Data breach is today’s hot button issue. And it just got hotter. On the heels of major data breaches at Equifax and Uber, the U.S. Supreme Court is confronted with the question of whether it will resolve a threshold issue in all data breach class actions—was the plaintiff class actually injured?

In Attias v. CareFirst, the U.S. Court of Appeals for the D.C. Circuit Court reversed a D.C. district court and allowed the plaintiff class to survive Article III standing by holding that a substantial likelihood of identity theft suffices as injury-in-fact in the data breach context. For the plaintiff class in Attias, the courthouse door is open and their foot is in. But Carefirst has filed a petition for writ of cert, potentially leaving it up to the Supremes to decide whether the door remains open.