Class Can’t Craft Data Breach Claims Against Michaels Stores

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Daniel R. Stoller

Consumers failed to craft a class action complaint with enough damages to support their claims against Michaels Stores Inc. over a 2014 payment card breach, a federal appeals court affirmed May 2 ( Whalen v. Michaels Stores, Inc. , 2d Cir., No. 16-260, summary order 5/2/17 ).

Companies hit by a data breach are often targets of consumer class actions—especially if a breach includes payment card data. But courts are likely to dismiss such claims unless consumers can allege imminent harm that is traceable to the breach.

In the case against Michaels, plaintiff Mary Whalen, on behalf of a proposed class, didn’t allege any injury that would allow her to sue in federal court, the U.S. Court of Appeals for the Second Circuit, represented by Judges Guido Calabresi, Susan L. Carney and District Judge Carol Bagley Amon, ruled in a summary order.

Whalen asserted instances of attempted unauthorized use of her credit card and a future risk of identity theft, but the claims didn’t raise a “particularized and concrete injury suffered from the attempted fraudulent purposes,” the court wrote. The plaintiff “neither alleged that she incurred any actual charges” or “that she had spent time or money monitoring her credit,” the court said in the nonprecedential ruling.

The case stems from a Michaels’ January 2014 announcement that hackers retrieved payment card data from company systems. However, the craft store said that no other personal information, such as Social Security numbers, names or addresses, were stolen. Michaels offered affected customers identity theft monitoring and credit-reporting services.

The court distinguished Whalen’s claims from two Seventh Circuit decisions. Remijas v. Neiman Marcus Grp. and Lewert v. P.F. Chang’s China Bistro, Inc. provide that future injury and loss of time, including an increased risk of fraudulent charges and identify theft, can be enough to sue in federal court—but only with a substantial showing of such harms in the complaint. The plaintiff here didn’t allege enough injury to support a suit, the court said.

Michaels is represented by Sidley Austin LLP. Whalen is represented by Siprut PC, Glancy Prongay & Murray LLP, Edelman Combs Latturner & Goodwin LLC, Weltz & Luxenberg PC and Lite DePalma Greenberg LLC.

To contact the reporter on this story: Daniel R. Stoller in Washington at

To contact the editor responsible for this story: Donald Aplin at

For More Information

Full text of the summary order is available at

Copyright © 2017 The Bureau of National Affairs, Inc. All Rights Reserved.

Request Bloomberg Law: Privacy & Data Security