On September 12, 2016, in Galaria v. Nationwide Mutual Insurance Co., the Sixth Circuit overturned a district court opinion and held that plaintiffs in a putative class action pled injuries that were sufficiently concrete to confer Article III standing, despite plaintiffs' failure to allege any actual fraud or identity theft as a result of the company's data breach. Noting that the purpose of the breach of Nationwide's computer network was to commit fraud with the stolen information, the Court held that plaintiffs were subject to a substantial risk of identity theft and the costs of credit freezes and monitoring plaintiffs incurred were "concrete injur[ies]" sufficient for standing purposes. Further, allegations that "but for" Nationwide's allegedly lax security, the data breach would not have occurred met the threshold for the standing doctrine's causation requirement—at least at the pleading stage. Finally, the Court clarified that "statutory standing" under the Fair Credit Reporting Act does not implicate a federal court's constitutional power to hear a case; it merely refers to whether the law gives plaintiffs a right to sue. Dissenting, Judge Batchelder contended that plaintiffs lacked Article III standing because they were not harmed by the data breach per se; rather, a third-party criminal would actually have to make use of the stolen information before an injury would result. Thus, Judge Batchelder would dismiss the claims against Nationwide on causation grounds and rebuked the majority for "tak[ing] sides" in the growing circuit split over whether an increased risk of identity theft is sufficient for Article III injury purposes in data breach cases. On September 26, 2016, Nationwide filed a petition for rehearing en banc asking the full Sixth Circuit to review the panel's decision, which the Sixth Circuit denied.