I Tan Tsao v. Captiva MVP Restaurant Partners, LLC ( 2021 )

USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 1 of 28
[PUBLISH]
IN THE UNITED STATES COURT OF APPEALS
FOR THE ELEVENTH CIRCUIT
________________________
No. 18-14959
________________________
D.C. Docket No. 8:18-cv-01606-WFJ-SPF
I TAN TSAO,
individually and on behalf of all others similarly situated,
Plaintiff-Appellant,
versus
CAPTIVA MVP RESTAURANT PARTNERS, LLC,
A Florida Limited Liability Company doing business as PDQ,
Defendant-Appellee.
_______________________
Appeal from the United States District Court
for the Middle District of Florida
_______________________
(February 4, 2021)
Before JORDAN, TJOFLAT, and TRAXLER,* Circuit Judges.
TJOFLAT, Circuit Judge:
*
The Honorable William B. Traxler, Senior United States Circuit Judge for the Fourth
Circuit, sitting by designation.
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 2 of 28
I Tan Tsao seeks to bring a number of claims against PDQ—a restaurant he
patroned—following a data breach that exposed PDQ customers’ personal
financial information. Tsao’s appeal presents two questions. First, did Tsao have
standing to sue based on the theory that he and a proposed class of PDQ customers
are now exposed to a substantial risk of future identity theft, even though neither
Tsao nor the class members have suffered any misuse of their information?
Second, and alternatively, were Tsao’s efforts to mitigate the risk of future identity
theft a present, concrete injury sufficient to confer standing? For both questions,
we conclude the answer is no, and we accordingly affirm the District Court’s order
dismissing the case without prejudice.
I.
PDQ is a group of fast casual restaurants that sells chicken tenders, chicken
nuggets, salads, and sandwiches. Like most restaurants today, PDQ accepts
payment through a point of sale system where customers can insert credit or debit
cards to pay for their meal. When customers pay with a debit or credit card, PDQ
collects some data from the cards, including the cardholder’s name, the account
number, the card’s expiration date, the card verification value code (“CVV”), and
PIN data for debit cards. PDQ then stores this data in its point of sale system and
transmits the information to a third party for processing and for completion of the
payment.
2
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 3 of 28
Beginning on May 19, 2017, a hacker exploited PDQ’s point of sale system
and gained access to customers’ personal data—the credit and debit card
information—through an outside vendor’s remote connection tool. PDQ later
became aware of the breach, and on June 22, 2018, it posted a notice to customers
that it had “been the target of a cyber-attack.” The notice stated that “[a]ll PDQ
locations in operation” between May 19, 2017, and April 20, 2018, were affected
by the attack, and the notice listed the customers’ personal information that “may
have been accessed”: cardholder names, credit card numbers, card expiration dates,
and CVVs. Because of the nature of the breach, PDQ stated that it “was not
possible to determine the identity or exact number of credit card numbers or names
that were accessed or acquired during” the cyber-attack. The notice repeatedly
made clear that PDQ customers’ information “may” have been accessed.
In October 2017—during the data breach period—plaintiff Tsao made at
least two food purchases at a PDQ restaurant in Pinellas, Florida, using two
different cards. On October 8, he paid with a Wells Fargo Home Rebate card, and
on October 31, he paid with a Chase Sapphire Reserve card. Both of these cards
offer Tsao the ability to accrue points or rebates by making certain types of
purchases—gas, dining, groceries, and travel, just to name a few. The Chase card
also requires Tsao to pay an annual fee of $450.00. Because Tsao made purchases
at PDQ during the breach period, the credit card data from these cards may have
3
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 4 of 28
been accessed by hackers. So, when Tsao learned of the possible breach in 2018,
he contacted both Chase and Wells Fargo and cancelled his cards.
Less than two weeks after PDQ’s announcement of the cyber-attack, Tsao
filed a class action complaint (the “Complaint”) in the Middle District of Florida
on behalf of a nationwide class, or alternatively, a separate Florida class. The
Complaint lists a variety of injuries that PDQ customers allegedly suffered as a
result of the cyber-attack, including “theft of their personal financial information,”
“unauthorized charges on their debit and credit card accounts,” and “ascertainable
losses in the form of the loss of cash back or other benefits.” Tsao asserts that he
and the class members “have been placed at an imminent, immediate, and
continuing increased risk of harm from identity theft and identity fraud, requiring
them to take the time which they otherwise would have dedicated to other life
demands such as work and effort to mitigate the actual and potential impact of the
Data Breach on their lives.” The Complaint also includes some general
information from the Federal Trade Commission and Government Accountability
Office about the risks associated with cyber-attacks and lists a few noteworthy data
breaches involving the restaurant industry.
