Cybersecurity Policy Report, 1st Cir.: First Circuit affirms dismissal of data breach suit for lack of traceability, (Jun 15, 2026)

By Patricia K. Ruiz, J.D.

The court found that the alleged identity theft was not plausibly linked to the ransomware attack despite sufficient injury-in-fact allegations.

The First Circuit affirmed dismissal of a putative class action brought by a former patient of Bayamón Medical Center following a 2019 ransomware attack that affected the personal identifying information (PII) and protected health information (PHI) of more than 522,000 patients. Holding that the plaintiff failed to plausibly allege her claimed injury was traceable to the breach, the court concluded that, although the complaint adequately alleged an injury in fact based on purported misuse of personal information, it did not establish the required causal connection to the defendant’s conduct. Without a plausible showing of traceability, the court held, Article III standing was lacking and dismissal was proper (Santos-Pagán v. Bayamón, No. 24-2018 (1st Cir. Jun. 11, 2026)).

Background. A patient alleged that her treating medical center was liable for unauthorized disclosure of her PHI and PII. The medical center admitted it suffered a ransomware attack in 2019 that allegedly affected the PHI and PII of more than 500,000 current and former patients. The medical center sent notice to the affected patients stating that the PHI and PII was, according to the court’s summary of the alleged facts, “temporarily locked through encryption” and had not been exfiltrated; however, the patient complained that she experienced the creation of a fraudulent cellphone account in her name (see Patient’s data breach claims against medical center dismissed as too tenuous to proceed, Oct. 7, 2024). The plaintiff filed suit asserting claims for negligence, breach of contract, and related causes of action under Puerto Rico law, as well as a federal claim under the Stored Communications Act (SCA). She also alleged harms including mitigation costs, risk of future identity theft, and diminished value of her personal data.

Amendments to complaint. After multiple amendments to the complaint, the plaintiff added allegations that she discovered a fraudulent cellphone account after receiving the breach notification and incurred approximately $800 in costs to repair her credit. The district court dismissed the claims, finding that the plaintiff failed to establish Article III standing and that jurisdiction was lacking.

Appeal. On appeal, the court focused its analysis on Article III standing, specifically the elements of injury in fact and traceability. It agreed that the complaint sufficiently alleged an injury in fact, noting that “actual misuse of PII” can constitute a concrete injury and that the alleged fraudulent account and related mitigation costs met that requirement at the pleading stage.

However, the court held that the plaintiff failed to plausibly allege that her injury was fairly traceable to the data breach. The court emphasized that traceability requires a causal connection between the defendant’s conduct and the alleged harm, even if it does not demand proximate cause.

Temporal connection. In assessing traceability, the court compared the plaintiff’s allegations to those in prior data breach cases where standing was found. It highlighted several deficiencies. First, the complaint did not establish a temporal connection between the 2019 breach and the fraudulent cellphone account, noting that the plaintiff neither alleged when the account was opened nor provided facts supporting a close temporal link. The record suggested a potential gap of several years, which undermined any inference of causation.

Precautions to safeguard personal information. Second, the court found the complaint lacked allegations showing that the plaintiff had taken precautions to safeguard her personal information, which in other cases had supported an inference that the data breach was the likely source of misuse. By contrast, the plaintiff relied only on the medical center’s assurances regarding data security, which the court found insufficient to establish traceability.

Missing allegation. Third, and “most critically,” the court determined that the plaintiff failed to allege that the type of information needed to open the fraudulent cellphone account matched the information maintained by the medical center or exposed in the breach. This omission echoed the district court’s earlier conclusion that the plaintiff had not alleged that the data required to commit the identity theft corresponded to the data at issue in the breach.

The court rejected the plaintiff’s assertion that cybercriminals commonly use PII for phone-related fraud, characterizing it as a conclusory allegation that did not identify what specific data was used or whether it originated from the breach. It also declined to credit the plaintiff’s argument, raised in briefing, that the information required to open a cellphone account was the same as that provided to the medical center, describing it as an unsupported assertion not pleaded in the complaint.

Taken together, these deficiencies led the court to conclude that the alleged injury could just as plausibly have resulted from “the independent action of some third party not before the court,” rather than the data breach itself. Because the complaint did not support a reasonable inference of a causal connection, the traceability requirement was not satisfied.

The case is No. 24-2018.

Judge: Montecalvo, L.

Attorneys: Thiago Coelho (Wilshire Law Firm PLC) for Betzaida Santos-Pagan and Minerva M. Hernandez-Umpierre. Michael C. McCall (The Law Offices of Michael Craig McCall) for Bayamon Medical Center.

Companies: Bayamon Medical Center

Cases: CaseDecisions FederalLegislation CMSNews EHRNews GCNNews GeneralNews HITNews CyberPrivacyFeed DataSecurity DataBreach DataPrivacy