Can You Sue After a Data Breach? What Courts Require

Sometimes, but not always. In October 2026 the Illinois Appellate Court, First District, ruled in Kimber v. Cook County Health and Hospitals System that patients whose records were exposed in a breach, but who alleged no fraud tied to it, lacked standing on what they alleged, meaning the legal right to bring the suit. The court said a higher risk of identity theft is not enough by itself. Federal courts use a related idea, and the rules differ from state to state.

What happened in the Kimber case?

Perry Johnson & Associates, a company that did medical transcription for the Cook County Health and Hospitals System, held patient files. Between about March 27 and May 2, 2023, an unauthorized third party got into those files. The files covered 1.2 million patients and, according to the breach notice, may have included names and some combination of dates of birth, addresses, medical record numbers and medical information. About 2,600 people also had Social Security numbers in the files. The health system sent letters on November 2, 2023, saying patients' information "may have been affected."

Two patients, Terry Kimber and Veronica Martin, sued on behalf of a larger group (a class action). They claimed negligence, breach of an implied contract, and violations of the Illinois Consumer Fraud and Deceptive Business Practices Act, among other things. Neither one claimed that anyone had used their data to commit fraud. Martin said she had gotten more spam calls and texts. The trial court dismissed the case with prejudice, calling the harms "speculative and conclusory, not imminent and substantial." All three appellate justices agreed (opinion by Justice Pucinski), and the dismissal was affirmed on October 23, 2026.

What does "standing" mean, and why does it decide these cases?

Standing is a threshold question. Before a court looks at whether a company was careless, it asks whether the person suing was harmed or faces a real threat of harm. In Illinois, the court explained, the claimed injury, whether "actual or threatened," must be "distinct and palpable" and "fairly traceable" to what the defendant did. It also must be substantially likely to be prevented or redressed by the relief requested. In Illinois courts, lack of standing is a defense that the defendant must raise and prove. If the court finds no such injury, the case ends there, whatever the company did or failed to do.

That is why a breach case can be thrown out without any ruling on whether the company's security was poor. The Kimber court said so directly: it limited its discussion to standing because that issue decided the appeal.

What did the Illinois court say would be enough?

The court did not require that a plaintiff already lost money. Quoting Olson v. Ferrara Candy Co., it said a plaintiff may allege a concrete injury based on "an imminent, a certainly impending, or a substantial risk" of harm. But it found that an "increased risk" of identity theft, by itself, is not enough. It agreed that the Kimber plaintiffs faced a higher risk than before the breach and still held that an increase in risk does not confer standing.

The deciding factor, in the court's words, was "the presence of a traceable misuse of the compromised data." It looked at three considerations drawn from Olson, a 2025 First District case: whether the data was taken in a targeted attempt, whether any of it has already been misused, and whether it is sensitive enough to create a high risk of fraud. The court found the first and third leaned toward the plaintiffs. It still treated the second as controlling, because, as it read them, each Illinois court that had addressed future-injury standing in a data breach case found standing only where there was actual or attempted misuse fairly traceable to the breach.

Here is how it sorted the earlier cases:

• Petta v. Christie Business Holdings Co. (Illinois Supreme Court, 2025) and Maglio v. Advocate Health & Hospitals Corp. (Appellate Court, Second District, 2015): no standing. In Maglio, no identity theft had occurred to any of the plaintiffs. In Petta, someone did file a fraudulent loan application, but the supreme court found it was not traceable to the breach.
• Flores v. Aon Corp. (First District, 2023) and Olson: standing, because some plaintiffs had suffered fraudulent charges or charge attempts that the courts found traceable to the breach.

In Flores and Olson, the fraud against some plaintiffs was enough to show an imminent risk for other plaintiffs in the same case who had not yet been targeted. That does not happen automatically. In Maglio, the fact that two plaintiffs in a class of four million had received notice of fraudulent activity did not help the plaintiffs whose own data showed no such activity. In Kimber, neither plaintiff alleged any attempted fraud tied to the breach.

How did the court treat spam, time spent and lost value?

Claimed harm	What the court said
Higher risk of identity theft	Not enough without traceable misuse. The allegations were "circumstantial speculation" about what the thieves intended.
More spam	The court found it "conceivable" that spam could be a concrete injury, but Martin's claim was conclusory. She did not say her phone number or email was in the breached files, or that the spam referred to the breach, and the court held the spam was not fairly traceable to it.
Time and money spent protecting yourself	May not confer standing unless the feared injury is itself substantial and imminent. Here the court found it was not.
Lost market value of your personal data	Rejected. The court said personal information has not been recognized as a property right in Illinois courts.
Overpaying for care that lacked data security	Not decided. The plaintiffs did not argue it on appeal, so the court treated it as forfeited.

The spam ruling is the most useful for ordinary readers. The court relied on Petta, where a fraudulent loan application used details that "could be found in a publicly available phone directory." Spam that uses only a phone number or email address available elsewhere is hard to tie to one breach. The court also said the timing of the spam, without other facts, was not enough.

How is Illinois standing different from federal standing?

The Kimber court said standing is not a jurisdictional issue in Illinois the way it is in federal courts, and that "we do not follow federal standing law." It added that Illinois courts may treat federal cases as instructive, and it noted that the Illinois Supreme Court in Petta looked to TransUnion LLC v. Ramirez (U.S. Supreme Court, 2021).

