff was \u201cnot able to plead facts that show there was actual misuse of data that resulted in identity theft, fraud, or another concrete injury-in-fact.\u201d Id. <\/em>at 4.  Plaintiff countered that he had standing to sue \u201cbecause the data breach harmed him, will harm him again, and requires him to expend resources mitigating that harm\u201d and that these harms \u201cconfer standing\u201d based on Fourth Circuit precedent.  Id.<\/em><\/p>\n\n\n\n

The Court\u2019s Order<\/strong><\/p>\n\n\n\n

The Court granted IBS\u2019s motion to dismiss.  The Court held Plaintiff failed to establish standing.  The Court reasoned that to proceed with a lawsuit, Article III requires a plaintiff to \u201cdemonstrate (1) an injury in fact; (2) causation; and (3) redressability.\u201d  Id. <\/em>at 5 (citing David v. Alphin<\/em>, 704 F.3d 327, 333 (4th Cir. 2013)). <\/p>\n\n\n\n

On the first element, the Court explained that Plaintiff must show he \u201csuffered an invasion of a legally protected interest which is concrete, particularized, and actual or imminent.\u201d  Id<\/em>.  Plaintiff argued that he was injured because the breach: \u201c(1) exposed his medical records, thus invading his privacy; (2) exposed information criminals can use to commit fraud and steal his identity; (3) required him to spend resources to mitigate the risk; and (4) caused him to suffer from anxiety, sleep disruption, stress, fear, and frustration.\u201d  Id. <\/em>  Relying on Fourth Circuit precedent, the Court rejected Plaintiff\u2019s argument that he was injured because of the data breach because nowhere in the pleadings did Plaintiff claim that he was a victim of identity theft or fraud, that risk of future theft was \u201ccertainly impending,\u201d or provide instances of his personal information being exploited.  Further, spending resources to mitigate the increased risk caused by the breach, where there was no misuse of data, was too speculative to confer standing.<\/p>\n\n\n\n

Turning to Plaintiff\u2019s claims of emotional harm, the Court opined that although the Supreme Court took no position on whether emotional harm confers standing in TransUnion v. Ramirez<\/em>, Fourth Circuit precedent, in Beck,<\/em> rejected a Plaintiff\u2019s claims that \u201cemotional upset\u201d and \u201cfear of future identity theft and financial fraud\u201d was sufficient to confer standing.  Id. <\/em>at 8 (quoting Beck v. <\/em>McDonald, 848 F.3d. 262 (4th Cir. 2017).  Accordingly, the Court dismissed Plaintiff\u2019s claims of emotional harm as \u201cbare assertions of possible or potential harm.\u201d  Id<\/em>.<\/p>\n\n\n\n

Implications For Companies<\/strong><\/p>\n\n\n\n

Standing remains an effective defense for companies to challenge putative class actions at the responsive pleading stage especially, whereas here, Plaintiff failed to assert facts demonstrating harm stemming from a data breach.<\/p>\n\n\n\n

Panighetti <\/em>shows that data breach plaintiffs cannot rely on speculative injuries based on future harm to satisfy Article III standing requirements.  However, companies asserting an Article III standing defense must consider the possibility of a class action plaintiff refiling in state court when determining whether to challenge standing in federal court. <\/p>\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr., George J. Schaller, and Bernadette M. Coyle Duane Morris Takeaways: On June 30, 2025, in Panighetti, et al. v. Intelligent Business Solutions, Inc., No. 1:23-CV-209, 2025 U.S. Dist. LEXIS 123406 (M.D.N.C. June 30, 2025), Judge Loretta C. Biggs of the U.S. District Court for the Middle District of North Carolina … <\/p>\n

Continue reading “North Carolina Federal Court Dismisses Data Breach Class Action In Finding Bare Assertions Are Insufficient To Confer Standing”<\/span><\/a><\/p>\n","protected":false},"author":575,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[91],"tags":[],"ppma_author":[7,96,137],"class_list":["post-2290","post","type-post","status-publish","format-standard","hentry","category-data-breach-class-actions"],"authors":[{"term_id":7,"user_id":575,"is_guest":0,"slug":"gmaatman","display_name":"Gerald L. Maatman, Jr.","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/maatmangerald-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":96,"user_id":655,"is_guest":0,"slug":"gschaller","display_name":"George Schaller","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2023\/07\/schallergeorge-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":137,"user_id":720,"is_guest":0,"slug":"bcoyle","display_name":"Bernadette Coyle","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/04\/coylebernadette-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2290","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/575"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=2290"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2290\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=2290"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=2290"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=2290"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=2290"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}