Opinion · Court of Appeals for the Fourth Circuit
Christopher Holmes v. Elephant Insurance Company
Christopher Holmes v. Elephant Ins. Co., No. 23-1782, UP11171192 (4th Cir. Oct. 14, 2025)
- Type
- Opinion
- Court
- Court of Appeals for the Fourth Circuit
- Jurisdiction
- Federal
- Date
- 2025-10-14
- Topic
- general
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 1 of 34 PUBLISHED UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT No. 23-1782 CHRISTOPHER HOLMES; TRINITY BIAS; JAIME CARDENAS; ROBERT SHAW, individually and on behalf of those similarly situated, Plaintiffs – Appellants, v. ELEPHANT INSURANCE COMPANY; ELEPHANT INSURANCE SERVICES, LLC; PLATINUM GENERAL AGENCY INC., d/b/a APPARENT INSURANCE, Defendants – Appellees. Appeal from the United States District Court for the Eastern District of Virginia, at Richmond. John A. Gibney, Jr., Senior District Judge.
Citator
UpLaw has not yet analyzed Christopher Holmes v. Elephant Insurance Company. The absence of a flag is not a finding that it is good law.
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 1 of 34
PUBLISHED
UNITED STATES COURT OF APPEALS
FOR THE FOURTH CIRCUIT
No. 23-1782
CHRISTOPHER HOLMES; TRINITY BIAS; JAIME CARDENAS; ROBERT SHAW,
individually and on behalf of those similarly situated,
Plaintiffs – Appellants,
v.
ELEPHANT INSURANCE COMPANY; ELEPHANT INSURANCE SERVICES, LLC;
PLATINUM GENERAL AGENCY INC., d/b/a APPARENT INSURANCE,
Defendants – Appellees.
Appeal from the United States District Court for the Eastern District of Virginia, at
Richmond. John A. Gibney, Jr., Senior District Judge. (3:22-cv-00487-JAG)
Argued: October 29, 2024 Decided: October 14, 2025
Before AGEE, RICHARDSON, and BERNER, Circuit Judges
Affirmed in part, reversed in part, and remanded by published opinion. Judge Richardson
wrote the opinion, in which Judge Agee and Judge Berner joined.
ARGUED: Kate M. Baxter-Kauf, LOCKRIDGE, GRINDAL & NAUEN, P.L.L.P.,
Minneapolis, Minnesota, for Appellants. James Francis Monagle, MULLEN COUGHLIN
LLC, Sacramento, California, for Appellees. ON BRIEF: Lee Floyd, BREIT
BINIAZAN, PC, Richmond, Virginia; M. Anderson Berry, CLAYEO C. ARNOLD, A
PROFESSIONAL LAW CORP., Sacramento, California; Gayle M. Blatt, CASEY
GERRY SCHENK FRANCAVILLA BLATT & PENFIELD, LLP, San Diego, California;
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 2 of 34
David K. Lietz, MILBERG COLEMAN BRYSON PHILLIPS GROSSMAN, PLLC,
Washington, D.C., for Appellants. Claudia D. McCarron, MULLEN COUGHLIN LLC,
Devon, Pennsylvania, for Appellees.
2
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 3 of 34
RICHARDSON, Circuit Judge:
Privacy is an endangered species in the digital age. In the day-to-day, we give our
personal data to banks and schools, airlines and telecom providers, search engines and e-
commerce platforms—and, relevantly, insurance companies. But these third parties are
imperfect stewards of our personal information. Some are leaky of their own accord.
Others are plundered despite their best efforts. And when they fall short in guarding our
information, there are inevitably lawsuits. This is one of those lawsuits.
On appeal before us, however, is solely the limited question of whether the plaintiffs
here even can bring suit, or whether they lack standing to do so. We hold that a subset of
the plaintiffs has standing to continue their suit on one of their alleged injuries-in-fact. We
affirm the district court’s dismissal of the remainder.
I. BACKGROUND
Elephant Insurance Company, Elephant Insurance Services LLC, and Apparent
Insurance (collectively, “Elephant”) sell various forms of insurance, including home and
car insurance. To make purchasing insurance more convenient, Elephant—like many other
insurance providers—designed its online quoting platform to auto-populate certain
information like driver’s license numbers whenever a potential customer provided other
information such as their name, address, and date of birth. The quoting platform’s auto-
populate feature was made possible by Elephant’s database of personal information, which
includes information not just from its own customers but also from third-party sources like
DMV records.
3
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 4 of 34
Unnamed hackers breached Elephant’s network between March 26 and April 1,
2022, compromising the driver’s license numbers of nearly 3 million people. Although
Elephant has not confirmed how the information was compromised, the plaintiffs allege
that the hackers took advantage of Elephant’s quoting platform by entering a person’s
publicly available information and acquiring their driver’s license number via the auto-
populate feature. Elephant announced the breach in a public statement a month later,
sending individualized notices of the breach, along with an offer of a year of free credit
monitoring, to all those affected.
Among those affected were Trinity Bias, Jaime Cardenas, Christopher Holmes, and
Robert Shaw. In July, a few months after they were notified that their personal information
was compromised in the breach, Bias and Cardenas sued Elephant on behalf of a putative
class. A few days later, Holmes brought a substantially similar class action. The district
court consolidated the two cases, and the parties—now with Shaw—filed a consolidated
class action complaint putatively representing all people affected by the breach of
Elephant’s network. 1
In the consolidated complaint, the four plaintiffs asserted that the breach injured
them in various ways. All four alleged that they spent time reviewing their credit and
1
The consolidated complaint contains five class-wide claims: (1) a violation of the
Driver’s Privacy Protection Act, 18 U.S.C. § 2721
et seq.; (2) negligence; (3) negligence
per se; (4) unjust enrichment; and (5) declaratory relief under the Declaratory Judgment
Act. It also includes three additional claims for two subclasses: (6) a violation of the Texas
Consumer Protection Act for the Texas Subclass, Texas Bus. & Com. Code §§17.41 et
seq.; and (7) a violation of the Illinois Consumer Fraud Act, 815 ILCS §§ 505 et seq.; and
(8) a violation of the Illinois Uniform Deceptive Trade Practices Act, 815 ILCS §§ 510/2
et seq., both for the Illinois Subclass.
4
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 5 of 34
financial documents—time they would otherwise have spent on other productive activities.
All four also alleged that the breach increased their risk of identity theft, with Cardenas
and Holmes claiming that they had found their driver’s license numbers on the dark web.
Holmes and Shaw added that this risk caused them significant fear, anxiety, and stress.
And Holmes alone asserted that he experienced an uptick in texts and calls from spammers
requesting his insurance policy information or posing as debt collectors. As relief, the
plaintiffs requested monetary damages, a declaration that Elephant’s existing security
measures are unlawfully inadequate, and an injunction against Elephant ordering it to
improve its data security.
The plaintiffs’ class action suit never made it past the threshold. Instead, the district
court concluded that the plaintiffs lacked standing to pursue any of their claims. See
Holmes v. Elephant Ins., 2023 WL 4183380
, at *1 (E.D. Va. June 26, 2023). The district
court identified and rejected several possible injuries in the plaintiffs’ complaint. The
district court thus granted Elephant’s Rule 12(b)(1) motion as to all plaintiffs and dismissed
the entire case. Id. at *6
.