In TransUnion, a credit reporting case and not a breach case, the justices said that to sue in federal court a plaintiff must show a concrete harm: "No concrete harm, no standing." On future harm, the Court said a person exposed to a risk of future harm may seek an injunction (a court order to prevent the harm) "at least so long as the risk of harm is sufficiently imminent and substantial." But a plaintiff must show standing separately for each kind of relief sought. For damages, the Court called persuasive the argument that "the mere risk of future harm, standing alone, cannot qualify as a concrete harm," at least unless exposure to the risk itself causes a separate concrete harm. The plaintiffs there had offered no evidence of a separate injury, such as an emotional one. In a footnote, the Court said it took no position on whether or how emotional or psychological harm from knowing about a risk could be enough.

That opinion did not involve a data breach, and this article does not cover how lower federal courts have applied it to breach cases.

Does Kimber mean you can never sue over a breach?

No. The ruling is narrower than that. It rests on what these two plaintiffs alleged, on the pleadings, with no fraud tied to the breach. The court itself pointed to cases where fraud tied to a breach supported standing.

It is also a published opinion of the Illinois Appellate Court, an intermediate court, so Illinois courts handling similar cases will look to it. It does not bind courts in other states. As of October 2026, a party may still ask the Illinois Supreme Court to review it. That court does not take every such appeal; it denied one in Olson in November 2025. The opinion does not say whether review will be sought. Other states set their own standing rules, so a breach case that fails in Illinois could be treated differently elsewhere. Check your own state.

What does a breach notice mean, and what do state laws require?

This section covers Illinois. Other states have their own notice rules. In Illinois, the Personal Information Protection Act (815 ILCS 530) requires a "data collector" (a term that includes corporations and government agencies) that owns or licenses certain personal information about an Illinois resident to notify the resident, at no charge, "in the most expedient time possible and without unreasonable delay." The same sentence allows for steps needed to determine the scope of the breach and secure the system, and a law enforcement agency can ask in writing for a delay. Covered information includes your name together with a Social Security number, a driver's license number or medical information, and also a username or email address together with a password. For the name-based kind, the notice must include the toll-free numbers and addresses of the credit bureaus and the FTC, and a statement that you can get information from them about fraud alerts and security freezes.

A health care provider or business associate that is subject to and complies with the federal HIPAA privacy and security standards is treated as complying with the Act, as long as it also notifies the Illinois Attorney General within five business days whenever it must report a breach to the U.S. Secretary of Health and Human Services.

The Kimber court noted that the Act "does not specifically provide for an independent cause of action." Instead, Section 20 says a violation "constitutes an unlawful practice" under the Consumer Fraud and Deceptive Business Practices Act, and the Kimber plaintiffs raised the Act through their consumer fraud and negligence per se claims. The court added that the statutes do not appear to give this kind of data the special standing the legislature created for biometric information, where a person can sue without showing an actual injury. A notice does not tell you your data was misused. It tells you it may have been exposed, as the Cook County letters did.

What should you do after a breach notice?

The FTC's IdentityTheft.gov page for lost or exposed information starts by asking whether anyone has already used your information, and then lays out steps by the type of data involved. These steps follow that guidance and the FTC's credit freeze page.

1. Read the notice closely and note what was exposed. A Social Security number calls for more action than an email address.
2. Freeze your credit. The FTC says a freeze is free, does not affect your credit score, and lasts until you lift it. You contact each of the three bureaus. Federal law backs the price: a bureau must place a freeze "free of charge," within one business day of a phone or secure online request, or three business days of a mailed one (15 U.S.C. 1681c-1(i)). The FTC says you do not have to wait for your information to be exposed or misused. See our guide to freezing your credit with all three bureaus.
3. Consider a fraud alert too. The FTC says an initial alert is for anyone who is or suspects they may be affected by identity theft. It is free and lasts one year, with the option to renew. You place it with one bureau, which must tell the other two. Our comparison of a credit freeze, a credit lock and a fraud alert explains the differences.
4. Change passwords if a login was involved, and watch your bank and card statements for charges you do not recognize.
5. Save the notice and any later fraud records. If something happens, follow our first steps for identity theft and report it at IdentityTheft.gov.

Documenting any misuse matters for more than recovery. As Kimber shows, traceable misuse is the fact that decided whether a case could go forward.

How do class action settlement notices work?

Breach lawsuits can be filed as class actions, as Kimber was, where a few named people sue on behalf of a larger group with similar claims. If you get a notice saying you may be part of a breach settlement, read it closely for any deadlines it lists. Scam mailings imitate these notices, so confirm the case through the court's own records before you give out personal information. Our guide to checking a class-action settlement notice goes through this. The details differ by court and by case.

This is general information, not legal advice. Rules vary by state, so check the official source or a licensed attorney in your state.

Know the law

Federal law limits your liability and gives you tools — fraud alerts, freezes, and an official FTC recovery plan at IdentityTheft.gov.

Key federal laws:

• Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq.

Where to get help or file a complaint:

• IdentityTheft.gov — official FTC recovery plan

Your state matters too. Federal law is the floor — your state sets the statute of limitations on debt, garnishment and exemption limits, payday and repossession rules, and has its own Attorney General and consumer-protection laws. Always check your state’s rules. This is general legal information, not legal advice.