A federal appeals court on Friday reinstated a putative class-action lawsuit filed in connection with a pharmacy data breach, stating that the plaintiffs had adequately alleged actual or potential harm.
Andover, Mass.-based Injured Workers Pharmacy LLC, a home delivery pharmacy, experienced a data breach in January 2012, in which hackers gained access to personally identifiable information, including social security numbers and personal financial information for more than 75,000 of its patients, according to the ruling by the 1st US Circuit Court of Appeals in Boston i Alexis Webb; Marsclette Charley v. Injured Workers Pharmacy LLC.
IWP didn’t discover the breach until nearly four months later, in May 2021
, and didn’t begin notifying its patients until February 2022. Even then, it “did not fully convey its size or scope,” the ruling said.Ms. Webb, whose PII was used to file a fraudulent 2021 tax return, and Ms. Charley, who said she feared for her personal financial security as a result of the breach, filed a putative class action in US District Court in Boston, alleging negligence, breach of implied contract, unjust enrichment, invasion of privacy and breach of fiduciary duty.
The district court dismissed the case, concluding that the plaintiffs’ complaint did not reasonably allege an injury in fact.
A three-judge panel overturned the verdict. “We believe that the complaint’s plausible allegation of actual misuse of Webb’s stolen PII to file a fraudulent tax return is sufficient to state an Article III concrete injury,” it said. “There is a clear temporal connection between the filing of the false tax return and the time of the data breach.”
As for Ms. Charley’s complaint, it alleges “is likely that an actual injury is based on the material risk of future misuse of Charley’s PII and an actual injury caused by exposure to its risk,” it said.
The appeals court affirmed the denial of the plaintiffs’ motion for injunctive relief, stating that it was “not likely to remedy their alleged injuries.”
Attorneys in the case did not respond to requests for comment.
Source link
