In a precedential opinion that could clear the way for similar cyberbreach claims, the U.S. Court of Appeals for the Third Circuit has ruled that the risk of identity theft or fraud is a concrete injury that may form the basis of a claim.

The appeals court reversed a Pennsylvania district court’s dismissal of claims brought by a former ExecuPharm employee seeking equitable and monetary relief over a data breach that resulted in the publication of her personal information on the Dark Web.