In re Zappos.com, Inc., 108 F. Supp. 3d 949

In Jan. 2012 Zappos’s servers were breached and personal data for ~24 million customers was stolen; plaintiffs allege access to names, emails, addresses, phone numbers, passwords, and last four digits of credit cards.
Multiple lawsuits were consolidated by the JPML into multidistrict litigation and assigned to this court; prior motions (including to compel arbitration) were denied.
Plaintiffs filed two consolidated second amended complaints (Preira SAC and Stevens SAC); Zappos moved to dismiss for lack of Article III standing; motion practice and mediation produced stays and delay.
Plaintiffs assert standing based on (1) increased risk of identity theft/fraud, (2) diminished market value of their personal data, and (3) costs incurred (credit‑monitoring) to mitigate risk; only 3 of 12 named plaintiffs purchased monitoring; none allege actual identity theft or financial loss.
The court reexamined standing in light of Supreme Court authority (Clapper) and Ninth Circuit precedent (Krottner) and concluded plaintiffs’ pleadings fail to allege a concrete, particularized, and imminent injury.
Court dismissed the complaints without prejudice for lack of standing, granted leave to amend to allege actual misuse/identity theft if it has occurred, denied Zappos’s motion to strike as moot, and granted leave for excess pages.

Issue	Plaintiff's Argument	Defendant's Argument	Held
Standing from increased risk of identity theft	Risk is credible and imminent after data exposure; Krottner supports standing	Risk is speculative and not certainly impending; insufficient under Clapper	No standing; risk not sufficiently imminent after >3 years with no misuse alleged
Standing from diminished value of personal data	Personal data has market value; breach deprived plaintiffs of that intrinsic value	Plaintiffs do not allege how value was reduced or any attempted sale; theory speculative	No standing; plaintiffs fail to show concrete loss of value
Standing from mitigation costs (credit monitoring)	Purchasing monitoring is injury and confers standing	Costs were self‑inflicted in response to speculative future harm; Clapper rejects such manufactured injury	No standing; mitigation costs insufficient where threatened harm is not imminent
Class‑representative adequacy for victims who suffered actual fraud	Plaintiffs say class may include victims who incurred fraud losses	Zappos argues named plaintiffs must themselves have standing to represent class	Named plaintiffs lack standing; hypothetical injured class members would have standing but cannot be represented by these named plaintiffs

Lujan v. Defenders of Wildlife, 504 U.S. 555 (standing requires concrete, particularized, and imminent injury)
Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138 (future injury must be certainly impending or present a substantial risk; courts should not rely on speculative chains of events)
Monsanto Co. v. Geertson Seed Farms, 561 U.S. 139 (standing requires injury that is concrete, traceable, and redressable)
Krottner v. Starbucks Corp., 628 F.3d 1139 (Ninth Circuit: credible threat of real and immediate harm can confer standing in data‑breach context)
Warth v. Seldin, 422 U.S. 490 (class representatives must personally allege and show injury)
O’Shea v. Littleton, 414 U.S. 488 (abstract or generalized grievances insufficient for Article III standing)
Susan B. Anthony List v. Driehaus, 134 S. Ct. 2334 (an allegation of substantial risk of harm can support standing in some contexts)