U.S. District Court Judge Elizabeth A. Wolford, who is presiding over the Excellus data breach class action, reinstated certain plaintiffs' claims in a decision released on Friday that reconsidered and reversed her previous ruling dismissing those claims.
In a decision last February, Judge Wolford ruled that four of the twenty named plaintiffs in the class action could not proceed with their claims as they had not alleged any misuse of their personally identifiable information due to the breach. According to this ruling, the plaintiffs' risk of future harm was not "certainly impending" and so they had failed to allege an injury sufficient to establish Article III standing.
Following the February decision, the plaintiffs filed a motion for reconsideration in March, arguing the Court had relied on undeveloped details regarding the breach that should not have been considered at this stage.
The Second Circuit's May decision in the Whalen v. Michaels Stores Inc. case also helped strengthen the plaintiffs' motion for reconsideration.
The Whalen decision indicated in dicta that the theft of personally identifying information, such as Social Security numbers or birthdates, in a data breach would be enough for standing based on a threat of future harm.
"Until the Supreme Court or the Second Circuit definitively weighs in, in this circuit at least, harm based on the theft of personally identifying information, such as a Social Security number or date of birth, as alleged, is sufficient to establish standing," stated Judge Wolford in her decision.
The plaintiffs' motion for reconsideration also revealed new evidence which established that three of the dismissed plaintiffs' data had been extracted from Excellus and was for sale on the dark web. This reinforced their claims that their personally identifying information had been compromised and that hackers had harmful intentions.
Judge Wolford explained, "Had the court had the benefit of all this additional information when it rendered its decision and order, it would have reached a different conclusion --- and it does so now."
The plaintiffs are represented by co-lead interim class counsel Hadley L. Matarazzo and Kathryn Lee Bruns of Faraci Lange.
"The plaintiffs are pleased by the Court's ruling and are thankful that the claims of the representative plaintiffs whose personally identifiable and health information has been stolen, but not yet misused, are reinstated and will move forward on behalf of this class of individuals," said Hadley in a statement to the Democrat & Chronicle.