The 3rd U.S. Circuit Court of Appeals held that a former employee of a biopharmaceutical company could sue the company for a data breach that resulted in the publication of her sensitive personal information on the dark web. Rejecting the company’s argument that the absence of any actual harm to the former employee deprived her of standing, the court held that the risk of harm from the publication of the information and the former employee’s alleged emotional distress and mitigation expenditures established injury sufficient to allow her to bring her claims.
