Background
Daniel Wisowaty, a former Lavelle Industries employee, gave the company personal information as a condition of employment, including his Social Security number, date of birth, driver’s-license, banking, and medical information. Lavelle stored that information in its computer systems.
After suspicious activity was detected in March 2024, Lavelle determined that an unknown actor may have accessed or taken information from its systems; LockBit 3.0 later claimed responsibility. Wisowaty alleged that LockBit released all stolen information online. He also alleged that, after the breach and before Lavelle notified employees, he received alerts about two unrecognized $800 transactions and experienced increased spam texts. He filed a putative class action asserting negligence, implied-contract, unjust-enrichment, privacy, fiduciary-duty, and medical-record-confidentiality claims. The circuit court dismissed for lack of standing.
The Court’s Holding
The Wisconsin Court of Appeals reversed. Accepting the complaint’s allegations as true, as required at the pleading stage, the court held that Wisowaty alleged an injury sufficient for standing because his private information was allegedly released on the internet. That injury was traceable to Lavelle’s handling of his personal information.
The court also held that the timing of the suspicious bank alerts and increased spam texts supported an inference of a connection to the breach. Whether Wisowaty can ultimately prove causation may be difficult, but that issue belongs at trial or summary judgment rather than on a motion to dismiss for lack of standing.
Key Takeaways
- An alleged online disclosure of private information can establish injury for standing in a data-breach case.
- At the dismissal stage, courts must accept pleaded facts and reasonable inferences as true.
- Proof of causation is a merits question when the pleaded facts plausibly link alleged harms to the breach.
Why It Matters
The decision allows Wisowaty’s putative class action to proceed beyond the standing stage. It underscores that a plaintiff need not conclusively prove the source of fraud-related activity to survive dismissal when the complaint alleges a data breach, online disclosure, and subsequent suspicious activity consistent with misuse of exposed information.