Heather Dieffenbach v. Barnes & Noble, 887 F.3d 826

In 2012 Barnes & Noble discovered POS "PIN pad" terminals were compromised, exposing customers’ names, card numbers, expirations and PINs.
Class action plaintiffs alleged injuries including temporary loss of use of funds (while banks reversed charges), time spent resolving issues with banks/police, inability to use compromised accounts for days, and costs of credit-monitoring services.
District court initially held plaintiffs lacked standing; after Seventh Circuit decisions (Remijas and Lewert) the court found injury alleged but dismissed for allegedly failing to plead compensable damages; an amended complaint was also dismissed.
Plaintiffs sued under state statutes including California’s Customer Records Act and Unfair Competition Law and the Illinois Consumer Fraud Act; jurisdiction was under CAFA.
The Seventh Circuit held that alleged harms (temporary loss of use of funds, time and paperwork to rectify breaches, out-of-pocket credit-monitoring fees) are economic injuries that can support standing and money damages under the relevant state laws.
The panel vacated the dismissal and remanded for further proceedings, noting unresolved merits and class-certification issues and declining to decide whether Barnes & Noble was liable for failing to prevent the criminal breach.

Issue	Plaintiff's Argument	Defendant's Argument	Held
Standing / Injury-in-fact	Data theft caused concrete harms (time value of money, time spent, monitoring costs) so plaintiffs have standing	Plaintiffs suffered no cognizable injury and thus lack standing	Plaintiffs alleged sufficient concrete injuries; standing exists (consistent with Remijas, Lewert)
Sufficiency of pleading damages	General allegations of economic loss suffice under Fed. R. Civ. P. 8; special damages not claimed	Complaint fails to plead particularized damages as required under state pleading standards	Federal rules govern pleadings; general allegation of injury is adequate and dismissal for lack of pleaded damages was improper
Recoverability under California law (Customer Records Act / UCL)	Temporary loss of use of funds, time/paperwork, and inability to use accounts are "lost money or property" recoverable under state law	Defendant argued plaintiffs failed to plead recoverable damages under state law	Court held those economic harms fit California’s "lost money or property" concept and can support damages; failure-to-gain claim rejected
Recoverability under Illinois law (Consumer Fraud Act)	Out-of-pocket credit-monitoring fees and temporary card deactivation are "actual damage" recoverable	Defendant relied on contrary appellate authority and urged dismissal	Court held a measurable out-of-pocket monthly fee is actual damage; complaint cannot be dismissed before plaintiffs prove causation

Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688 (7th Cir. 2015) (consumers whose data were stolen have standing)
Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963 (7th Cir. 2016) (data-breach plaintiffs can demonstrate injury-in-fact)
Lujan v. Defenders of Wildlife, 504 U.S. 555 (U.S. 1992) (standing requires concrete injury-in-fact)
Walker v. Armco Steel Corp., 446 U.S. 740 (U.S. 1980) (federal rules govern pleading requirements in federal court)
Gasperini v. Center for Humanities, Inc., 518 U.S. 415 (U.S. 1996) (choice between federal and state procedural rules)
Shady Grove Orthopedic Assocs. v. Allstate Ins. Co., 559 U.S. 393 (U.S. 2010) (federal rules can preempt contrary state procedural rules)
Burlington N. & Santa Fe Ry. v. White, 548 U.S. 53 (U.S. 2006) (compensable injury can exist even when back pay is later awarded)
Kwikset Corp. v. Superior Court, 51 Cal.4th 310 (Cal. 2011) (California’s "lost money or property" embraces varied economic injuries)
Reiter v. Sonotone Corp., 442 U.S. 330 (U.S. 1979) (out-of-pocket money is a conventional understanding of actual damages)