The U.S. Supreme Court declined to settle a circuit split concerning if actual and immediate damages are needed to adequately allege an injury from a data breach, leaving some jurisdictions hotspots for data breach class action filings because of a lower threshold for standing.

On March 25, the U.S. Supreme Court declined Zappos’ petition for writ of certiorari in a case involving the 2012 data breach of Zappos’ computer systems that led to hackers stealing 24 million customers’ names, email and physical addresses and partial credit card information. Although no fraudulent charges were reported by breached customers, class action suits followed after Zappos revealed the breach. The central issue of the case was whether individuals whose data is breached have Article III standing without concrete injury.