Credit: Ken Wolter/Shutterstock.com

A federal appeals court has found that a plaintiff had standing to sue over a 2013 data breach but couldn’t bring claims based on “bare assertions.”

Monday’s decision by the U.S. Court of Appeals for the Eighth Circuit reversed a Missouri federal judge’s finding for St. Louis-based investment firm Scottrade Inc. based on federal jurisdiction.

Citing the U.S. Supreme Court’s 2016 ruling in Spokeo v. Robins and precedent in its own circuit, the panel found that Matthew Kuhns had standing to bring breach-of-contract claims against Scottrade.

“Kuhns alleges that a portion of the fees paid in connection with his Scottrade account were used to meet Scottrade’s contractual obligations to provide data management and security to protect his [personal identifying information],” wrote James Loken for the panel. “When Scottrade breached those obligations, Kuhns received brokerage services of lesser value.”

But the panel affirmed dismissal of the case on different grounds that those Scottrade brought up on appeal, holding that Kuhns failed to sufficiently state his claims.

Timothy Blood, of San Diego’s Blood, Hurst & O’Reardon who argued for Kuhns, referred calls to another lawyer on the plaintiffs’ team, Joseph Siprut, of Siprut PC in Chicago. Siprut didn’t respond to a request for comment.

Chris Hohn, a partner at Thompson Coburn in St. Louis who represented Scottrade, also did not respond to a request for comment.

In court filings, Scottrade said the case presented an issue of first impression for the Eighth Circuit on whether a plaintiff had established standing in a data breach class action. The Eighth Circuit previously reversed a $10 million settlement over the 2013 cyberattack of Target Corp. customers.

Scottrade’s data breach affected 4.6 million of its customers. Four class actions were filed in federal courts in California, Florida and Missouri, where they were consolidated. Last year, U.S. Magistrate Judge Shirley Padmore Mensah of the Eastern District of Missouri dismissed the consolidated action after finding that the plaintiffs lacked standing because they hadn’t suffered injuries.

Kuhns was the only named plaintiff who appealed. Two others brought new cases in California and Florida state courts.

On March 23, just before oral arguments at the Eighth Circuit, Blood asked to dismiss Kuhns’ appeal because Scottrade had sought to stay the state court cases. Scottrade called the move “transparent, procedural gamesmanship” aimed at avoiding a detrimental Eighth Circuit decision.

In its decision, the Eighth Circuit refused to dismiss the appeal. The panel found Kuhns had standing to bring claims that Scottrade breached a brokerage contract he signed, citing its 2016 holding in Carlsen v. GameStop. But as in GameStop, the Eighth Circuit also agreed that Kuhns failed to allege those claims sufficiently, prompting dismissal of his case. The panel specifically said Kuhns failed to cite actual misrepresentations apart from “bare assertions” and criticized the “bare bones claim for declaratory relief” as “virtually unintelligible.” Loken also found that Kuhns had failed to allege actual damages he suffered as a result of the hack.

“Massive class action litigation should be based on more than allegations of worry and inconvenience,” he wrote.

Contact Amanda Bronstad at abronstad@alm.com.