Seventh Circuit Finds P.F. Chang’s Customers Have Standing to Sue for Data Breach
The Seventh Circuit Court of Appeals has revived a data breach lawsuit
against P.F. Chang’s China Bistro, Inc., finding that the two plaintiffs
have standing to sue despite eating at a restaurant apparently not linked
to the breach. Lewert v. P.F. Chang’s China Bistro, Inc., No. 14-3700 (7th
Cir., order entered April 14, 2016). Additional details about the breach
appear in Issue 526 of this Update.
The plaintiffs ate at an Illinois location of P.F. Chang’s two months before
the company announced its payment system had been hacked, revealing
personal information and credit card numbers. One plaintiff noticed
fraudulent charges on his card and purchased credit-monitoring services,
while the other alleged that he spent time and effort monitoring his card
statements and credit report. Each brought separate lawsuits, which
were later consolidated then dismissed for lack of standing. Following its
announcement about the data breach, P.F. Chang’s identified 33 restaurants
affected, excluding the Illinois location at which both plaintiffs had
eaten.
Citing a similar data breach lawsuit against Neiman Marcus, the
appeals court found that the plaintiffs had standing to sue despite the
discrepancy in location. “In its June statement, P.F. Chang’s addressed
customers who had dined at all of its stores in the United States and
admitted that it did not know how many stores were affected,” the
court noted. “It is easy to infer that it considered the risk to all stores
significant enough to implement a universal, though temporary, switch
to manual card-processing.” The later finding that only 33 stores had
been affected creates a factual dispute but does not destroy standing, the
court said. “P.F. Chang’s will have the opportunity to present evidence to
explain how the breach occurred and which stores it affected. Perhaps it
can trace which specific data files were stolen. Perhaps each individual
location’s data is behind a separate firewall. Or perhaps it is being too
optimistic and the breach was greater than it suggests. At this stage, no
one knows.” Accordingly, the court reversed the lower court’s dismissal
and remanded the case for further proceedings.
Issue 601
