On April 26, the Second Circuit Court of Appeals stated that the risk of identity theft after a data breach may be grounds to sue.^[1] The three-judge panel held that plaintiffs can establish Article III constitutional standing on the theory that a data breach put them at an increased risk of identity theft or fraud if the data are sensitive and have been misused, or if there is reason to believe the data will be misused.