On November 2, the Supreme Court heard argument in Spokeo, Inc. v. Robins, No. 13-1339, a case concerning who has standing to bring lawsuits under the Fair Credit Reporting Act (FCRA). The Court is reviewing a Ninth Circuit ruling that Congress can confer standing to sue on consumers who have not been concretely injured and therefore would have otherwise lacked standing under the Constitution. The Court's decision could have significant implications for data breach suits, which often involve plaintiffs who allege violations of state or federal law but cannot show that a data breach caused them concrete injury. Several Justices expressed skepticism at the notion that a statutory injury is sufficient. If the Court reverses the Ninth Circuit and holds that a plaintiff must show more than statutory injury, the Justices will need to confront the separate question of whether the particular injury alleged by the plaintiff in Spokeo -- the dissemination of false information on the Internet -- is sufficiently concrete for constitutional purposes.