The plaintiffs then timely appealed the district court’s dismissal.
II. DISCUSSION
The federal courts can only resolve “Cases” and “Controversies.” U.S. Const. art.
III, § 2, cl. 1. This requires a plaintiff to have a “personal stake”—known as “standing”—
in the suit he brings. TransUnion LLC v. Ramirez, 594 U.S. 413, 423
(2021). He “must
be able to sufficiently answer the question: ‘What’s it to you?’” Id.
(quotation omitted).
To do so, a plaintiff must show three things: “(i) that he suffered an injury in fact that is
5
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 6 of 34
concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by
the defendant; and (iii) that the injury would likely be redressed by judicial relief.” Id.
(citing Lujan v. Defs. of Wildlife, 504 U.S. 555
, 560–61 (1992)).
Some plaintiffs may need to answer the standing question more than once.
“[S]tanding is not dispensed in gross.” Town of Chester, N.Y. v. Laroe Estates, Inc., 581 U.S. 433, 439
(2017) (quotation omitted). Rather, “a plaintiff must demonstrate standing
separately for each form of relief sought.” Friends of the Earth, Inc. v. Laidlaw Env. Servs.
(TOC), Inc., 528 U.S. 167, 185
(2000). So a plaintiff could, for example, have standing to
seek damages from the defendant but lack standing to seek an injunction. See City of Los
Angeles v. Lyons, 461 U.S. 95, 105
(1983).
These standing requirements apply equally to class actions. The individual named
plaintiffs must therefore satisfy those requirements. 2 See Warth v. Seldin, 422 U.S. 490, 502
(1975). So, like any other plaintiffs, Bias, Cardenas, Holmes, and Shaw can each only
proceed if they show an injury-in-fact caused by Elephant and redressable by the court for
each form of relief sought. Id.
This case turns primarily on whether their allegations
establish the first requirement: injury-in-fact. 3
2
In this appeal, we evaluate only the district court’s finding that the named plaintiffs
lacked Article III standing. As to the surviving damages claims, we note that “[e]very
class member must have Article III standing in order to recover individual damages.”
TransUnion, 594 U.S. at 431
.
3
Holmes alone pleaded an injury that the district court found was an injury-in-fact—
an uptick in spam texts and calls to his phone after the data breach at Elephant. But as the
district court accurately noted, “[t]he plaintiffs do not allege that the [compromised
information] in this Data Breach included cell phone numbers.” Elephant Ins., 2023 WL
(Continued)
6
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 7 of 34
All named plaintiffs—Bias, Cardenas, Holmes, and Shaw—assert that the breach of
Elephant’s network inflicted four injuries-in-fact: (1) the actual compromise of their
personal information in the breach; (2) the risk of future misuse of their personal
information by other malicious actors; (3) the risk of having their personal information
taken again in the future in another hack of Elephant; and (4) the emotional distress and
time spent monitoring their financial records to mitigate the likelihood of future harm. We
address each alleged injury for each of the four plaintiffs to see if they are “concrete,
particularized, and actual or imminent.” TransUnion, 594 U.S. at 423
.
A. Two Plaintiffs Suffered A Concrete Injury
Having one’s information compromised by a data breach is a harm that is both
particularized, by affecting each individual personally, and actual, by occurring in reality.
See Spokeo, Inc. v. Robins, 578 U.S. 330, 339
(2016). The difficulty is determining
whether it is “concrete”—whether it is “real, and not abstract.” TransUnion, 594 U.S. at 424
(quoting Spokeo,578 U.S. at 340
). Some harms are unquestionably concrete. “The
most obvious are traditional tangible harms, such as physical harms and monetary harms.”
Id. at 425
(emphasis added). When a plaintiff alleges that he has been punched or had his
wallet stolen, little more needs to be said.
Intangible harms are not so straightforward. To be sufficiently concrete, an
intangible harm must bear “a close relationship to harms traditionally recognized as
4183380, at *6. This straightforwardly defeats Holmes’s attempt to attribute his uptick in
spam texts and calls to the data breach. Without much consternation, we affirm the district
court’s determination that “Holmes has failed to adequately allege traceability” for this
injury. Id.
7
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 8 of 34
providing a basis for lawsuits in American courts.” Id.
To determine whether an injury
satisfies this standard, we must assess whether there is “a close historical or common-law
analogue” to it, though the analogue need not be “an exact duplicate.” Id. at 424
. 4
Notice what the Supreme Court tells us the relationship must be between: “harms.”
Id. at 425
. Not elements. This concern with harm is apparent from the very first paragraph
of TransUnion, which lists “physical,” “monetary,” and “reputational” harms without
discussing the many distinct elements of the many distinct causes of action that protect
against these types of harm. 594 U.S. at 417
. For this reason, we have explained that under
TransUnion, “our inquiry focuses on types of harms protected at common law, not the
precise point at which those harms become actionable.” Garey v. James S. Farrin, P.C.,
35 F.4th 917, 922
(4th Cir. 2022) (cleaned up) (quoting Krakauer v. Dish Network, LLC,
925 F.3d 643, 654
(4th Cir. 2019)).
This is not to say that the elements of a common-law cause of action are irrelevant.
Defining the harm addressed by a cause of action can be difficult, especially when the harm
is intangible. And when the harm addressed is not immediately obvious, the elements of
the cause of action can shed light on the matter. Consider TransUnion itself. There, the
Court assessed whether someone whose credit file contained a misleading “OFAC alert”—
a warning stating that they had a name identical to one on a list of potential terrorists and
criminals—had suffered a harm sufficiently close to that inflicted by defamation. 594 U.S. 4
TransUnion adds that “harms specified by the Constitution itself” can also be
concrete without the need for a common-law analogue. 594 U.S. at 425
. This case does
not concern such harms.
8
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 9 of 34
at 432. The Court determined that the 1,853 plaintiffs whose misleading OFAC alerts were
disseminated to a third party suffered a harm analogous to defamation and thus sufficient
for concrete injury. Id.
But for the 6,332 whose misleading OFAC alerts were not
disseminated, the Court concluded otherwise. Id.
at 434–35.
In explaining why the latter group lacked a concrete injury, the Court pointed to the
elements of defamation, remarking that the element of “[p]ublication is ‘essential to
liability’ in a suit for defamation.” Id.
at 434 (quoting Restatement of Torts § 577 cmt. a
(Am. L. Inst. 1938)). Without publication of the OFAC alert in their credit files, the group
of 6,332 plaintiffs could not analogize to defamation. 5 Critically, however, this was not
because the Court required an element-to-element comparison with defamation. Instead,
the Court found the lack of publication fatal to concrete injury because defamation’s harm
“was the loss of credit or fame, and not the insult” itself, and that harm could only occur
when the defamatory information was known by others. TransUnion, 594 U.S. at 434
(quotation omitted). Publication did not matter because it was an element of defamation;
it mattered because it helped define the harm of defamation.
