The Seventh Circuit Court of Appeals has revived a data-breach lawsuit against P.F. Chang’s China Bistro, Inc., finding that the two plaintiffs have standing to sue despite eating at a restaurant apparently not linked to the breach. Lewert v. P.F. Chang’s China Bistro, Inc., No. 14-3700 (7th Cir., order entered April 14, 2016). Additional details about the breach appear in Issue 526 of this Update.

The plaintiffs ate at an Illinois location of P.F. Chang’s two months before the company announced its payment system had been hacked, revealing personal information and credit card numbers. One plaintiff noticed fraudulent charges on his card and purchased credit-monitoring services, while the other alleged that he spent time and effort monitoring his card statements and credit report. Each brought separate lawsuits, which were later consolidated then dismissed for lack of standing. Following its announcement about the data breach, P.F. Chang’s identified 33 restaurants affected, excluding the Illinois location at which both plaintiffs had eaten.

Citing a similar data-breach lawsuit against Neiman Marcus, the appeals court found that the plaintiffs had standing to sue despite the discrepancy in location. “In its June statement, P.F. Chang’s addressed customers who had dined at all of its stores in the United States and admitted that it did not know how many stores were affected,” the court noted. “It is easy to infer that it considered the risk to all stores significant enough to implement a universal, though temporary, switch to manual card-processing.” The later finding that only 33 stores had been affected creates a factual dispute but does not destroy standing, the court said. “P.F. Chang’s will have the opportunity to present evidence to explain how the breach occurred and which stores it affected. Perhaps it can trace which specific data files were stolen. Perhaps each individual location’s data is behind a separate firewall. Or perhaps it is being too optimistic and the breach was greater than it suggests. At this stage, no one knows.” Accordingly, the court reversed the lower court’s dismissal and remanded the case for further proceedings.