Based on these alleged injuries, the Complaint claims that PDQ (1) breached
an implied contract by failing to safeguard customers’ credit card data (Count I);
(2) was negligent in failing to provide adequate security for the credit card data
4
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 5 of 28
(Count II); (3) was per se negligent because PDQ violated Section 5 of the Federal
Trade Commission Act (15 U.S.C. § 45), which prohibits unfair practices that
affect commerce (Count III); (4) was unjustly enriched when it received payments
from the customers but failed to provide those customers with adequate data
security (Count IV); and (5) violated the Florida Unfair and Deceptive Trade
Practices Act by failing to, among other things, maintain “adequate . . . data
security practices” (Count VI). The Complaint additionally seeks a declaratory
judgment stating that “PDQ’s existing data security measures do not comply with
its contractual obligations and duties of care” and that PDQ, in order to comply
with those obligations, is required to implement and maintain a variety of security
measures (Count V).
PDQ moved to dismiss the Complaint on August 28, 2018. PDQ argued that
the Complaint failed to state a claim under Federal Rules of Civil Procedure
12(b)(1), (b)(6), and (b)(7) “for failure to satisfy Article III standing, to state a
claim upon which relief can be granted, and/or for failure to join indispensable
parties.” On the standing issue, PDQ emphasized that, although customer data
may have been “compromised” or “exposed” during the cyber-attack, Tsao failed
to identify “a single incident involving an actual misuse of the credit card
information, much less any misuse . . . causing any of the customers any actual
injury” (emphasis in original). Instead, PDQ argued, Tsao’s claims were
5
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 6 of 28
“premised on a fear that his credit card information may be misused at some point
in the future,” and since he cancelled his cards before any misuse occurred, he was
foreclosed from alleging damages. And even if Tsao did incur some out-of-pocket
expenses to mitigate the risk of misuse, PDQ claimed that such “manufacture[d]
standing” was not enough to satisfy Article III.
Tsao’s response to the motion to dismiss focused heavily on three types of
injuries he allegedly suffered in his efforts to mitigate the perceived risk of future
identity theft: lost cash back or reward points, lost time spent addressing the
problems caused by the cyber-attack, and restricted card access resulting from his
credit card cancellations. On the first point—the loss of cash back or reward
points—Tsao argued that, because he cancelled his Chase and Wells Fargo cards in
anticipation of possible misuse, he temporarily “lost the opportunity to accrue” the
rewards connected to those cards. And on the latter two points—lost time and
restricted account access—Tsao asserted that he “expended time and effort” to
cancel his cards and to deal with the impact of the cyberattack, and since he
cancelled the cards, he lost access to his “preferred accounts.” Importantly,
however, Tsao did not point to any specific instances in which his—or any other
class member’s—identity was stolen, cards were fraudulently charged, or data was
misused. Rather, the thrust of Tsao’s response was that he had standing (1)
6
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 7 of 28
because he and the class were at an elevated risk of identity theft, or, alternatively,
(2) because he took “proactive[]” steps to mitigate the risk of identity theft.
On November 1, 2018, the District Court dismissed Tsao’s Complaint
without prejudice for lack of standing. The Court noted that although Tsao
claimed that his private data was “compromised” and “exposed” to criminals, not
once did he allege “that his credit cards were used in any way by a thief or that his
identity was stolen.” Nor did Tsao identify “a single specific, concrete injury in
fact that he or anyone else [] suffered as a result of any misuse of customer credit
card information.” These conclusory allegations of harm, the Court found, were
speculative at best, and mere “[e]vidence of a data breach, without more, [was]
insufficient to satisfy injury in fact under Article III standing.”
This appeal followed. Tsao’s briefing mostly retreads the arguments he
made below—that he and the class are at an elevated risk of future identity theft
and that he lost cash back and rewards point, time, and account access—in an
effort to satisfy Article III’s standing requirement. But after a careful review of the
record and with the benefit of oral argument, we affirm the District Court’s
dismissal for lack of standing.
II.
Whether plaintiffs have standing to sue is a threshold jurisdictional question
that we review de novo. Debernardis v. IQ Formulations, LLC, 942 F.3d 1076,
7
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 8 of 28
1083 (11th Cir. 2019). On a facial attack to a complaint for lack of standing, we
take the allegations of the complaint as true. McElmurray v. Consol. Gov’t of
Augusta-Richmond Cty., 501 F.3d 1244, 1251 (11th Cir. 2007).
III.
Tsao’s arguments focus on two general theories of standing. First, he argues
that he could suffer future injury from misuse of the personal information disclosed
during the cyber-attack (though he has not yet), and this risk of misuse alone is
enough to satisfy the standing requirement. Then, he argues that he has already
suffered some “concrete, particularized” mitigation injuries—for example, lost
time, lost rewards points, and loss of access to accounts—that are sufficient to
confer standing. Below, we reject both of these theories of standing. But before
we dive into Tsao’s arguments, an overview of our standing case law is in order.