5
In a footnote, the Court also considered the argument that the 6,332 plaintiffs
whose OFAC alerts were not disseminated still suffered a concrete injury because the alert
was seen “internally” by “employees within TransUnion.” TransUnion, 594 U.S. at 434
n.6. The Court rejected this argument, explaining that “[m]any American courts did not
traditionally recognize intra-company disclosures as actionable publications.” Id.
The
Court added that “evidence that the document was actually read and not merely processed”
was “lacking” from the plaintiffs. Id.
It thus concluded that because “the plaintiffs’
internal publication theory circumvent[ed] a fundamental requirement of an ordinary
defamation claim,” it could not support a finding of concrete injury. Id.
9
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 10 of 34
But not all elements of a cause of action go to the harm addressed. Many common-
law torts, for example, reserve liability for defendants who have acted with a certain
culpable mental state. Take the tort of false imprisonment. To be liable for false
imprisonment, a defendant must act “intending to confine” the plaintiff, at least when the
imprisonment does not otherwise threaten bodily harm. Restatement (Second) of Torts
§ 35 & illus. 2 (Am. L. Inst. 1965). Yet a day trapped in a storage closet is a day trapped
in a storage closet whether it is brought about intentionally or not; the tangible harm of the
confinement is independent of the defendant’s intentions. So a person imprisoned by
accident will have standing to sue. The victim has suffered regardless of the defendant’s
liability. More generally, elements that pertain to the details of the defendant’s action will
often—though not always—be unrelated to the kind of harm felt by the victim. 6 At all
times, the concreteness analysis must be focused on the harm addressed by the analogous
cause of action, not on the cause of action’s elements. 7
6
We do not deny the possibility that in some cases, the intentions of the defendant
could help define the harm to the victim. But this will only occur when it is important that
the defendant’s intentions be known or apparent. What matters in those cases is not the
defendant’s mental state itself but the way the plaintiff perceives that mental state. For
instance, knowing that someone has injured you on purpose may cause particular offense
or instill fear of future harm.
7
This focus on harm over elements is shared by our sister circuits. See, e.g., Barclift
v. Keystone Credit Servs., LLC, 93 F.4th 136, 145
(3d Cir. 2024) (“TransUnion speaks only
of harms, not elements.”); Drazen v. Pinto, 74 F.4th 1336, 1343
(11th Cir. 2023) (en banc)
(requiring the presence of “element[s] essential to the harm” in assessing common-law
analogues); Nabozny v. Optio Sols. LLC, 84 F.4th 731, 734
(7th Cir. 2023) (listing several
examples of the types of harm that provide standing); Shields v. Pro. Bureau of Collections
of Md., Inc., 55 F.4th 823, 829
(10th Cir. 2022) (stating that the plaintiff “did not have to
plead and prove the tort’s elements to prevail” but had “to at least allege a similar harm”).
10
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 11 of 34
1. Having one’s driver’s license number listed on the dark web bears
a close relationship to a harm recognized at common law
Now to apply TransUnion’s harm-analogue test to this case. The plaintiffs here
seek to analogize the harm from Elephant’s data breach to the harm addressed by the tort
of public disclosure of private information—a harm mentioned by name as a permissible
common-law analogue. 8 TransUnion, 594 U.S. at 425
. Public disclosure of private
information is one of four “invasion of privacy” torts historically recognized at common
law. 9 See William L. Prosser, Privacy, 48 Calif. L. Rev. 383
, 389 (1960). It requires that
the defendant (1) disclose (2) to the public (3) true but private information that would be
highly offensive to a reasonable person and (4) is otherwise of no legitimate concern to the
public. See Restatement (Second) of Torts § 652D & Special Note & cmt. a; Cape
Publ’ns., Inc. v. Hitchner, 549 So.2d 1374, 1377
(Fla. 1989); Shulman v. Grp W. Prods.,
Inc., 955 P.2d 469, 478
(Cal. 1998).
What harm is the public disclosure of private information tort aimed at? It is chiefly
concerned with the dissemination of information regarding “[s]exual relations,” “family
quarrels,” and “humiliating illnesses” to a large number of individuals. Restatement
8
Elephant argues that public disclosure of private information cannot serve as a
TransUnion analogue because it “is not recognized under Virginia common law.” Resp.
Br. 7, 17. True, at least since 1977. See WJLA-TV v. Levin, 564 S.E.2d 383
, 394 n.5 (Va.
2002). But this matters not. TransUnion does not ask for an analogue recognized in the
specific jurisdiction whose laws are being applied. It only asks for an analogue
“traditionally recognized” in history or at common law in general. TransUnion, 594 U.S. at 425
. Virginia’s relatively recent actions in this area are irrelevant in light of the
widespread recognition of the tort of public disclosure of private information.
9
The other three are intrusion upon seclusion, misappropriation of name or likeness,
and false publicity. See Restatement (Second) of Torts § 652A.
11
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 12 of 34
(Second) of Torts § 652D cmt. b. But the public-disclosure tort shields more information
than just the inherently shameful. It extends to cover situations where publicity has been
given to “income tax returns,” suggesting that the private information need not be so sordid
as to find a home on Page Six. Id. Nor is it limited to information that has been kept
completely confidential. A woman who agrees to film her “caesarian operation . . . for
exhibition to medical students for educational purposes” cedes much of her privacy for a
particular purpose, and yet she can still sue if the film of her operation is then shown “in a
commercial theater.” Id. § 652D illus. 11. So even information that is revealed in some
contexts can remain private as to the public at large.
A closer look at the elements of the public disclosure of private information allows
us to refine our understanding of its harm. While the tort covers a wide range of
information, two of its elements—that the information be highly offensive to a reasonable
person if shared, and that it not be of legitimate public concern—tell us that only sensitive
personal information falls within the scope of the tort. Other pieces of nonsensitive
personal information can be shared without inflicting actionable harm. So while an
idiosyncratic recluse may be distressed by the publicization of his hair color or his favorite
flavor of ice cream, the tort does not protect such anodyne facts. See id. § 652D cmt. c
(“[A]nyone who is not a hermit must expect and endure the ordinary incidents of the
community life of which he is a part.”).
And the publicity element makes clear that even when sensitive personal
information is at issue, actionable harm does not occur any time that information is shared
without permission. The tort is only implicated when the sharing is so broad that it
12
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 13 of 34
“reaches, or is sure to reach, the public.” Id. § 652D cmt. a. Publicity is given to
information “broadcast over the radio,” or given “to a large audience,” or published “in a
newspaper or a magazine, even of small circulation,” but not to statements made “to a small
group of persons.” Id. So while a confidante may breach her friend’s trust by sharing her
friend’s intimate secret with a handful of family members, the tort is unconcerned with
such small-scale disclosures. Overall, the public disclosure of private information is aimed
at the harm that occurs when sensitive personal information is released into the open.
Importantly, however, our question is not whether the harm inflicted by Elephant
would be actionable under the public-disclosure tort. Rather, under TransUnion, the
plaintiffs have standing so long as their harm is similar to the harm protected by a common-
law cause of action. They need not an “exact duplicate” but an “analogue.” TransUnion,
594 U.S. at 424
. While the relationship between harms cannot be so “loose[]” as to serve
as an “open-ended invitation for federal courts” to create new bases for standing divorced
from history and tradition, the set of harms analogous to those actionable at common law
is necessarily broader than the set of harms actually actionable at common law. Id.
at 424–
25.
