Two law firm employees whose financial data was hacked don’t have standing to sue the payroll-processing company that allowed the breach, a federal appeals court has held in a precedential opinion.

Because there is no evidence the compromised information has been or will be used, the injuries alleged are too speculative, the Third Circuit Court of Appeals said, agreeing with the majority of courts that have decided whether risk of future harm posed by data security breaches confers standing on persons whose data may have been accessed.