The Seventh Circuit has ruled, in Remijas v. Neiman Marcus Group, that the 350,000 Neiman Marcus customers affected by the company’s 2013 data breach have standing to sue based on the risk of future fraudulent charges and identity theft and the costs incurred in mitigating that risk.  The court overturned a district court’s dismissal of the plaintiffs’ proposed class action, finding that the alleged risk of harm sufficiently met the “certainly impending” harm threshold for Article III standing established by the Supreme Court in Clapper v. Amnesty International USA.  While other courts have cited Clapper in rejecting claims not based on actual identity theft or fraud, the Seventh Circuit concluded that Clapper only rules out claims involving speculative, unsubstantiated harms and does not “foreclose any use whatsoever of future injuries to support Article III standing.”  Neiman Marcus has petitioned the court for a rehearing en banc