TransUnion gives a specific clue about how far the analogous harms can extend by
telling us that the harm in Davis v. FEC, 554 U.S. 724
(2008), is sufficiently close.
TransUnion, 594 U.S. at 425
. Davis is a campaign finance First Amendment case that
involved a challenge to a federal law that required political candidates to report the total
amount of expenditures they made in their own campaigns over a certain threshold. Davis,
554 U.S. at 729–32. The harm of disclosing the amount of such campaign expenditures
13
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 14 of 34
thus must bear a close relationship to the harm “traditionally recognized” by the public-
disclosure tort. But the amount a candidate spends on his campaign—a bare dollar figure
without detail—is not information that would be considered personally sensitive in a way
that is actionable under the public-disclosure tort. It is merely information that, though dry
and numerical, a candidate may justifiably wish to tightly control (because he wishes to
avoid being seen as wealthy and out-of-touch by voters, for example). So though the
public-disclosure tort may be limited to sensitive personal information, TransUnion’s
invocation of Davis tells us that it furnishes standing by analogy for more.
Because the campaign expenditure amount in Davis was certain to be made publicly
available by law, see 52 U.S.C. § 30104
(a)(11)(B), Davis does not help us determine
whether the public-disclosure tort’s requirement of publicity is similarly broadened. We
conclude the answer is no—publicity cannot be broadened under TransUnion to include
disclosures that would be considered private at common law. Sensitive personal
information and justifiably withheld information, like false statements and misleading
statements, differ in degree. See TransUnion, 594 U.S. at 433
. But public disclosure and
private disclosure strike us as differing in kind. “Private disclosure is not just a less extreme
form of public disclosure. Publicity causes a qualitatively different harm.” Hunstein v.
Preferred Collection and Mgmt. Servs., Inc., 48 F.4th 1236, 1249
(11th Cir. 2022) (en
banc); see also Restatement (Second) of Torts § 652D cmt. a (drawing a sharp “distinction
. . . between private and public communication”). An announcement to a crowd is not
simply a more efficient way of conducting a series of one-on-one conversations; it is a
14
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 15 of 34
different way of communicating altogether. So harms that analogize to the harm of the
public disclosure of private information must still involve publicity.
Viewing this all together through the lens of TransUnion, we hold that the public
disclosure of private information tort makes concrete the intangible harm suffered when
information that the plaintiff would justifiably prefer to tightly control is released into the
open. Though the information need not be embarrassing or salacious, the plaintiff must
have good reason to keep it close to the vest. And though the information need not be
broadcast to the whole world, it must be accessible to many.
With this understanding in mind, we can determine whether the plaintiffs have
alleged facts that show they have suffered a concrete injury from the Elephant data breach.
Our answer is that they have—but only for two of the named plaintiffs.
The complaint contains sufficient allegations to show why all four plaintiffs
justifiably desire to keep their driver’s license numbers confidential. The plaintiffs tell us
that driver’s license numbers are “critical to easily forging an identity” using a full profile
of information that includes other “[u]nique and persistent identifiers.” J.A. 53. The
numbers can be used “alone or in combination with other information” to “[o]pen bank
accounts” and “[a]pply for financial loans.” J.A. 55. And they are often “the critical
missing link for a fraudulent unemployment benefits application.” J.A. 61. So it is no
surprise that the plaintiffs wish to protect such information from being known by the public
at large, and certainly by the unsavory individuals that often trawl the dark web.
But Bias and Shaw do not provide any reason to think that their driver’s license
numbers are now generally accessible. We are told that the hackers possess their driver’s
15
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 16 of 34
license numbers, but they do not allege that the unnamed hackers are so numerous as to
constitute the public on their own. Nor do they allege that the hackers have shared their
driver’s license numbers with anyone else. As far as we are told, their stolen information
is currently accessible to only a few. So the harm felt by Bias and Shaw does not bear a
close relationship to the harm addressed by the public-disclosure tort. If the hackers’
private knowledge of their driver’s license number inflicts a harm, it is a harm different in
kind, not degree, from that addressed by the common-law tort. The two of them have not
alleged a concrete injury.
The two other named plaintiffs—Cardenas and Holmes—are different. They allege
that they found their driver’s license numbers listed on the dark web and attribute the
listings to the Elephant breach. 10 The dark web, an anonymous online network for
unregulated content and markets, is not a traditional method of communicating information
like a newspaper or radio broadcast. But, not dissimilar to the internet more generally, it
is a forum accessible to all—or at least to those with some degree of proficiency with
computers. Information listed on it thus either “reaches, or is sure to reach, the public,” or
is close to doing so. Restatement (Second) of Torts § 652D cmt. a. So Cardenas and
10
Strictly speaking, Cardenas only alleges that he found her information for sale on
the dark web, which implies that his full driver’s license number is only accessible with
payment. But we do not see why this should make a difference. One classic example of
publicity in public-disclosure tort cases is listing information in a newspaper. See
Restatement (Second) of Torts § 652D cmt. a (“[A]ny publication in a newspaper or a
magazine, even of small circulation . . . is sufficient to give publicity.”). Yet many
newspapers are only accessible with payment too. We see no reason to treat the internet
differently. Paywalled or not, information listed on the internet is ordinarily accessible to
many.
16
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 17 of 34
Holmes have alleged facts showing that information they justifiably prefer to tightly
control has been released into the open. Under TransUnion, that is sufficient to show a
concrete injury in the eyes of Article III. 11
2. Elephant’s counterarguments are unavailing
Elephant attacks the TransUnion analogy between the plaintiffs’ alleged harm and
the public disclosure of private information tort in two ways. Neither succeeds.
First, Elephant argues that the plaintiffs’ theory of concrete injury should fail
because they cannot satisfy one element required for liability under the public-disclosure
tort: that Elephant made a disclosure. 12 That is, in Elephant’s view, an analogy only exists
if Elephant had exposed their driver’s license numbers through some affirmative action.
See Disclose, Black’s Law Dictionary (6th ed. 1990) (“To bring into view by uncovering;
to expose; to make known.”). And Elephant asserts that it took no such action—that it and
the plaintiffs alike were passive victims of a hack.
But this misunderstands TransUnion for reasons already given. Recall that
TransUnion only seeks a “close relationship” between harms, not elements. 594 U.S. at 425
. So the only elements that matter are the ones that define the harm of the analogous
11
In so concluding, we join the First, Second, and Third Circuits, which have
recently issued opinions finding concrete injury under TransUnion in similar situations.
See Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365
(1st Cir. 2023); Bohnak v.
Marsh & McLennan Cos., 79 F.4th 276
(2d Cir. 2023); Clemens v. ExecuPharm Inc.,48 F.4th 146
(3d. Cir. 2022).
12
Though case law tends to use the word “disclosure,” the Restatement eschews the
term, instead speaking in terms of “giving publicity.” Restatement (Second) of Torts
§ 652D. This terminological difference does not change our understanding of the tort.
