The decision was delivered April 14 in the U.S. Seventh Circuit Court of Appeals by Chief Judge Diane Wood, with Judges William Bauer and David Hamilton in agreement. The ruling revived a class action suit against P.F. Chang’s, which was brought by John Lewert and Lucas Kosner in 2014 in U.S. District Court for the Northern District of Illinois. P.F. Chang’s is based in Arizona, with establishments across the country.
Lewert and Kosner separately visited the P.F. Chang’s in Northbrook in April 2014, both using their debit cards to pay for meals. On June 12 that year, Chang’s announced its computer system had been breached and some debit and credit card data had been stolen. The restaurant chain encouraged customers to keep an eye on their card statements and credit reports. Later in the summer, P.F. Chang’s said it determined the only restaurant in Illinois affected by the breach was the one at Woodfield Mall in suburban Schaumburg.
Lewert said he spent time and effort monitoring his financial statements and credit report, but did not find any fraudulent activity with his debit card. Kosner was not so lucky. He learned four bogus purchases had been made with his card, but his bank stopped the charges before payments were made. Nonetheless, this prompted him to spend $106.89 on a credit monitoring and protection service. He said he also was unable to accrue points while waiting for a replacement card. The two men filed independent suits, then consolidated their grievances into a class action lawsuit.
U.S. District Judge John Darrah had tossed their suit for lack of standing, concluding they had not suffered any real harm under the law.
The appellate judges disagreed, however, finding Lewert, Kosner and others like them, faced the “concrete” possibility of future injury – identity theft and fraudulent charges – which is enough to sustain their suit. Wood added that plaintiffs should not have to wait until such acts actually occur before commencing a suit.
“It is plausible to infer a substantial risk of harm from the data breach, because a primary incentive for hackers is ‘sooner or later to make fraudulent charges or assume those consumers’ identities,’” Wood said, partially quoting a Seventh Circuit opinion in a similar case from last year.
To back her position, Wood pointed to the U.S. Supreme Court, which has said “certainly impending” harm can be adequate grounds for a suit. The High Court made this determination in a 2013 case in which plaintiffs feared the federal government might have intercepted their private communications.
However, Judge Wood went further, pointing out Lewert and Kosner do not have to solely rely on possible future injury, but can claim they have already suffered injuries enough to support a suit.
Wood remanded the case to district court for further proceedings.
Wood noted other appellate claims made by plaintiffs are questionable, such as their contention the cost of their meals at P.F. Chang’s are injuries, because they would not have dined there if they had known of the chain’s allegedly inadequate data precautions. Wood noted this assertion would only apply if the meals themselves were “defective or dangerous.”
Plaintiffs also claim they have a property right to their personal financial data, and the theft of their data, in and of itself, is a loss, just as the theft of their car would qualify as a loss. However, Wood was not persuaded, saying “actual damages” are required.
Lewert is represented by the firms of Siprut PC and Maurice Wutscher. Kosner is represented by Lite, DePalma & Greenberg, and Gordon Law Offices. All the firms are of Chicago.
P.F. Chang’s is defended by attorneys from the Chicago firms of Levin Ginsburg LLP and Benesch, Friedlander, Coplan & Aronoff, as well as the Los Angeles office of Lewis, Brisbois, Bisgaard & Smith.