District Judge Lorna G. Schofield
TransPerfect Global Inc. (TPG) has over 4,000 employees. Despite understanding the prevalence of cyber-attacks on corporate records, TPG did not train them on data security, erect digital firewalls, or maintain personally identifiable information (PII) retention and destruction protocols. Plaintiffs’ purported class suit arose from a breach of TPG’s computer systems that disclosed their PII to hackers. The court denied TPG’s motion to dismiss suit for lack of jurisdiction after concluding that the first two of four injuries alleged in plaintiffs’ complaint established Article III standing. Katz v. Donna Karan Co. and Whalen v. Michaels Stores Inc. suggested that Second Circuit will follow other circuits in holding that Article III does not require plaintiffs to wait for their identities to be stolen before seeking legal recourse. Plaintiffs’ complaint adequately alleged injury in fact with regard to risk of identity theft and remedial measures. The court dismissed only plaintiffs’ claim of breach of express contract. Their complaint adequately alleged injury resulting from TPG’s breach of a duty owed under common law and negligence per se principles. It also stated a claim for breach of implied contract arising from plaintiffs’ course of dealings with TPG.