Second Circuit Allows Data Breach Claims for Increased Risk of Identity Theft The U.S. Court of Appeals for the Second Circuit has ruled that plaintiffs can establish standing to pursue claims arising out data breaches based solely on an increased risk of identity theft, provided that the plaintiffs can demonstrate that the risk is sufficiently concrete. On April 26, 2021, in McMorris v. Carlos Lopez and Associates, 1 the Second Circuit ruled that affected data subjects who have alleged only an increased risk of identity theft following a data breach can have standing to bring a claim. The ruling is somewhat of a departure from other circuits’ decisions on similar issues, in which data subjects without a concrete injury had been denied standing to sue. However, although the court ruled that it was possible to have standing based solely on increased risk, it denied standing in the specific case before it based on its determination that the plaintiffs had not shown sufficient increased risk of harm.