A.
Under Article III of the Constitution, the jurisdiction of a federal court is
limited to “cases” and “controversies.” See Wilding v. DNC Servs. Corp., 941 F.3d
1116, 1124 (11th Cir. 2019). To satisfy the “case” or “controversy” requirement, a
plaintiff in a matter must have standing to sue. See Spokeo, Inc. v. Robins, 136 S.
Ct. 1540, 1546–47 (2016). And for a plaintiff to have standing, it must have “(1)
suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of
the defendant, and (3) that is likely to be redressed by a favorable judicial
8
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 9 of 28
decision.” Id. at 1547 (citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61, 112
S. Ct. 2130, 2136 (1992)). A plaintiff at the pleading stage, as the party invoking
federal jurisdiction, bears the burden of establishing these elements by alleging
facts that “plausibly” demonstrate each element. Trichell v. Midland Credit
Mgmt., Inc., 964 F.3d 990, 996 (11th Cir. 2020)
Of the three standing elements, Tsao’s allegations implicate only injury. At
the pleading stage, “general factual allegations of injury” are enough. Lujan, 504
U.S. at 561, 112 S. Ct. at 2137. But this does not mean that any allegations of
injury can push a plaintiff across the standing threshold. Rather, a plaintiff must
set forth general factual allegations that “plausibly and clearly allege a concrete
injury,” Thole v. U. S. Bank N.A, 140 S. Ct. 1615, 1621 (2020), and that injury
must be “‘actual or imminent, not conjectural or hypothetical,’” Spokeo, Inc., 136
S. Ct. at 1548 (quoting Lujan, 504 U.S. at 560, 112 S. Ct. at 2136). “[M]ere
conclusory statements[] do not suffice.” Ashcroft v. Iqbal, 556 U.S. 662, 678, 129
S. Ct. 1937, 1949 (2009).
This standing framework raises two questions. First, what is a “concrete”
injury? In Spokeo, the United States Supreme Court offered a straightforward
definition: “A concrete injury must be de facto; that is, it must actually exist.”
Spokeo, Inc., 136 S. Ct. at 1548 (quotations omitted). The Supreme Court noted
that, when it uses the term “concrete,” it intends to “convey the usual meaning of
9
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 10 of 28
the term—‘real,’ and not ‘abstract.’” Id. (quoting Webster’s Third New
International Dictionary 472 (1971)). This Court has adhered to that definition,
and we have noted that “[a] concrete injury need be only an ‘identifiable trifle.’”
Salcedo v. Hanna, 936 F.3d 1162, 1167 (11th Cir. 2019) (quoting United States v.
Students Challenging Regul. Agency Proc’s. (SCRAP), 412 U.S. 669, 689 n.14, 93
S. Ct. 2405, 2417 n.14 (1973)) (emphasis added).
Typically, tangible 1 injuries are “concrete.” See Trichell, 964 F.3d at 997.
Tangible injuries can include both straightforward economic injuries, see
Debernardis, 942 F.3d at 1084, and more nebulous injuries, like lost time, see
Salcedo, 936 F.3d at 1173, or the loss of a “fraction of a vote,” id. at 1167 (quoting
SCRAP, 412 U.S. at 689 n.14, 93 S. Ct. at 2417 n.14).
But although many types of injuries may qualify as “concrete,” there is
another restriction on standing: “Where a ‘hypothetical future harm’ is not
‘certainly impending,’ plaintiffs ‘cannot manufacture standing merely by inflicting
harm on themselves.’” Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917, 931
(11th Cir. 2020) (en banc) (quoting Clapper v. Amnesty Int’l USA, 568 U.S. 398,
1
Intangible injuries, such as a mere statutory violation, will sometimes qualify as
concrete, but that inquiry depends upon the context of the statutory violation. See Trichell v.
Midland Credit Mgmt., Inc., 964 F.3d 990, 997 (11th Cir. 2020). Although intangible injuries
are not relevant here, we mention them briefly for the sake of completeness.
10
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 11 of 28
416, 133 S. Ct. 1138, 1151 (2013)). This raises the second question: When is an
injury “actual or imminent” and not just “conjectural or hypothetical?”
In Clapper, the United States Supreme Court addressed whether a group of
plaintiffs—people in the United States whose work required them to engage in
sensitive international communications that may have been the target of
surveillance under a federal statute—suffered an injury in fact because “there [wa]s
an objectively reasonable likelihood that their communications w[ould] be
acquired under [the statute] at some point in the future.” Clapper, 568 U.S. at 401,
133 S. Ct. at 1143. The Supreme Court found no injury—and thus no standing—
because the plaintiffs “merely speculate[d] and ma[de] assumptions about whether
their communications with their foreign contacts w[ould] be acquired” under the
statute. Id. at 411, 133 S. Ct. at 1148. Such speculation was not enough:
“[T]hreatened injury must be certainly impending to constitute injury in fact, . . .
