In In re SuperValu, Inc., Customer Data Security Breach Litigation, No. 16-2378 (8th Cir. Aug. 30, 2017), the Eighth Circuit reviewed the district court’s dismissal of a lawsuit alleging claims arising out of a data breach that purportedly caused a single identified unauthorized charge. The district court found plaintiffs lacked standing because they did not suffer an injury in fact. As for the risk of future injury, the Eighth Circuit concluded plaintiffs had alleged information had been stolen, but, with one exception, had not alleged that it had been misused. The Court found the mere possibility of future harm was not sufficient for standing. Likewise, the costs plaintiffs may incur to mitigate their risk of future harm cannot create an injury where the risk of future identify theft is itself speculative. As for present injury, the Court concluded that the single allegation of misuse of credit card information was sufficient to demonstrate the class representative had standing. Because one named plaintiff had standing, the district court erred in dismissing the action.