The First Circuit recently affirmed a Puerto Rico district court’s ruling dismissing a class action suit arising from a 2019 ransomware attack against a hospital in which 522,493 patients’ personally identifiable information (“PII”) and protected health information (“PHI”) was allegedly accessed by hackers, albeit in “encrypted” form. See Santos-Pagán v. Bayamon Medical Center, No. 24-2018, 2026 WL 1693930 (1st Cir. June 11, 2026).
The central issue on appeal was whether the named plaintiff had Article III standing. The plaintiff alleged that, at some point, an unknown cellphone account was opened in her name, causing her to expend time and money to remediate the resulting credit score impact and monitor for further fraudulent activity. Importantly, the plaintiff did not allege when that account was opened but told the district court that she “discovered” the account in or after September 2023, more than four years after the incident.
A unanimous First Circuit panel held, in a published opinion, that the plaintiff failed to plausibly allege that the fraudulent cellphone account, although sufficient to allege an injury-in-fact, was traceable to the hospital’s 2019 ransomware incident, for three main reasons. First, the plaintiff failed to show a temporal connection between the breach and the account; indeed, the only date-related facts alleged suggested the gap might have been as long as four years. Second, the plaintiff failed to allege that she was herself careful about sharing and storing her PII securely, so as to support an inference that the cellphone fraudster did not obtain the PII from another source. Third, the plaintiff offered no factual allegations demonstrating an overlap between the information in the breach and the information one would need to open a fraudulent cellphone account; for that she offered only conclusory argument. This failure to plausibly show traceability meant that the plaintiff lacked Article III standing.
The First Circuit’s opinion is useful authority for defendants facing data breach litigation. The opinion also demonstrates the variation in how courts analyze causation issues in these cases. We recently reported on a Michigan district court ruling that found that traceability was satisfied but nonetheless dismissed under Rule 12(b)(6) for failure to sufficiently plead causation. Litigants seeking to dismiss such cases may need to pay particular attention to how a given court entertains these causation arguments at the pleading stage.