[a]llegations of possible future injury are not sufficient.” Id. at 409, 133 S. Ct. at
1147 (emphasis in original) (quotations omitted). While this standard does not
require a plaintiff to show that it is “literally certain that the harms they identify
will come about,” it, at the very least, requires a showing that there is a “substantial
risk” that the harm will occur. Id. at 414 n.5, 133 S. Ct. at 1150 n.5.
This Circuit recently discussed Clapper’s “high standard for the risk-of-
harm analysis” in the context of speculative allegations of future identity theft.
11
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 12 of 28
Muransky, 979 F.3d at 927. In Muransky, customers of Godiva chocolate stores
alleged violations of the Fair and Accurate Credit Transactions Act (“FACTA”),
claiming that Godiva printed too many digits on credit card receipts and thus
exposed customers to an elevated risk of identity theft. Id. at 922. The injuries
alleged were merely “statutory in nature”—that is, the harm to plaintiffs was
simply that FACTA had been violated. Id. As the litigation wore on, the parties
began to negotiate a settlement, fueled largely by the United States Supreme
Court’s impending decision in Spokeo v. Robins, which would decide whether a
statutory violation alone could confer standing. Id. With Spokeo still outstanding,
the District Court certified the proposed class, approved a settlement between the
parties, and directed notice of the settlement to the class members. Id. at 922–23.
But before the District Court could hold a fairness hearing on the class
settlement, the Supreme Court issued its decision in Spokeo. Id. An objector to
the Godiva settlement argued that the District Court was obliged to determine
whether, in light of Spokeo, plaintiffs had standing to sue for a statutory violation,
but the District Court ignored the issue and approved the settlement. Id. at 923.
This Court, sitting en banc, vacated the District Court’s order approving the
settlement and remanded with instructions to dismiss for lack of standing. Id. at
936. We reasoned, in relevant part, that Muransky’s naked allegations that he and
the class were exposed to an “elevated risk” of identity theft—but not that he and
12
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 13 of 28
the class were ever actually the victims of identity theft—were not enough to
confer standing. Id. at 933. But in an attempt to end run around Spokeo,
Muransky claimed that he suffered a direct injury in fact when he spent time
“destroying or safeguarding” his receipts in an effort to mitigate his risk of future
identity theft. Id. at 931. Citing Clapper, this Court flatly rejected Muransky’s
argument: “Where a ‘hypothetical future harm’ is not ‘certainly impending,’
plaintiffs ‘cannot manufacture standing merely by inflicting harm on themselves.’
[] Muransky is no different than the Clapper plaintiffs in this respect—his
management-of-risk claim is bound up with his arguments about actual risk.” Id.
(citing Clapper, 568 U.S. at 416, 422, 133 S. Ct. at 1151, 1155).
From Clapper and Muransky, we can distill two legal principles relevant to
Tsao’s claims. First, a plaintiff alleging a threat of harm does not have Article III
standing unless the hypothetical harm alleged is either “certainly impending” or
there is a “substantial risk” of such harm.2 Clapper, 568 U.S. at 409, 414 n.5, 133
S. Ct. at 1147, 1150 n.5; Muransky, 979 F.3d at 931. Second, if the hypothetical
harm alleged is not “certainly impending,” or if there is not a substantial risk of the
harm, a plaintiff cannot conjure standing by inflicting some direct harm on itself to
2
The Supreme Court indicated that both the “certainly impending” and “substantial risk”
standards are applicable in future injury cases, albeit without resolving whether they are distinct.
See Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158, 134 S. Ct. 2334, 2341 (2014). As a
result, we discuss both throughout this opinion.
13
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 14 of 28
mitigate a perceived risk. Clapper, 568 U.S. at 416, 422, 133 S. Ct. at 1151, 1155;
Muransky, 979 F.3d at 931. With these two principles in mind, we turn to Tsao’s
claims.
B.
We begin with Tsao’s theory that he has Article III standing because he
faces a “substantial risk of identity theft, fraud, and other harm in the future as a
result of the data breach.” Although this Circuit has not addressed the issue head-
on, a number of our sister circuits have, and they are divided. On the one hand, the
Sixth, Seventh, Ninth, and D.C. Circuits have all recognized—at the pleading
stage—that a plaintiff can establish injury-in-fact based on the increased risk of
identity theft. See Attias v. Carefirst, Inc., 865 F.3d 620, 629 (D.C. Cir. 2017);
Galaria v. Nationwide Mut. Ins. Co., 663 F. App’x 384, 387–89 (6th Cir. 2016);
Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 692, 694–95 (7th Cir. 2015);
Krottner v. Starbucks Corp., 628 F.3d 1139, 1142–43 (9th Cir. 2010); Pisciotta v.
