Whether a plaintiff can establish Article III standing in a data breach lawsuit by alleging an intangible harm analogous to a common law tort when the defendant did not commit the act giving rise to the alleged harm

No question identified. : resulting from the Elephant data breach. This case raises the question of what facts a plaintiff in a data breach class action lawsuit must plead in order to establish Article II standing under this Court’s holding in TransUnion LLC v. Ramirez, 594 U.S. 413 (2021). 2. Elephant moved to dismiss the class action complaint for lack of subject matter jurisdiction. The U.S. District Court for the Eastern District of Virginia granted that motion in its entirety on June 26, 2023, finding that the plaintiffs failed to plead concrete injuries-in-fact fairly traceable to the Elephant data security incident that would give them standing under Article III of the U.S. Constitution. 3. On appeal to the U.S. Court of Appeals for the Fourth Circuit, the court affirmed in part and reversed in part the district court decision, finding that two of the four named plaintiffs had alleged factual material sufficient to establish Article III standing at the pleading stage because they stated that their driver’s license numbers had been found on the dark web after the Elephant data incident. Holmes v. Elephant Ins. Co., 156 F.4th 413 (4th Cir. 2025). 4. Relying on TransUnion, the Fourth Circuit found that the allegations of two plaintiffs that their driver’s license numbers were found on the dark web were analogous to the common law tort of public disclosure of private facts. Id. at 425. The Fourth Circuit further explained that it was immaterial that any disclosure of the plaintiffs’ information on the dark web would have been made by the threat actor and not by Elephant. Id. at 426. Although disclosure by the defendant is an element of the tort of public disclosure of private facts, the Fourth Circuit found that it “is not a harm-defining element” and that, under TransUnion, “the only elements that matter are the ones that define the harm of the analogous cause of action.” Jd. (emphasis in original). 5. With this decision, the Fourth Circuit joined the U.S. Court of Appeals for the Second Circuit as the only courts of appeal that have found that a plaintiff may establish Article III standing under the TransUnion framework by analogizing an intangible injury to a harm traditionally protected at common law in a situation where the defendant is not the actor who committed the act that would have given rise to the common law harm. See Bohnak v. Marsh & McLennan Cos., Inc., 79 F.4th 276, 285 (2d Cir. 2023) (finding data breach plaintiff sufficiently alleged Article III standing based on harm analogous to public disclosure of private facts where defendant made no disclosure and was instead the victim of cyberattack). By contrast, the U.S. Court of Appeals for the Eleventh Circuit has held that TransUnion requires a comparison of the elements between the asserted injury and common law analogue because “if the elements do not match up, how could the harm that results from those elements?” Hunstein v. Preferred Collection and Mgmt. Servs., Inc., 48 F.4th 1236, 1239-40 (11th Cir. 2022). Reasons For Granting an Extension of Time The time to file a petition for a writ of certiorari should be extended for 60 days for the following reasons: 1. The Fourth Circuit’s decision creates a circuit conflict as to whether, when analyzing the sufficiency of intangible harms based on analogous common-law torts, a court must consider whether the defendant must be the one who commits the act giving rise to the injury that is analogous to a common law harm. Petitioners contend that an injury that is analogous to a common law harm cannot be “fairly traceable” to a defendant if the defendant is not the actor who committed the analogous harm. See Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992). In the data breach context, the Second and Fourth Circuits currently stand alone among the appellate courts in holding that a defendant need not make the disclosure that causes a harm analogous to public disclosure of private facts. + Petitioners believ