Duane Morris Takeaways:
On June 30, 2025, in Panighetti, et al. v. Intelligent Business Solutions, Inc., No. 1:23-CV-209, 2025 U.S. Dist. LEXIS 123406 (M.D.N.C. June 30, 2025), Judge Loretta C. Biggs of the U.S. District Court for the Middle District of North Carolina granted Intelligent Business Solution's ("IBS") motion to dismiss a data breach class action and found that Plaintiff did not have standing under Article III because he failed to plead a concrete injury. Plaintiff alleged on behalf of himself, and over 11,000 other individuals, that IBS invaded his privacy and negligently failed to protect his personal informal following a data breach in 2022.
The decision in Panighetti shows a growing trend among federal courts finding claims based on future and/or speculative harm in data breach class actions are insufficient – without any concrete instance of personal information being stolen or misused –to establish Article III standing.
Case Background
IBS, a health information company, collects and maintains personal identifiable information and protected health information for healthcare entities. Plaintiff, a hospital patient that IBS provided services for, alleged that his personal information was part of a 2022 data breach. Id. at 1. Plaintiff further alleged the data breach exposed the names, Social Security numbers, medical treatment information, and health insurance information of an estimated 11,595 individuals. Id. at 2.
After IBS became aware of the data breach, it notified impacted individuals. Plaintiff maintained that by issuing this notification, IBS "created a present, continuing, and significant risk of suffering identity theft." Id. On March 7, 2023, Plaintiff filed suit against IBS, alleging seven causes of action including negligence, invasion of privacy, unjust enrichment, and violation of the North Carolina Unfair Trade Practices Act. Id.
IBS moved to dismiss and asserted Plaintiff lacked Article III standing to bring his claims. IBS argued Plaintiff was "not able to plead facts that show there was actual misuse of data that resulted in identity theft, fraud, or another concrete injury-in-fact." Id. at 4. Plaintiff countered that he had standing to sue "because the data breach harmed him, will harm him again, and requires him to expend resources mitigating that harm" and that these harms "confer standing" based on Fourth Circuit precedent. Id.
The Court's Order
The Court granted IBS's motion to dismiss. The Court held Plaintiff failed to establish standing. The Court reasoned that to proceed with a lawsuit, Article III requires a plaintiff to "demonstrate (1) an injury in fact; (2) causation; and (3) redressability." Id. at 5 (citing David v. Alphin, 704 F.3d 327, 333 (4th Cir. 2013)).
On the first element, the Court explained that Plaintiff must show he "suffered an invasion of a legally protected interest which is concrete, particularized, and actual or imminent." Id. Plaintiff argued that he was injured because the breach: "(1) exposed his medical records, thus invading his privacy; (2) exposed information criminals can use to commit fraud and steal his identity; (3) required him to spend resources to mitigate the risk; and (4) caused him to suffer from anxiety, sleep disruption, stress, fear, and frustration." Id. Relying on Fourth Circuit precedent, the Court rejected Plaintiff's argument that he was injured because of the data breach because nowhere in the pleadings did Plaintiff claim that he was a victim of identity theft or fraud, that risk of future theft was "certainly impending," or provide instances of his personal information being exploited. Further, spending resources to mitigate the increased risk caused by the breach, where there was no misuse of data, was too speculative to confer standing.
Turning to Plaintiff's claims of emotional harm, the Court opined that although the Supreme Court took no position on whether emotional harm confers standing in TransUnion v. Ramirez, Fourth Circuit precedent, in Beck, rejected a Plaintiff's claims that "emotional upset" and "fear of future identity theft and financial fraud" was sufficient to confer standing. Id. at 8 (quoting Beck v. McDonald, 848 F.3d. 262 (4th Cir. 2017). Accordingly, the Court dismissed Plaintiff's claims of emotional harm as "bare assertions of possible or potential harm." Id.
Implications For Companies
Standing remains an effective defense for companies to challenge putative class actions at the responsive pleading stage especially, whereas here, Plaintiff failed to assert facts demonstrating harm stemming from a data breach.
Panighetti shows that data breach plaintiffs cannot rely on speculative injuries based on future harm to satisfy Article III standing requirements. However, companies asserting an Article III standing defense must consider the possibility of a class action plaintiff refiling in state court when determining whether to challenge standing in federal court.
Disclaimer: This Alert has been prepared and published for informational purposes only and is not offered, nor should be construed, as legal advice. For more information, please see the firm's full disclaimer.
