Ruling in a case of first impression, a unanimous Georgia Supreme Court revived a putative class action involving claims by at least 200,000 current and former patients of an Athens clinic whose personal information, including names, addresses, Social Security numbers and insurance information, was stolen in a 2016 data breach.

The hackers demanded a ransom but the Athens Orthopedic Clinic refused to pay, and at least some of the patients’ information was later made available on the dark web.