17
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 18 of 34
cause of action. A defendant’s disclosure, though also an element of the public disclosure
of private information tort, is not a harm-defining element—it goes to the defendant’s
liability, not to what is felt by the plaintiff. Someone whose driver’s license number is
made accessible to many is harmed by that loss of control over their private information,
even if the situation was brought about through no fault or action of the defendant. 13
Though the defendant cannot be held liable under the public-disclosure tort without
disclosure, there is still a concrete injury. 14
Second, Elephant points out that a divided panel of the Seventh Circuit has held, in
a case nearly identical to this one, that a driver’s license number is not sufficiently close to
the kind of sensitive information protected by the public disclosure of private information
tort. In that case, Baysal v. Midvale Indemnity Co., plaintiffs brought a putative class action
suit against an insurer after the plaintiffs’ driver’s license numbers were compromised in a
data breach using the insurer’s auto-populated quoting platform. 78 F.4th 976, 977
(7th
Cir. 2023). The Seventh Circuit affirmed the dismissal of the case for lack of standing
under TransUnion, reasoning that only “potentially embarrassing or intimate details” are
13
Plaintiffs argue that even if active disclosure were required under TransUnion’s
analogue test, it was satisfied here because Elephant intentionally designed its online
quoting platform with an auto-populate feature. Since we hold that the element of
disclosure is immaterial to our standing analysis, we have no occasion to address this
argument.
14
To put a fine point on it: Elephant’s argument elides the distinction between what
is needed for standing under the common-law analog and what is needed to prove liability
under the common-law analog. Allegations that would fall short of proving liability can
nevertheless establish standing. These are separate inquiries.
18
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 19 of 34
shielded by the public disclosure of private information, and “[a] license number is not
viewed as embarrassing . . . or private . . . but as neutral.” Id. at 979
.
As our discussion should make clear, we see things differently. Undoubtedly, a
driver’s license number is unlike the details of an affair or a medical condition. People do
not consider their driver’s licenses embarrassing and hand them to bartenders and waiters
and police officers without hesitation. But we know that the public-disclosure tort protects
some types of information that we would not strictly consider embarrassing. See
Restatement (Second) of Torts § 652D cmt. b (listing “income tax returns”). And we also
know that TransUnion requires harms that are analogues, not duplicates, which further
broadens the set of information whose dissemination may inflict a concrete injury. So we
cannot accept that a concrete injury exists only if the information publicized is
embarrassing.
Indeed, the Seventh Circuit appeared to recognize as much when it implied in the
very same opinion that publicizing social security numbers would be concrete injury.
Baysal, 78 F.4th at 977, 979
. But social security numbers are also “not viewed as
embarrassing . . . or private . . . but as neutral,” and “most adults have these numbers,
which are neither good nor bad.” Id. at 979
. While driver’s license numbers may be less
private than social security numbers, 15 such a difference would be a difference in degree,
15
The plaintiffs assert that this may not even be true, telling us that the value of a
driver’s license number is the same as a social security number on the dark web. If the
privacy information is correlated with its value to malicious actors, the two pieces of
information would appear to be equally private—or at least equally capable of dealing
damage when misused by the wrong party.
19
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 20 of 34
not a difference in kind—and TransUnion only requires an analogy by kind. See
TransUnion, 594 U.S. at 424
; see also Garey,35 F.4th at 922
(explaining that the
TransUnion inquiry compares “types of harms”). 16 If publicizing social security numbers
would inflict a kind of concrete injury, we see no reason why driver’s license numbers
would be different.
Notably, Congress appears to agree with us. TransUnion reminds us that “[i]n
determining whether a harm is sufficiently concrete to qualify as injury in fact
. . . Congress’s views may be ‘instructive.’” 594 U.S. at 425
(quoting Spokeo,578 U.S. at 341
). And here, Congress has enacted the Driver’s Privacy Protection Act, which provides
a cause of action against “a person who knowingly obtains, discloses, or uses personal
information, from a motor vehicle record, for a purpose not permitted under this chapter,”
which includes driver’s license numbers. 18 U.S.C. § 2724
(emphasis added). To be sure,
“we cannot treat an injury as ‘concrete’ . . . based only on Congress’s say-so.” Id. at 426
(quotation omitted). But “our assessment of concreteness must look to ‘both history and
the judgment of Congress.’” Baysal, 78 F.4th at 981
(Ripple, J., dissenting) (emphasis
added) (quoting Spokeo, 578 U.S. at 340
). Respect for “Congress’ role in identifying and
elevating intangible harms” thus requires us to give weight to the harms it chooses to
16
We caution that while we disagree with the Seventh Circuit on the bottom line,
we agree that there is a “need to be precise when thinking about invasion of privacy” torts
and how they furnish standing. Baysal, 78 F.4th at 980
. The harm inflicted by each of the
four invasion-of-privacy torts is not the same; each must be taken on its own terms. What
is true for public disclosure of private information, for example, may not be true for
intrusion upon seclusion. See, e.g., Prosser, supra, at 389–90, 398 (tracing the roots of
public disclosure of private information to defamation but the roots of intrusion upon
seclusion to trespass).
20
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 21 of 34
protect by statute. Spokeo, 578 U.S. at 341
. Though driver’s license numbers may not be
the most sensitive personal information people possess, they are, in Congress’s view,
among the “personal information” worth protecting. § 2725(3). That favors finding the
injury here concrete.
In sum, Cardenas and Holmes have had their driver’s license numbers listed on the
dark web against their justifiable wishes. Under TransUnion, they have suffered a concrete
injury. And because that injury has already come to pass, it gives them standing to seek
damages. See Lyons, 461 U.S. at 105
. On this specific basis for injury-in-fact, only for
retrospective relief like damages, and only for Cardenas and Holmes, we reverse the district
court’s decision.
B. Plaintiffs’ Other Alleged Injuries Do Not Support Standing
The plaintiffs’ other standing theories do not fare so well. The risk that their driver’s
license numbers may be misused in the future fails to furnish standing because they have
not alleged facts showing that any particular misuse is imminent. The risk that another
data breach may befall Elephant in the future fails for the same reason. And the lack of
imminent injury prevents the plaintiffs from bootstrapping their way into standing for
damages solely by expending time or alleging emotional distress.
1. Plaintiffs have not shown any further future misuse is imminent
The plaintiffs’ second asserted injury-in-fact is the risk that someone may misuse
their driver’s license numbers in the future. In the plaintiffs’ words, they are at an
“increased risk of identity theft.” J.A. 71. But the plaintiffs use the phrase “identity theft”
more broadly than is conventional. They suggest that the posting of information on the
21
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 22 of 34
dark web is itself “identity theft.” See, e.g., J.A. 76 (Plaintiff Holmes’s “information was
on the dark web, proof that his identity has been stolen.”). So we consider the plaintiffs to
have actually alleged two distinct risks. Bias and Shaw allege that they are at risk of having
their information publicized. And Cardenas and Holmes, who have already had their
information publicized on the dark web, allege that they are at risk of having their identity
further misused as part of a fraudulent impersonation attempt. 17
The two alleged future harms are both concrete and particularized. 18 So they may
furnish standing to seek prospective declaratory and injunctive relief if the future harm is
“imminent.” Lujan, 504 U.S. at 564
. A future harm is not imminent just because there is
an “objectively reasonable likelihood” that it will someday come to pass. Clapper v.