Old Nat’l Bancorp, 499 F.3d 629, 633–34 (7th Cir. 2007). On the other hand, the
Second, Third, Fourth, and Eighth Circuits have declined to find standing on that
theory. See Beck v. McDonald, 848 F.3d 262, 273–76 (4th Cir.), cert. denied sub
nom. Beck v. Shulkin, 137 S. Ct. 2307 (2017); Whalen v. Michaels Stores, Inc., 689
F. App’x 89, 90–91 (2d Cir. 2017); In re SuperValu, Inc., 870 F.3d 763, 770–72
14
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 15 of 28
(8th Cir. 2017); Reilly v. Ceridian Corp., 664 F.3d 38, 42–44 (3d Cir. 2011). 3 Of
course, we are not bound by any of these cases, but a brief overview of their
reasoning is helpful.
Generally speaking, the cases conferring standing after a data breach based
on an increased risk of theft or misuse included at least some allegations of actual
misuse or actual access to personal data. In Attias, two plaintiffs alleged that they
suffered identity theft when their anticipated tax refunds went missing. Attias, 865
F.3d at 626 n.2. In Galaria, plaintiffs alleged that their data was accessed and had
“already been stolen” by “ill-intentioned criminals.” Galaria, 663 F. App’x at 388.
In Remijas, plaintiffs alleged that personal data had “already been stolen” and that
“9,200 cards [] experienced fraudulent charges.” Remijas, 794 F.3d at 692–94.
And in Krottner, at least one plaintiff alleged that someone “attempted to open a
bank account in his name.” Krottner, 628 F.3d at 1142.
3
It is worth noting that the First Circuit appears to have gone both ways on this issue. In
Anderson v. Hannaford Bros., 659 F.3d 151, 162–67 (1st Cir. 2011), the First Circuit declined to
question whether victims of a data breach—who alleged 1,800 instances of credit-card fraud—
had standing to sue. But when analyzing Anderson in a different data breach case, the First
Circuit drew the distinction between instances where confidential data has actually been
accessed and case where data might be accessed. Katz v. Pershing, LLC, 672 F.3d 64, 80 (1st
Cir. 2012) The Court held that, in the latter scenario, the “theoretical possibility” of access to
confidential data “simply does not rise to the level of a reasonably impending threat.” Id. at 79.
Since Katz, other Circuits have interpreted First Circuit law to preclude standing based on
allegations of future identity theft unaccompanied by criminal activity involving the stolen
information, see Beck, 848 F.3d at 273, as have district courts within the First Circuit, see
Hartigan v. Macy’s, Inc., No. CV 20-10551-PBS, 2020 WL 6523124, at *3 (D. Mass. Nov. 5,
2020).
15
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 16 of 28
The outlier among the cases conferring standing is Pisciotta, 499 F.3d at
634. There, plaintiffs brought a class action against a bank after its website was
hacked, alleging that the bank failed to adequately secure the personal information
it solicited (including names, addresses, birthdates, and social security numbers)
when consumers applied for banking services on its website. Id. at 631. The
named plaintiffs did not allege any actual misuse or access to their data, but the
Seventh Circuit found standing nonetheless: “[T]he injury-in-fact requirement can
be satisfied by a threat of future harm or by an act which harms the plaintiff only
by increasing the risk of future harm that the plaintiff would have otherwise faced,
absent the defendant’s actions.” Id. at 634.
Though the Seventh Circuit’s opinion appears to sweep broadly on its face,
we are hesitant to read too closely into Pisciotta in light of two considerations.
First, Pisciotta is a pre-Clapper decision, and thus it is unclear if the Seventh
Circuit would have (or could have) reached the same conclusion with the benefit of
the Supreme Court’s opinion. Second, none of the Seventh Circuit data breach
cases that followed Pisciotta—including Remijas, 794 F.3d at 693, Lewert v. P.F.
Chang’s China Bistro, Inc., 819 F.3d 963 (7th Cir. 2016), and Dieffenbach v.
Barnes & Noble, Inc., 887 F.3d 826 (7th Cir. 2018)—even cite the case, suggesting
that Pisciotta should not weigh too heavily in our analysis.
16
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 17 of 28
Other Circuits have declined to find standing on an “elevated risk of identity
theft” theory where the plaintiffs failed to allege any actual misuse of class
members’ personal information. The Second Circuit, for example, distinguished a
breach of credit-card-specific data from a breach of other forms of personal
information in Whalen v. Michaels Stores, Inc., 689 F. App’x at 90. In Whalen,
Michaels Stores publicly announced a breach of card data, and Whalen filed suit
alleging that her card—which was used at Michaels during the breach period—had
been “physically presented for payment” at two locations in Ecuador, though no
charges were actually incurred. Id. To show standing, Whalen pointed to the two
attempts to use her cards in Ecuador, the “risk of future identity fraud,” and the lost
time and money she spent resolving the attempted fraudulent purchases. Id. But
the Second Circuit held that Whalen failed to allege a concrete injury because (1)
Whalen never paid, nor was asked to pay, for the attempted fraudulent charges in
Ecuador; (2) she did not identify a threat of future fraud, as her stolen credit card
had already been canceled and no other identifying information was stolen; and (3)
the complaint did not allege that she expended any time or money to monitor her
financial data. Id. at 90–91.
