Jason Hensley v. Lewis Brothers Bakeries, Inc.
24A-PL-02246
| Ind. Ct. App. | Jun 30, 2025Background
- Lewis Brothers Bakeries, Inc. (LBB) suffered a targeted cyberattack in March 2024, resulting in unencrypted personal information (PII) of past and current employees being stolen.
- Jason Hensley, a former LBB employee, was among those whose PII (including Social Security number and full name) was compromised; he filed a putative class action seeking damages and injunctive relief.
- LBB notified affected individuals in May 2024, offering twelve months of credit monitoring and advising vigilance against identity theft.
- Hensley alleges harms including lost time, anxiety, invasion of privacy, increased phishing attempts, and continued risk of misuse, even without evidence of actual identity theft.
- The trial court dismissed Hensley's suit for lack of standing, reasoning that no concrete injury was alleged because no actual misuse of his PII had occurred.
- Hensley appealed, arguing that the risk and mitigation expenses he faced constitute sufficient harm for standing at the pleading stage.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Sufficiency of Injury Allegations for Standing | Risk of misuse and mitigation efforts create actual harm; shouldn't need to wait for actual misuse | No standing without alleged actual misuse of PII | Plaintiff alleged sufficient harm for standing; actual misuse not required |
| Requirement of Concrete Harm | Loss of time, anxiety, risk mitigation, invasion of privacy are actual injuries | Intangible and future risks insufficient; must show current misuse | Intangible harms and mitigation costs are sufficient at pleadings |
| Applicability of Federal Standing Precedent | Indiana courts not bound by restrictive federal standing doctrine in data breach context | Federal courts require actual misuse post-TransUnion | State law allows broader standing; does not follow restrictive federal approach |
| Adequacy of Pleadings at Motion to Dismiss | Allegations of present and ongoing harm satisfy threshold at motion-to-dismiss stage | No present injury, so complaint should be dismissed | Accepts plaintiff's allegations as true for sufficiency at this stage |
Key Cases Cited
- Hoosier Contractors, LLC v. Gardner, 212 N.E.3d 1234 (Ind. 2023) (Indiana standing requires injury or immediate danger of direct harm)
- Solarize Ind., Inc. v. S. Ind. Gas & Elec. Co., 182 N.E.3d 212 (Ind. 2022) (standing ensures courts only decide real, not abstract, disputes)
- Alexander v. PSB Lending Corp., 800 N.E.2d 984 (Ind. Ct. App. 2003) (plaintiffs must show personal stake and direct injury for standing)
- Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688 (7th Cir. 2015) (purpose of data theft is likely misuse; risk supports standing)
- In re Equifax Inc. Customer Data Sec. Breach Litig., 999 F.3d 1247 (11th Cir. 2021) (recognizes damage from sensitive data theft, even without misuse)