To embed, copy and paste the code into your website or blog: In April 2021, the Second Circuit issued a decision recognizing an increased risk of future, unrealized identity theft or fraud as a basis for establishing Article III standing. Background The case, McMorris v. Carlos Lopez & Assocs., LLC, No. 19-4310, 2021 WL 1603808 (2d Cir. Apr. 26, 2021), involved the inadvertent disclosure of personal data by an employee of Defendant, Carlos Lopez & Associates LLP. The employee accidentally emailed all 65 of Defendant’s employees a spreadsheet containing the personal data of approximately 130 current and former employees of Defendant, including Social Security numbers, dates of birth, home addresses, telephone numbers, educational degrees, and dates of hire. This action constituted a data breach under New York, California, Florida, New Jersey, Texas, and Maine laws which generally define a data breach to include the disclosure of personally identifiable information, such as an individual’s Social Security number.