[co-author: Lara McMahon] In McMorris v. Carlos Lopez & Associates, LLC, a data breach case, the Second Circuit held that plaintiffs may demonstrate standing based on a theory of “increased risk” of future identity theft or fraud following an unauthorized disclosure of their data. With this holding, the Second Circuit joins the Sixth, Seventh, Ninth, and D.C. Circuits in recognizing that a plaintiff can establish an Article III injury based solely on an increased risk of identity theft or fraud. 1 While the Third, Fourth, Eighth, and Eleventh Circuits 2 have declined to find standing on the facts of a case alleging an increased risk of future injury, they have not altogether foreclosed the viability of the increased-risk theory.