Similarly, in Reilly v. Ceridian Corp.—a pre-Clapper decision—a class of
law firm employees brought a putative class action against a payroll processing
firm (Ceridian) asserting various claims related to an increased risk of identity theft
17
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 18 of 28
and costs to monitor credit activity after Ceridian suffered a security breach. See
664 F.3d at 40. After the breach, Ceridian sent letters to the potential identity theft
victims, informing them of the breach: “[S]ome of your personal information . . .
may have been illegally accessed by an unauthorized hacker. . . . [T]he information
accessed included your first name, last name, social security number and, in
several cases, birth date and/or the bank account that is used for direct deposit.”
Id. (alterations in original). Although the plaintiffs argued that the breach left them
at an “increased risk of identity theft,” they did not allege any actual misuse of
personal information. Id. at 40–41 The Third Circuit, relying on Lujan, 504 U.S.
at 561, 112 S. Ct. at 2136–37, and Whitmore v. Arkansas, 495 U.S. 149, 155, 110
S. Ct. 1717, 1722–23 (1990), found that the plaintiffs’ alleged injuries were
hypothetical and relied on speculation, and thus they were not “imminent” or
“certainly impending.” Reilly, 664 F.3d at 43. As a result, the plaintiffs did not
have standing. Id.The Fourth Circuit has likewise rejected the “increased risk of future identity
theft” theory in the context of a data breach. In Beck v. McDonald, a class of
veterans who received medical treatment and health care at a South Carolina
Veterans Affairs Medical Center brought actions alleging violations of various
federal statutes following two data breaches at the Medical Center. 848 F.3d at
266. The plaintiffs sought to establish Article III standing based on (1) the harm
18
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 19 of 28
from the increased risk of future identity theft and (2) the cost of measures to
protect against it. Id. at 266–67. The Fourth Circuit, distinguishing Remijas and
Krottner on the ground that those cases included allegations of actual misuse,
found that the plaintiffs’ alleged injury from the elevated risk of identity theft was
“too speculative”: “[E]ven after extensive discovery, the Beck plaintiffs have
uncovered no evidence that the information contained on the stolen laptop has been
accessed or misused or that they have suffered identity theft, nor, for that matter,
that the thief stole the laptop with the intent to steal their private information.” Id.
at 274. The “mere theft” of the plaintiffs’ data, without something more, required
the consideration of the “attenuated chain of possibilities” rejected by Clapper. Id.
at 275. This theory of harm was simply “too speculative to constitute an injury-in-
fact.” Id. at 274.4
And notably, the Eighth Circuit in In re SuperValu, Inc. found no standing
on an “increased risk of future identity theft” theory, even when a named plaintiff
alleged actual misuse of personal information. 870 F.3d at 769–71. There, a class
of grocery store customers filed suit against SuperValu and other grocery store
owner-operators following two data breaches in which the customers’ financial
4
The Fourth Circuit later found standing in a data breach case where the plaintiffs did
allege that hackers “used—and attempted to use—the Plaintiffs’ personal information to open
Chase Amazon Visa credit card accounts without their knowledge or approval.” Hutton v. Nat’l
Bd. of Exam’rs in Optometry, Inc., 892 F.3d 613, 622 (4th Cir. 2018). There, as we do here, the
Fourth Circuit noted the distinction between cases alleging the possibility of misuse of personal
information and cases alleging actual misuse. See id.19
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 20 of 28
information was allegedly accessed and stolen. Id. at 765. The customers alleged
that, as a result of the data breaches, hackers were allowed to gain access to
customers’ “names, credit or debit card account numbers, expiration dates, card
verification value (CVV) codes, and personal identification numbers (PINs).” Id.
at 766. In support of their theory of standing, the customers relied on a June 2007
United States Government Accountability Office (GAO) report on data breaches,
which states that “identity theft” includes “many types of criminal activities,
including fraud on existing accounts—such as unauthorized use of a stolen credit
card number—or fraudulent creation of new accounts—such as using stolen data to
open a credit card account in someone else’s name.” Id. at 770 (citing U.S. Gov’t
Accountability Off., GAO-07-737, Personal Information: Data Breaches are
Frequent, but Evidence of Resulting Identity Theft is Limited; However, the Full
Extent is Unknown (2007), http://www.gao.gov/assets/270/262899.pdf (hereinafter
“GAO Report”)). That report points out, however, that compromised credit or
debit card information, without additional personal identifying information,
“generally cannot be used alone to open unauthorized new accounts.” Id. (citing
GAO Report at 30). The Eighth Circuit additionally noted that the GAO report
concludes that “most breaches have not resulted in detected incidents of identity
theft.” Id. at 771 (citing GAO Report at 21).
