In Re: Science Applications International Corp. (Saic) Backup Tape Data Theft Litigation
45 F. Supp. 3d 14
D.D.C.2014Background
- In Sept. 2011 backup tapes containing PII/PHI for ~4.7 million TRICARE beneficiaries were stolen from an SAIC employee’s car; tapes did not contain financial account data and required specialized hardware/software to read. SAIC and TRICARE notified affected persons and offered one year of credit monitoring.
- Thirty-three named plaintiffs (from eight suits consolidated into an MDL) sued SAIC, TRICARE, DoD and Secretary, alleging injuries including increased risk of identity theft, invasion of privacy, monitoring costs, loss of value of data, and some instances of actual fraud.
- Defendants moved to dismiss for lack of Article III standing and, alternatively, for failure to state claims. The Court considered only the Rule 12(b)(1) standing arguments at this stage.
- Applying Lujan and Clapper, the Court held that an increased risk of future identity theft and precautionary costs generally do not constitute a concrete, imminent injury sufficient for standing absent facts showing actual or certainly impending misuse.
- Of 33 plaintiffs, only two (Robert Curtis and Dorothy Yarde) plausibly alleged injuries traceable to the tape theft: Curtis alleged fraudulent loan solicitations likely requiring SSN and DOB; Yarde alleged unsolicited calls referencing an unlisted phone number and a specific medical condition. All other plaintiffs’ asserted harms were speculative and dismissed for lack of standing.
- The Court granted in part and denied in part the motions to dismiss (standing); it reserved rulings on Rule 12(b)(6) merits and scheduled a status conference given the dismissal of most plaintiffs.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether increased risk of identity theft and costs to mitigate constitute injury-in-fact | Increased risk (claimed 9.5x) and monitoring costs are concrete injuries | Risk and mitigation costs are speculative; injury requires actual or certainly impending harm | Increased risk and mitigation costs alone do not confer standing; dismissed |
| Whether mere loss/theft of backup data without evidence of access is an invasion of privacy | Theft alone invaded privacy because private records were taken | Privacy requires disclosure/access by a third party; mere loss without viewing is speculative | No privacy injury absent allegation that records were accessed; most privacy claims dismissed |
| Whether plaintiffs can claim loss of value of personal/medical data or insurance premiums | Data/insurance premiums have market/value lost by breach | Plaintiffs did not allege intent to sell data or any diminution in insurance value; speculative | Loss-of-value and premium theories do not plausibly allege injury; dismissed |
| Whether any plaintiffs alleged actual misuse causally connected to the breach | Some plaintiffs alleged unauthorized charges, loans, solicitations, or medical fraud | Defendants: financial data was not on tapes; many harms plausibly from other sources; plaintiffs must trace harm to tapes | Two plaintiffs (Curtis and Yarde) plausibly linked harms to tape theft and have standing; others lacked causation and were dismissed |
Key Cases Cited
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (standing requires injury-in-fact, causation, redressability)
- Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138 (speculative chain of future events insufficient for standing; plaintiffs cannot manufacture standing via mitigation costs)
- Reilly v. Ceridian Corp., 664 F.3d 38 (data-breach where unknown whether hacker accessed data; increased risk alone insufficient for standing)
- Anderson v. Hannaford Bros., 659 F.3d 151 (permitting standing where numerous fraud instances were clearly linked to breach)
- Krottner v. Starbucks Corp., 628 F.3d 1139 (possibility of future injury may suffice where intrusion suggests substantial risk)
- Warth v. Seldin, 422 U.S. 490 (named plaintiffs must personally allege injury to represent class)