What Consumers Can Sue For in a Data Breach Class Action

by Faaria Zubair and Stephen T. Rutkowski

Have you ever received a data breach notice in the mail, via email by the organization that has been compromised, or even learned through watching the news? You are not alone. If you have questions about whether you may qualify to participate in a lawsuit, or if you would simply like to learn more about the process, then you are in the right place.

Data breaches have become increasingly common. According to the Identify Theft Resource Center’s 2025 Annual Data Breach Report, there was a total of 3,322 data compromises, five percent higher than the previous year. The financial services industry was mainly targeted in data breaches with 739 compromises, followed by healthcare (534), professional services (478), manufacturing (299), and education (188). This report surveyed consumers on whether they received a data breach notice in the past 12 months, and 80% reported that they had. However, not all data breaches are treated the same, nor do they automatically guarantee a lawsuit.

When does a Data Breach give Consumers the Right to Sue?

In 2026, 20 states have adopted comprehensive privacy laws, which govern how personal information is collected, stored, and used by government agencies, companies, and other organizations. However, not all privacy laws allow individual consumers to file lawsuits, also known as a Private Right of Action. Instead, some privacy laws rely on state and federal officials to enforce the law, such as a state attorney general. Virginia is one such state. This goes for the majority of U.S. States such as Oregon, New Hampshire, Arizona, Rhode Island, Texas, Florida, Colorado, Connecticut, and Utah. On the other hand, there are exceptions, such as the California Consumer Privacy Act of 2018, which grants a private right of action to “any consumer whose nonencrypted and nonredacted personal information… is subject to an unauthorized access and exfiltration, theft, or disclosure.”
What Can a Consumer Do if No Privacy Statue Applies?
Let’s say a state may have a comprehensive privacy law, but it does not allow an individual consumer to bring a private action, or a consumer’s claim falls outside the scope of a privacy law, she might be able to pursue another form of legal relief. Prior to the adoption of many of these privacy laws, consumers have brought lawsuits under centuries-old common law theories of recovery. These include: negligence, breach of contract, unjust enrichment, and invasion of privacy torts.

1. Negligence: A typical negligence claim: a consumer alleges that the company had a duty to protect his or her personal information and that the company failed to use reasonable security measures. The plaintiff can potentially establish this through evidence that the company was being careless and that the failure to protect the data caused the consumer actual harm.
2. Breach of Implied Contract: The consumer alleges that the company failed to meet the obligations of an implied agreement with the company, whereby the consumer agrees to hand over her data in exchange for the company’s implicit promise to keep it secure. To establish this, a plaintiff can potentially show that there was a mutual understanding, e.g., in the terms of service, that the company would protect the information and that it failed to do so.
3. Unjust Enrichment: The consumer alleges that the company unlawfully benefited from the other party, such that it would be unfair to allow the company to keep its gains. This theory is often used as an alternative theory to a breach of contract claim, because it can be asserted even in the absence of a contract. A plaintiff may be able to establish unjust enrichment by showing that the company retained a benefit that caused a detriment to the consumer.
4. Invasion of Privacy: The consumer claims that private personal information was unlawfully exposed, accessed, or disclosed to a third party. The plaintiff generally can establish this by showing that private information was improperly published to unauthorized third parties, causing injury.

Establishing Concrete Harm

It is important to note that a violation of a law or statue may not necessarily create a lawsuit. According to TransUnion  v. Ramirez, 594 U.S. 413, the U.S. Supreme Court held that “only plaintiffs concretely harmed by a defendant’s statutory violation have Article III standing to seek damages against that private defendant in federal court.”

In TransUnion, the Supreme Court found that only those whose consumer data was disseminated to a third party had standing to bring a lawsuit for damages under the Fair Credit Reporting Act on their reasonable-procedure claims. Although TransUnion was not a data breach case, it is often used by courts to see if plaintiffs have an injury significant enough to warrant a lawsuit. The most repeated line from the decision is: “No concrete harm, no standing.” Through this inquiry, courts distinguish between the risk of dissemination of information, and actual harm resulting from the disclosure of information to third parties. In the opinion, Justice Kavanaugh explained that there are obvious “tangible harms, such as physical harms and monetary harms.” However, there are also intangible harms that have long been recognized as sufficiently concrete to grant standing, such as “reputational harms, disclosure of private information, and intrusion upon seclusion.” The Court found that those plaintiffs whose data was actually obtained by third parties suffered injuries that were concrete.

What types of losses have consumers historically been able to recover?

Potentially Recoverable Losses 

• Fraudulent Charges
• Identity Theft
• Financial Losses
• Credit Monitoring Expenses
• Out-of-Pocket Mitigation Costs
• Time Lost Responding to a Breach
• Other Potential Damages
• Statutory Damages
• Punitive Damages
• Which Categories have been Scrutinized by Courts?
• Future Risks
• Speculative Injuries
• Diminished Value of Personal Information
• Losses Not Tied to Actual Harm

Protecting Consumers After a Data Breach

As data breaches become more prevalent across industries and there is an increasing reliance on digital platforms, it is important that consumers know their rights. Data breaches typically affect thousands or millions of people; therefore, many cases are brought as data breach class actions. At Miller Shah, our attorneys have successfully represented certified classes of consumers and other plaintiff groups of all sizes across a wide spectrum of industries and situations.