20
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 21 of 28
In light of the GAO Report’s findings, the Eighth Circuit found that the
plaintiffs failed to demonstrate a substantial risk that they would suffer identity
theft in the future. Id. at 770. The hackers in SuperValu were not alleged to have
stolen social security numbers, birth dates, or driver’s license numbers, and thus,
according to the GAO report, the risk of identity theft was “little to no[ne].” Id.The Court did find, however, that a lone named plaintiff alleged actual misuse, and
thus that plaintiff had standing based on present, but not future injury. Id. at 772.
We are persuaded by the reasoning of the Eighth Circuit in SuperValu, and
the facts of that case map closely to the facts of this one. Here, as the plaintiffs did
in SuperValu, Tsao has alleged that hackers may have accessed and stolen
customer credit card data “including the cardholder name, the account number,
expiration date, card verification value (‘CVV’), and PIN data for debit cards.”
And here, just like the plaintiffs in SuperValu, Tsao cites to the 2007 GAO Report
on data breaches in support of his theory that the PDQ hack may result in future
identity theft. But we, like the Eighth Circuit in SuperValu, believe the GAO
Report actually demonstrates why there is no “substantial risk” of identity theft
here. Tsao has not alleged that social security numbers, birth dates, or driver’s
license numbers were compromised in the PDQ breach, and the card information
allegedly accessed by the PDQ hackers “generally cannot be used alone to open
unauthorized new accounts.” GAO Report at 30. So, based on the GAO Report, it
21
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 22 of 28
is unlikely that the information allegedly stolen in the PDQ breach, standing alone,
raises a substantial risk of identity theft.
This leaves us with the risk that the hackers, if they accessed and stole
Tsao’s credit card information, could make unauthorized purchases with his cards
or drain his accounts. But again, the GAO Report suggests that most data breaches
have not resulted in detected incidents of fraud on existing accounts. See id. at 21.
Indeed, the GAO Report reviewed the 24 largest data breaches between January
2000 and June 2005 and found that only 4 of the 24 breaches (roughly 16.667%)
resulted in some form of identity theft, and only 3 resulted in account theft or fraud
(12.5%). Id. at 24–25. Given the low rate of account theft, the GAO Report
simply does not support the conclusion that the breach here presented a
“substantial risk” that Tsao would suffer unauthorized charges on his cards or
account draining.
Of course, we recognize that the GAO Report is over a decade old, and it is
possible that some breaches may present a greater risk of identity theft than others.
But even if we set aside the GAO Report and the reasoning of SuperValu, we
remain unconvinced that Tsao has met his burden to show that the there is a
“substantial risk” of harm, or that such harm is “certainly impending.” Clapper,
568 U.S. at 409, 414 n.5, 133 S. Ct. at 1147, 1150 n.5. Three considerations color
this conclusion.
22
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 23 of 28
First, we recently held in Muransky that conclusory allegations of an
“elevated risk of identity theft”—or, as Tsao puts it, a “continuing increased risk”
of identity theft—“[are] simply not enough” to confer standing. Muranksy, 979
F.3d at 933. Tsao’s allegations about the “increased risk” of identity theft are
supported only by reports defining identity theft, outlining the general risks of
identity theft, or stating that identity thieves have stolen $112 billion in the last six
years. These reports do nothing to clarify the risks to the plaintiffs in this case, and
Tsao’s threadbare allegations of “increased risk” are insufficient to confer
standing.
Second, Tsao offers only vague, conclusory allegations that members of the
class have suffered any actual misuse of their personal data—here, “unauthorized
charges.” But again, conclusory allegations of injury are not enough to confer
standing. See Iqbal, 556 U.S. at 678, 129 S. Ct. at 1949. Of course, as our sister
Circuits have recognized, evidence of actual misuse is not necessary for a plaintiff
to establish standing following a data breach. See, e.g., Beck, 848 F.3d at 275
(stating that district court did not impermissibly require plaintiffs to demonstrate
actual misuse). However, without specific evidence of some misuse of class
members’ data, a named plaintiff’s burden to plausibly plead factual allegations
sufficient to show that the threatened harm of future identity theft was “certainly
impending”—or that there was a “substantial risk” of such harm—will be difficult
23
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 24 of 28
to meet. Cf. Resnick v. AvMed, Inc., 693 F.3d 1317, 1323 n.1 (11th Cir. 2012)
(finding that plaintiffs who suffered “actual” identity theft had standing but noting
that “speculative” identity theft may not be sufficient to confer standing). As the
case law discussed above confirms, most plaintiffs that have failed to offer at least
some evidence of actual misuse of class members’ data have fared poorly in
disputes over standing. See Op. at 14–21.
