The third putative class action filed against health insurer CareFirst over its 2014 data breach has ended with the same result as the first two:  dismissal for lack of standing.  On August 23, the U.S. District Court for the Central District of Illinois held that the plaintiff in Unchageri v. CareFirst of Maryland, Inc. had failed to make out the requisite concrete injury since he had not alleged that the personal information affected by the breach had already been misused.  This is the same conclusion reached by federal courts in Maryland and the District of Columbia in the other CareFirst suits, and it bolsters a growing trend in which courts have required plaintiffs in data breach cases to allege something more than simply the theft of personal information to establish standing to sue in federal court.