Chambliss v. CareFirst, Inc., 189 F. Supp. 3d 564

CareFirst announced in May 2015 that two data breaches (June 2014 and just before May 2015) exposed personal customer data of ~1.1 million people (names, birthdates, emails, subscriber IDs); CareFirst said medical records were not affected.
Named plaintiffs Chambliss and Adamson are CareFirst customers (Chambliss later left CareFirst); they brought a putative class action asserting negligence, breach of implied contract, unjust enrichment, declaratory judgment, and Maryland Personal Information Protection Act claims.
Plaintiffs do not allege any actual misuse of their data; Chambliss purchased credit-monitoring services (mitigation expense); no other monetary losses were pleaded.
Defendants moved to dismiss for lack of subject-matter jurisdiction (Rule 12(b)(1)), arguing plaintiffs lack Article III standing because they alleged only speculative future injuries.
The district court evaluated standing under the injury-in-fact, causation, and redressability framework and addressed four alleged injuries: increased risk of identity theft, mitigation costs, benefit-of-the-bargain loss, and diminished value of personal information.
The court granted the motion and dismissed all claims for lack of Article III standing, finding plaintiffs’ allegations too speculative and insufficiently imminent or concrete.

Issue	Plaintiff's Argument	Defendant's Argument	Held
Standing — increased risk of identity theft	Breach increased likelihood hackers will misuse Plaintiffs’ data causing future identity theft	Risk is speculative; no misuse alleged and stolen fields are not highly sensitive	No standing; future harm not "certainly impending" and rests on speculative chain of third‑party acts
Standing — mitigation costs	Chambliss incurred credit‑monitoring expenses to mitigate future harm	Mitigation costs cannot create standing absent certainly impending harm	No standing; mitigation expenses insufficient without imminent injury
Standing — benefit‑of‑the‑bargain loss	Plaintiffs lost the value of the bargain with CareFirst for data security	No allegation that insurance value or price was diminished by breach or that price included a security premium	No standing; benefit‑of‑the‑bargain not plausibly alleged
Standing — diminished value of personal data	Personal data has intrinsic market value that was reduced by the breach	No allegation plaintiffs tried to sell data or accepted lower price due to breach	No standing; diminution alleged without factual showing of market injury

Lujan v. Defenders of Wildlife, 504 U.S. 555 (injury‑in‑fact must be concrete and imminent)
Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138 (speculative future harm insufficient for standing)
Friends for Ferrell Parkway, LLC v. Stasko, 282 F.3d 315 (standing doctrines overview in Fourth Circuit)
Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688 (standing where plaintiffs alleged actual fraudulent charges)
In re Science Applications Int’l Corp. Backup Tape Data Theft Litig., 45 F. Supp. 3d 14 (loss of data without misuse does not by itself confer standing)
In re Zappos.com, Inc., 108 F. Supp. 3d 949 (same: speculative risk and mitigation costs insufficient)