Amnesty Int’l USA, 568 U.S. 398, 410
(2013). Instead, “the plaintiffs must show a
17
This second risk to Cardenas and Holmes is what we understand the conventional
definition of “identity theft” to be. It requires the use of personal information in a
fraudulent impersonation attempt for personal gain. See McMorris v. Carlos Lopez &
Assocs., 995 F.3d 295, 302
(2d Cir. 2021) (distinguishing posting personal information on
the dark web from “actual or attempted identity theft”); see also Identity Theft, Department
of Justice Criminal Division (Aug. 11, 2023) (“Identity theft and identity fraud are terms
used to refer to all types of crime in which someone wrongfully obtains and uses another
person’s personal data in some way that involves fraud or deception, typically for
economic gain.” (emphasis added)). To avoid confusion between this conventional
definition and the plaintiffs’ broader definition, we eschew the use of the phrase “identity
theft” in this section.
18
The first injury, of having one’s information posted on the dark web, is concrete
for reasons given above. The second injury, of having one’s identity fraudulently
misrepresented, is concrete because it either inflicts a tangible injury, see, e.g., Hutton v.
Nat’l Bd. of Exam’rs in Optometry, Inc., 892 F.3d 613, 622
(4th Cir. 2018) (eleven point
decrease in credit score from a fraudulent credit card application), or will inflict an
intangible injury that is on all fours with the common-law tort of appropriation of another’s
name or likeness, see Restatement (Second) of Torts § 652C.
22
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 23 of 34
substantial risk that” it will happen “in the near future.” Murthy v. Missouri, 603 U.S. 43, 58
(2024). 19 While imminence “is concededly a somewhat elastic concept,” Lujan,504 U.S. at 564
n.2, we conclude that neither alleged future harm establishes a substantial risk
of future misuse of their driver’s license numbers.
First, Bias and Shaw. Their assertion of imminence runs headlong into TransUnion.
The 6,332 plaintiffs in TransUnion who did not have their inaccurate credit reports
disseminated, in addition to alleging that they suffered an actual injury, also alleged that
they faced an imminent injury because “TransUnion could have divulged their misleading
credit information to a third party at any moment.” TransUnion, 594 U.S. at 438
. But the
Court dismissed this “risk of dissemination to third parties” as “too speculative” to establish
an imminent injury because the plaintiffs had given no reason to think it would occur. Id.
The fact that other members of the class already had their information disseminated was
not enough to establish imminence.
Bias and Shaw are in a position that is materially indistinguishable from the 6,332
plaintiffs in TransUnion. The hackers who breached Elephant could presumably post their
driver’s license numbers to the dark web “at any moment.” But they have given us no
19
The Supreme Court has used multiple phrases to express this concept. See, e.g.,
Susan B. Anthony List v. Driehaus, 573 U.S. 149
, 158 (2014) (“An allegation of future
injury may suffice if the threatened injury is certainly impending, or there is a substantial
risk that the harm will occur.” (quotation omitted)). Until recently, it was unclear whether
“certainly impending” and “substantial risk” expressed the same or different standards. See
Clapper, 568 U.S. at 414
n.5 (“But to the extent that the ‘substantial risk’ standard is
relevant and is distinct from the ‘clearly impending’ requirement . . .”). But recently, the
Court has treated the two as one, using “substantial risk” as the preferred language. See,
e.g., Murthy, 603 U.S. at 58
. We follow the Court’s more recent gloss on the Clapper
standard.
23
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 24 of 34
reason to think that this will occur. Their strongest piece of evidence is that the hackers
have already posted Cardenas and Holmes’s information to the dark web, suggesting that
more information from the breach may follow. But that fact did not suffice for imminence
in TransUnion itself. We see no reason it would be different here.
Cardenas and Holmes are in a different position. Because they have already had
their driver’s license numbers listed on the dark web, the future misuse they worry about
will come from a malicious actor’s fraudulent impersonation attempt. Bias and Shaw, of
course, cannot show that fraudulent impersonation is imminent because they falter at an
earlier step. Though Cardenas and Holmes have a head start, they arrive at the same place.
Specifically, Cardenas and Holmes’s position is foreclosed by the principle we
stated in Beck v. McDonald, 848 F.3d 262
(4th Cir. 2017). In Beck, an employee’s laptop
and four boxes of medical reports were stolen from a veterans’ hospital. Id.
at 267–68.
Patients of the hospital sued the hospital for the data breach, alleging violations of the
Privacy Act of 1974 and the Administrative Procedure Act. Id. at 266
. But the district
court dismissed their suit for lack of standing, and this Court affirmed. Id.
at 277–78. In
doing so, we set out a numerical bar for imminence in the context of data breaches: “Even
if we credit the Plaintiffs’ allegation that 33% of those affected by [the data breach] will
become victims of identity theft, it follows that over 66% of veterans affected will suffer
no harm. This statistic falls far short of establishing a ‘substantial risk’ of harm.” Id.
at
24
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 25 of 34
275–76. So Beck tells us that the probability needed for “substantial risk” is at least 33%—
and presumably a good bit higher. 20
Cardenas and Holmes do not clear that bar. They do not allege that their driver’s
license numbers have been misused by the hackers to date. So any future harm, given that
the hackers have posted their information on the dark web, would presumably come from
the intervening actions of independent malicious actors who might buy or otherwise obtain
their compromised numbers. Clapper, 568 U.S. at 413
. But they have not alleged facts
that show that those intervening “independent decisionmakers” “will likely react in
predictable ways” that will ultimately result in fraudulent impersonation. Murthy, 603 U.S. at 58
(quoting Dep’t of Com. v. New York,588 U.S. 752, 768
(2019)).
Instead, the plaintiffs offer only a “speculative chain of possibilities.” Id.
at 70
(quoting Clapper, 568 U.S. at 414
). To start, the plaintiffs do not allege anything that
suggests that their specific driver’s license numbers will be acquired by identity thieves off
20
We are bound here to apply Beck’s statistical floor. See Payne v. Taslimi, 998 F.3d 648, 654
(4th Cir. 2021). But one might understand Beck to not extend beyond the
context of data breaches and other similar informational injuries. See Beck, 848 F.3d at 276
; cf. Sommerville v. Union Carbide Corp.,149 F.4th 408
, 421 (4th Cir. 2025) (finding
Beck inapposite because plaintiff’s “injury is a present physical one” that “exists already”).
What qualifies as a “substantial risk” might vary from injury to injury—in other words,
“substantial risk” might encompass expected value, not just pure probability. See, e.g.,
Mountain States Legal Found. v. Glickman, 92 F.3d 1228, 1234
(D.C. Cir. 1996) (“The
more drastic the injury that government action makes more likely, the lesser the increment
in probability necessary to establish standing.”). While we note the possibility, we take no
position on Beck’s reach or on whether this distinction might reflect modern standing
doctrine.
25
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 26 of 34
the dark web. 21 To be sure, hackers list personal information on the dark web in the hope
that someone will buy it. But no particular piece of personal information is guaranteed to
be seen or sold, just as no particular item on Craigslist or eBay is guaranteed to be seen or
sold. Without more, it is unrealistic to assume that identity thieves will imminently acquire
the driver’s license number of any given plaintiff.