Third, Tsao immediately cancelled his credit cards following disclosure of
the PDQ breach, effectively eliminating the risk of credit card fraud in the future.
Of course, even if Tsao’s cards are cancelled, some risk of future harm involving
identity theft (for example, the use of Tsao’s name) still exists, but that risk is not
substantial and is, at best, speculative.
In short, Tsao has not alleged either that the PDQ data breach placed him at
a “substantial risk” of future identity theft or that identity theft was “certainly
impending.” Clapper, 568 U.S. at 409, 414 n.5, 133 S. Ct. at 1147, 1150 n.5.
Evidence of a mere data breach does not, standing alone, satisfy the requirements
of Article III standing. It follows that Tsao does not have standing here based on
an “increased risk” of identity theft.
C.
We turn now to Tsao’s claims that he has suffered actual, present injuries in
his efforts to mitigate the risk of identity theft caused by the data breach.
24
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 25 of 28
Following notice of the PDQ data breach, Tsao notified Wells Fargo and
Chase to cancel his credit cards and, in his words, “proactively t[ook] steps to
mitigate the damage done by PDQ’s mistakes.” As a result of these mitigation
efforts, Tsao claims that he has suffered three distinct injuries: (1) lost opportunity
to accrue cash back or rewards points on his cancelled credit cards, (2) costs
associated with detection and prevention of identity theft in taking the time and
effort to cancel and replace his credit cards; and (3) restricted account access to his
preferred payment cards. Tsao’s mitigation efforts are not enough to confer
standing.
It is well established that plaintiffs “cannot manufacture standing merely by
inflicting harm on themselves based on their fears of hypothetical future harm that
is not certainly impending.” Clapper, 568 U.S. at 416, 133 S. Ct. at 1151; see also
Muransky, 979 F.3d at 931 (citing Clapper and stating the same). In Muransky,
this Court held that a plaintiff’s mitigation costs—there, “additional time
destroying or safeguarding his receipt”—were insufficient to confer standing
because there was no substantial risk of identity theft. Muransky, 979 F.3d at 931.
Although we noted that allegations of “wasted time” could sometimes “state a
concrete harm for standing purposes,” we noted that Muransky’s “management-of-
risk claim [wa]s bound up with his arguments about actual risk,” id. at 930–31
(quotations and citations omitted). As a result, Muransky’s “assertion of wasted
25
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 26 of 28
time and effort necessarily r[ose] or f[ell] along with” the Court’s determination of
whether there was a substantial risk of harm. Id. at 931.
So too here. The mitigation costs Tsao alleges are inextricably tied to his
perception of the actual risk of identity theft following the PDQ data breach. Tsao,
by his own admission, voluntarily cancelled his credit cards, and the three types of
harm he has identified flowed from that cancellation. By cancelling his cards, he
voluntarily forwent the opportunity to accrue cash back or rewards points on those
cards. By cancelling his cards, he voluntarily restricted access to his preferred
payment cards. And by cancelling his cards, he voluntarily spent time
safeguarding his accounts. Tsao cannot conjure standing here by inflicting injuries
on himself to avoid an insubstantial, non-imminent risk of identity theft. To hold
otherwise would allow “an enterprising plaintiff . . . to secure a lower standard for
Article III standing simply by making an expenditure based on a nonparanoid
fear.” Clapper, 568 U.S. at 416, 133 S. Ct. at 1151. The law does not permit such
a result.
IV.
We hold that Tsao lacks Article III standing because he cannot demonstrate
that there is a substantial risk of future identity theft—or that identity theft is
certainly impending—and because he cannot manufacture standing by incurring
26
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 27 of 28
costs in anticipation of non-imminent harm. Accordingly, we affirm the District
Court’s order dismissing the case without prejudice for lack of standing.
AFFIRMED.
27
USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 28 of 28
JORDAN, Circuit Judge, concurring in the judgment.
Given our recent decision in Muransky v. Godiva Chocolatier, Inc., 979 F. 3d
917 (11th Cir. 2020) (en banc)—a decision from which I dissented—I concur in the
judgment. I note only that the court here, rather than viewing Mr. Tsao’s allegations
favorably, necessarily engages in a value-laden and normative inquiry concerning
the question of “substantial risk” at the motion-to-dismiss stage. That to me is
problematic for a number of reasons, see id. at 964-70 (Jordan, J., dissenting), but
Muransky apparently has sanctioned such an analytical approach. Hopefully the
Supreme Court will soon grant certiorari in a case presenting the question of Article
III standing in a data breach case.
28