A trust betrayed: The Ninth Circuit lowers the bar for data breach class actions

There was no criminal hacker, no ransomware, and no alleged identity theft – an employee at a health plan administrator inadvertently emailed a spreadsheet to the wrong people. That spreadsheet held plan members’ names, unique tracking numbers, provider names, claim numbers, dates of service, and amounts billed or paid. On October 9, 2026, the U.S. Court of Appeals for the Ninth Circuit in Black v. IEC Group, Inc. d/b/a AmeriBen held that this disclosure, without any allegation of misuse, was enough to let the impacted individuals bring a class action in federal court.

The decision in Black arrives at a pivotal moment. Data breach class actions have grown from roughly 100 filings in 2018 to more than 1,800 in 2025, an average of over seven every business day. Since the Supreme Court’s 2021 decision in TransUnion LLC v. Ramirez, defendants have relied on that opinion in an attempt to secure early dismissals by arguing that plaintiffs lack standing, the constitutional requirement that a plaintiff allege a real, concrete injury before suing in federal court. Black weakens that defense in the Ninth Circuit, and businesses that handle individuals’ data should understand why.

What the Ninth Circuit decided:

Plaintiffs and proposed class action representatives Miles and Melissa Black received health insurance through a plan administered by AmeriBen. In August 2023, the company notified them that some of their information had been disclosed to unauthorized parties. They filed a class action in federal court in Idaho alleging negligence, breach of contract, breach of fiduciary duty, and several other state-law claims.

The district court dismissed the case for lack of standing. Applying a narrower line of Ninth Circuit authority, the district court concluded the Blacks had not pleaded an imminent and substantial risk of future harm.

In turn, the Ninth Circuit reversed. Writing for a unanimous panel, Judge Eric Tung framed the question simply: if a company is trusted to keep sensitive health information private and discloses it without consent, has the impacted individual been injured? The court’s answer was “yes.”

Why the Ninth Circuit held that “a trust betrayed is the harm:”

The court’s reasoning rested on three considerations, the first being history. Under Supreme Court precedent, an intangible harm can support standing if it closely resembles a harm that courts have traditionally recognized. The panel identified that analogue in the centuries-old action for breach of confidence, tracing it through English chancery cases and early American decisions. In the court’s words, “a trust betrayed is the harm.”

The second consideration, breach of contract, then built on that foundation. The plaintiffs alleged that AmeriBen promised, including through its privacy policy, to keep their information confidential. The court noted that breach of contract claims were available at common law even without any financial loss.

Finally, the court considered the judgment of Congress, which the Supreme Court has said is important in deciding whether an intangible harm is real. When Congress enacted the Health Insurance Portability and Accountability Act (HIPAA), it prohibited the unauthorized disclosure of individually identifiable health information, even though the statute does not let individuals sue. The court read that choice as confirmation that disclosing this kind of data is a genuine injury. As the court explained, even seemingly mundane details such as a provider’s name or a date of service can reveal that a patient sees a psychiatrist for daily therapy or is struggling with infertility.

How Black fits into the standing debate:

For more than a decade, standing has been a consistent focus in data breach cases. The Ninth Circuit was long one of the more plaintiff-friendly forums, holding in Krottner v. Starbucks (2010) and In re Zappos.com (2018) that the risk of identity theft after a breach was enough to sue.

In 2021, however, the Supreme Court narrowed the path for all federal courts, including the Ninth Circuit, when it held in TransUnion that the mere risk of future harm, on its own, generally cannot provide standing. This allowed defendants in data breach cases a clearer path to argue lack of standing, but circuits have since divided. The Fourth Circuit, for example, now requires some form of public disclosure, not just unauthorized access.

Black offers plaintiffs a new route around TransUnion. Instead of arguing that identity theft is likely, they can argue that the disclosure itself was a breach of trust of the kind courts have long recognized, particularly where health information is involved, and the business promised confidentiality. The panel acknowledged that other circuits have taken narrower views, and it left open whether disclosure alone, without a confidential relationship, would be enough. Given the division among the courts, some commentators have argued that the Supreme Court should revisit the issue.

That said, two cautions do apply. First, Black addresses standing at the pleading stage only, and the plaintiffs must still prove their claims. Second, the ruling binds only federal courts in the Ninth Circuit. But that circuit does cover nine western states, including California, which is already a hotbed of data breach litigation.

What practical steps businesses should consider:

Businesses should start with their privacy promises. In Black, the plaintiffs pointed to the company’s privacy policy to support their claim that it promised confidentiality. Privacy notices, member agreements, and vendor contracts should say only what the business can actually deliver. Rewording these documents will not eliminate a potential plaintiff’s standing on its own, since the court grounded its holding in the confidential relationship itself and in HIPAA, but overstated commitments can strengthen contract and consumer protection claims once an incident occurs.

Data classification also deserves a fresh look. For HIPAA-regulated businesses, claim numbers, provider names, and dates of service are already protected health information, yet this data often moves through spreadsheets, billing systems, and email with far less care than clinical records. It should be handled with the same safeguards.

Because the disclosure here came from a single misdirected email, everyday data handling controls matter too. Data loss prevention tools, restrictions on emailing bulk data, encryption, and regular employee training can all reduce the chance of a similar incident.

Finally, businesses should revisit litigation reserves and cyber insurance coverage with Black in mind. Class action filings nationwide reached a 10-year high in 2025, driven largely by data breach claims, and the top 10 data breach settlements alone totaled more than $515 million that year. With an early dismissal defense now weaker in the Ninth Circuit, the cost of defending and resolving a breach claim may only rise.

To learn more about the current landscape of class action data breach litigation and how it may affect your business, contact a member of the McDonald Hopkins' national data privacy and cybersecurity team.