There is another link in the speculative chain. As the plaintiffs themselves explain,
one single piece of personal information is not enough for fraudulent impersonation;
impersonators must usually “aggregate information taken from data breaches on users to
build profiles on individuals” before attempting to impersonate someone. J.A. 53. The
district court recognized as much. See Elephant Ins., 2023 WL 4183380
, at *4 (“The
driver’s license number’s real value lies in being pieced together with other [personal
information] to create a full profile.”). So even if Cardenas or Holmes’s specific driver’s
license number was acquired, that enables fraudulent impersonation only if the
impersonators also have enough information from other sources to build a profile.
And there is yet another link. Driver’s license numbers do not stay valid for all
eternity. “[L]icense numbers change over time as people move to different states or
licenses are renewed.” Baysal, 78 F.4th at 979
. 22 Though perhaps harder to cancel than a
21
Holmes alleges that his driver’s license number was “found” on the dark web but
does not clarify if it was found in its entirety for free or whether it was simply for sale.
Cardenas expressly alleges that his number was for sale.
22
Baysal declined to find concrete injury under TransUnion on the grounds that
driver’s license numbers were insufficiently sensitive. As explained above, we believe that
reasoning to be mistaken. So long as the plaintiffs justifiably seek to tightly control the set
(Continued)
26
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 27 of 34
credit card, driver’s license numbers can still “be rendered useless to cybercriminals” more
easily than many other forms of information. McMorris, 995 F.3d at 302
. Driver’s license
numbers are thus part of, or close to, the category of “less sensitive data” that “does not
pose the same risk of future identity theft or fraud to plaintiffs if exposed.” Id.
For many
plaintiffs, then, “as the breach[] fade[s] further into the past,” the risk they will be
impersonated “become[s] more and more speculative.” Beck, 848 F.3d at 275
(quotation
omitted).
All this means that fraudulent impersonation will befall Cardenas and Holmes only
if other intervening malicious actors acquire their driver’s license numbers from the dark
web and also acquire other pieces of their personal information and do so before their
driver’s license numbers change. And under our precedent, the plaintiffs cannot just assert
that all this might happen; they must allege facts allowing us to conclude that for some
particular plaintiff, the combined probability of that speculative chain materializing
surpasses at least 33%. See Beck, 848 F.3d at 276–77. They have not done so. So they
“fall[] far short of establishing a ‘substantial risk’ of harm.” Id. at 276
. Accordingly,
neither Bias nor Shaw nor Cardenas nor Holmes have shown that they are at risk of an
imminent injury.
of people who know the information, the degree of sensitivity of the information does not
help gauge whether its disclosure would work the kind of harm addressed by the public
disclosure of private information tort. But the degree of sensitivity, including the ease of
replacing the information, is perfectly at home in assessing whether the risk of future
fraudulent impersonation is imminent—a wholly separate inquiry from concreteness.
Different aspects of standing look to different facts.
27
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 28 of 34
We recognize that our sister circuits have found imminent injury to plaintiffs in
similar circumstances to Cardenas and Holmes. See, e.g., Bohnak, 79 F.4th at 289
(finding
imminent injury when names and SSNs were compromised in a hack); Webb, 72 F.4th at
375–76 (finding imminent injury from future use of detailed pharmacy records
compromised in a hack); Attias v. Carefirst, Inc., 865 F.3d 620
, 628–29 (D.C. Cir. 2017)
(finding imminent injury from future use of names and health insurance numbers
compromised in a hack); Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688
, 693–94 (7th
Cir. 2015) (finding imminent injury from future use of credit card numbers compromised
in a hack). And several cases identify the targeted nature of an attack and the subsequent
listing of the information on the dark web—both present here—as factors weighing in favor
of standing. See, e.g., McMorris, 995 F.3d at 301
; Clemens,48 F.4th at 157
; Green-Cooper
v. Brinker Int’l, Inc., 73 F.4th 883
, 889–90 (11th Cir. 2023).
But our sister circuits have not explained how a data breach presents a substantial
risk that any one piece of personal information will be misused in the future, even when
the plundered information is listed on the dark web. None run through the chain of
independent events and third-party choices that would have to coalesce for future
fraudulent impersonation to befall any particular plaintiff. Rather, many cases appear to
implicitly require only a reasonable probability of future harm—a looser notion of
imminence urged by the dissent in Clapper but rejected by the majority. See Clapper, 568
U.S. at 432–33, 441 (Breyer, J., dissenting). Following “the common-sense notion that a
threatened event can be reasonably likely to occur but still be insufficiently imminent to
constitute an injury-in-fact,” Beck, 848 F.3d at 276
(cleaned up), this Court has drawn a
28
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 29 of 34
tighter boundary when it comes to future harms. The plaintiffs may have alleged enough
to show that the risk of future misuse is an imminent injury before other courts. But they
have not done so before this one.
2. Plaintiffs have not shown another breach will occur at Elephant
Next, the plaintiffs assert another future harm: a second data breach at Elephant
that might compromise more of their information in the same way. To redress this alleged
injury, they ask us to declare that Elephant’s security is unlawfully shoddy and enjoin
Elephant to fix it by, among other things, hiring security auditors, deleting unused customer
data, and conducting routine internal security training sessions. We have already
determined that such a data breach would be a concrete injury if the compromised
information was then made accessible to many, as by sharing the information on the dark
web. And it would be particularized to any person whose information was compromised.
So the question, again, is whether the risk of this future injury is imminent enough to itself
be an injury-in-fact.
The answer, again, is no. On this front, the plaintiffs run headlong into the Supreme
Court’s decision in City of Los Angeles v. Lyons. In Lyons, police placed Adolph Lyons
into a chokehold at a traffic stop. 461 U.S. at 97
. Along with retrospective damages for
the incident, Lyons sought a prospective injunction ordering the Los Angeles Police
Department to revise its use-of-force policies to bar chokeholds outside of situations
requiring deadly force. Id. at 98
. Despite the fact that Lyons had been previously placed
in a chokehold, the Court held that Lyons had no standing to seek such relief. Id. at 109
.
Even though “there [would] be certain instances in which strangleholds [would] be illegally
29
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 30 of 34
applied” by the Los Angeles Police Department to denizens of the city, the certainty of
unconstitutional action in the aggregate did not mean that “Lyons himself [would] again
be involved in one of those unfortunate instances.” Id. at 108
. And without alleging
anything to support that he, specifically, had a substantial risk of suffering future harm,
Lyons could not establish standing for prospective relief. Id.
at 105–06, 111. Lyons was
“no more entitled to an injunction than any other citizen.” Id. at 111
.
Lyons maps neatly onto this case. The plaintiffs here make only general allegations
that “it is axiomatic” that a database hacked once “due to inadequate security measures” is
thereby at risk of imminent additional breaches “unless those security measures are
improved.” Op. Br. at 48. But they give us no reason to think this is true—or that hackers
would target Elephant again, specifically, as opposed to other companies that have recently
suffered data breaches. Nor do they give any reason to think another data breach at
Elephant would compromise their information, specifically, as opposed to information
belonging to others. All the plaintiffs can show is that they are on the same footing as
anyone else whose information was compromised in a data breach in the past few years.
