What is a data breach class action? Breach lawsuits under Rule 23, defined

A data breach class action is a civil action in which one or more people whose personal information was exposed in a security incident sue the organization that held it, on behalf of everyone similarly affected. In federal court it proceeds under Rule 23 of the Federal Rules of Civil Procedure, and a settlement binds the class only with the court's approval.

How a breach suit becomes a class action

Rule 23 sets four gates: a class too numerous to join individually, common questions of law or fact, representative claims typical of the class, and representatives who will fairly and adequately protect it. A class seeking damages under Rule 23(b)(3) also needs a finding that common questions predominate and that a class action is superior to separate suits.

Large breach classes can be heard in federal court under a 2005 amendment to 28 U.S.C. § 1332. It gives district courts original jurisdiction over class actions with more than $5,000,000 in controversy where any class member is a citizen of a different state from any defendant, unless the proposed classes total fewer than 100 members.

What the complaints allege

The panel order in the Change Healthcare cases lists the counts. Over a cyberattack announced on 21 February 2024, plaintiffs asserted tort counts (a failure to use reasonable care, including per se theories built on statutes), breach of contract or implied contract, unjust enrichment and violations of state consumer protection laws. Those are allegations against the defendant companies, not findings.

Standing after TransUnion

Exposure alone may not carry a damages claim. In its TransUnion decision (No. 20-297), issued on 25 June 2021, the Supreme Court held that every class member must have Article III standing to recover individual damages. It added that the mere risk of future harm, without more, cannot qualify as a concrete harm in a damages suit. The case concerned credit reports, not a breach.

How a case ends

A class settlement needs court approval after a hearing and a finding that it is fair, reasonable and adequate. The court directs notice to the class members who would be bound before it decides.

What it is not

It is not a regulator's case; agency actions sit on the enforcement tracker. It is not the notice duty itself, which comes from statutes such as a state breach notification law or the HIPAA Breach Notification Rule. And it is not an MDL: multidistrict litigation is how many such suits are grouped for pretrial work.

Where it appears on cisonews.net

The litigation tracker lists federal data breach class actions consolidated under an In re caption since 2022, built from CourtListener's RECAP archive of federal dockets. Breach outcomes lists companies on this record for both an Item 1.05 disclosure and a consolidated class action over the same incident.