That “falls far short of the allegations that would be necessary to establish a case or
controversy.” Lyons, 461 U.S. at 105
. If the possibility of being subject to another
chokehold was insufficiently imminent in Lyons, the possibility of being subject to another
data breach is insufficiently imminent here.
30
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 31 of 34
3. Without a separate imminent injury, Bias and Shaw cannot
recover damages for time spent or emotional distress felt
Finally, the plaintiffs assert that they have suffered an injury-in-fact sufficient for
damages by spending time monitoring their financials and by feeling emotional distress in
response to the data breach at Elephant. 23 Because Cardenas and Holmes have already
shown an injury-in-fact sufficient for damages, this assertion is inapplicable to them; there
is no such thing as double standing for one form of relief. 24 But this assertion matters
greatly for Bias and Shaw, who have no other basis to recover damages.
Neither the Supreme Court nor the courts of appeals have settled whether either time
spent or emotional distress felt are concrete injuries bearing a close relationship to harms
recognized at common law. See TransUnion, 594 U.S. at 436
n.7 (“We take no position
on whether or how such an emotional or psychological harm could suffice for Article III
purposes.”); Perez v. McCreary, Veselka, Bragg & Allen, P.C., 45 F.4th 816, 825
(5th Cir.
2022) (“[W]e are not aware of any tort that makes a person liable for wasting another’s time
. . . [but] we do not conclusively decide whether such injuries are closely related to
23
Although the plaintiffs’ amended complaint repeatedly refers to the “out-of-
pocket costs associated with the prevention, detection, recovery, and remediation from
identity theft,” J.A. 80, the complaint has no allegations that the plaintiffs spent money
after learning of the breach. The most the plaintiffs allege is that they spent time. So we
take the “out-of-pocket costs” to refer solely to time, as the district court did. See Elephant
Ins., 2023 WL 4183380
, at *5.
24
To be clear, mitigation time and emotional distress are irrelevant to Cardenas and
Holmes for standing. They may be relevant down the line when calculating the amount of
their compensatory damages. See Restatement (Second) of Torts § 652H (recognizing both
“mental distress” and “special damage” as recoverable for an invasion of privacy tort);
FAA v. Cooper, 566 U.S. 284, 295
(2012) (explaining that “special damages” are “actual
pecuniary loss[es]” that are incurred from an invasion of privacy (quotation omitted)).
31
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 32 of 34
traditional harms.”). We need not settle these questions today. Assuming without deciding
that both are sufficiently concrete, we hold that Bias and Shaw cannot furnish standing for
damages solely through expenditures of time and allegations of emotional distress.
To start, we know that plaintiffs “cannot manufacture standing by choosing to make
expenditures based on hypothetical future harm that is not [imminent].” Clapper, 568 U.S. at 402
. When the future harm is imminent, a plaintiff may have standing to sue based on
monetary costs that “remain[] fairly traceable to” the threat. Fed. Election Comm’n v.
Cruz, 596 U.S. 289
, 297 (2022). But when the future harm is merely speculative, a plaintiff
cannot backdoor standing “simply by making an expenditure based on a nonparanoid fear.”
Clapper, 568 U.S. at 416
. “If the law were otherwise, an enterprising plaintiff” could
conjure standing from nothing, “improperly water[ing] down the fundamental
requirements of Article III.” Id.
25
We see no reason to treat mitigation time differently than mitigation costs. The
worry with finding standing based on mitigation costs alone is that anyone can pay to
mitigate anything, however unlikely. The same worry exists for time. The only difference
25
It is unclear whether this rule against freestanding mitigation costs goes to the
injury-in-fact or the traceability prongs of standing. It may be that expenditures made in
response to a speculative event “are not fairly traceable to” that event. Clapper, 568 U.S. at 416
; see alsoid. at 417
(“[R]espondents’ present injuries are not fairly traceable to [the
challenged statute].”). It may also be that mitigation cost is a unique kind of injury such
that a plaintiff cannot plead it alone—that mitigation costs must connect with a second
injury to be an injury-in-fact. See, e.g., Hutton, 892 F.3d at 622
(“[C]osts for mitigating
measures to safeguard against future identity theft may not constitute an injury-in-fact
when that injury is speculative.”); Remijas, 794 F.3d at 694
(“Mitigation expenses do not
qualify as actual injuries where the harm is not imminent.”). Either way, the result is the
same—mitigation costs cannot furnish standing on their own.
32
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 33 of 34
is that rather than spend a dollar, plaintiffs could spend a minute. Just as plaintiffs cannot
circumvent their burden to show substantial risk by tacking on a claim for mitigation costs,
we think plaintiffs cannot circumvent their burden by tacking on a claim for mitigation
time. Allowing the latter would defeat the purpose of Clapper’s rule against the former
and place the existence of an Article III case or controversy entirely in the hands of every
plaintiff. We decline this invitation to gut the law of standing.
So too with emotional distress. Under Clapper, a plaintiff cannot “manufacture
standing” by resort to a theory that would permit standing in every case. 568 U.S. at 402
.
And although emotional distress is distinct from mitigation expenditures, it poses much the
same problem. Though a plaintiff does not choose to suffer emotional distress the way he
might choose to spend time or money, a plaintiff can freely allege emotional distress in
every case with little fear of disproof. For this reason, tort law has long aimed a skeptical
eye at freestanding emotional distress claims. “Because of the fear of fictitious or trivial
claims, distrust of the proof offered, and the difficulty of setting up any satisfactory
boundaries to liability, the law has been slow to afford independent protection to . . .
emotional distress standing alone.” Restatement (Second) of Torts § 46 cmt. b. Instead,
the law has traditionally only recognized “recovery for emotional distress as an additional,
or ‘parasitic’ element of damages” that must be attached to a separate injury. Id. § 47 cmt.
b. The same protective measure applies in the standing context.
Accordingly, we hold that if time spent and emotional distress felt are concrete
injuries, they may serve as the sole basis for standing to recover damages only when
incurred in response to a separate imminent harm. They do not suffice for standing on their
33
USCA4 Appeal: 23-1782 Doc: 51 Filed: 10/14/2025 Pg: 34 of 34
own. For reasons explained above, Bias and Shaw have failed to allege any imminent
harm. So they lack standing to recover damages for any time spent or emotional distress
felt too.
* * *
Bias, Cardenas, Holmes, and Shaw sued Elephant after their driver’s license
numbers were compromised in a breach of Elephant’s network. Cardenas and Holmes had
their driver’s license numbers then posted on the dark web. The publicity given to their
driver’s license numbers inflicted a concrete harm sufficient to establish an actual injury-
in-fact. Accordingly, the two of them—along with anyone in their class, if their class is
certified—can seek damages for that injury. But they cannot recover any other form of
relief. And Bias and Shaw cannot recover at all. The requirements of Article III standing
prohibit plaintiffs from receiving redress for speculative future injuries or for injuries
incurred only in response to those speculative injuries. Accordingly, the judgment is
AFFIRMED IN PART, REVERSED IN PART, AND REMANDED.
34