Labor & Employment Law Daily Wrap Up, PRIVACY, COMPUTER FRAUD—Wis. Ct. App.: Failure to allege actual harm dooms employees’ class action over data breach, (Nov 20, 2025)

By Marjorie Johnson, J.D.

The employees did not allege that the breach of their sensitive information during a ransomware attack resulted in any instances of identity theft, fraud, or any other misuse of the data.

A group of employees failed to convince an appeals court to revive their class action lawsuit alleging multiple contract and tort claims against their employer following a ransomware attack on the company’s computer system that resulted in their personally identifiable information and/or health information being accessed and/or acquired by an unauthorized third party or parties. Affirming dismissal of their claims in an unpublished opinion, the court concluded they lacked standing to assert any of their claims against the employer because, in light of the Supreme Court’s TransUnion LLC v. Ramirez decision, the mere possibility of future identity theft is not sufficiently imminent (Bauer v. Fincantieri Marine Group, LLC, No. 2024AP1882 (Wis. Ct. App. Nov. 18, 2025, unpublished)).

Cyberattack. In April 2023, the employer discovered a cyberattack on its computer systems, and it determined that its current and former employees’ sensitive information may have been viewed or collected by unauthorized third parties. The company notified the affected individuals of the data breach on January 5, 2024, explaining that the personal information impacted in the data breach included names, dates of birth, Social Security numbers, diagnosis information, health insurance information, full face pictures, and medical account numbers.

The notice advised that the company had “immediately secured our environment, investigated to determine the nature and scope of the incident, and notified law enforcement” and also that it “implemented additional technical safeguards to help prevent a similar incident in the future.” The employer also offered impacted individuals access to complimentary credit monitoring and identity protection services.

Lawsuit. Several affected employees filed this class action lawsuit alleging myriad tort and contractual claims. In particular, they asserted that, as a result of the employer’s failure to properly secure and safeguard sensitive and confidential personally identifiable information, they faced “ongoing,” “imminent,” and “impending” threats of identity theft crimes, fraud, scams, and other misuses of their personal information. Significantly, however, none of the employees alleged that any identity theft or data misuse had actually occurred.

Claims dismissed. The trial court granted the employer’s motion to dismiss in full. First, the court found that they lacked standing to bring their negligence claim, squarely rejecting their contention that the threat of future identity theft alone is sufficient to establish standing. Rather, they needed to allege that some identity theft or misuse of protected information had actually already occurred such that future, related harms (like those alleged here) were sufficiently imminent. The court dismissed the remaining claims on other grounds.

No standing. The appeals court affirmed, concluding first that the trial court appropriately determined that the employees lacked standing to bring their negligence claim because they had not alleged any injury—apart from the risk of future harm—as a result of the data breach. The appeals court further concluded that this lack of standing doomed all of the employees’ claims, which included breach of contract, breach of implied contract, breach of fiduciary duty, breach of the implied covenant of good faith and fair dealing, unjust enrichment, breach of a third-party beneficiary contract, and for declaratory and injunctive relief. “Based on our review of the relevant legal authority, we conclude that the threat of future identity theft or fraud, on its own, is insufficient to establish standing for any claim in this case.”

Must allege actual harm. Significantly, this case was distinguishable from other Wisconsin law cases upon which the employees relied because, unlike those cases, the employees did not allege that anyone had fallen victim to identity theft, fraud, or any other type of digital scam. For example, they did not claim to have been subjected to phishing emails, spam phone calls, or blackmail, or that any of the stolen information was found on the “dark web.” Rather, they merely allege an “increased risk” of these things happening, emphasized the appeals court, which was insufficient to confer standing.

They similarly failed to convince the court that certain federal cases supported their contention that the risk of future identity theft is sufficient to establish standing. Notable, in all of those cases, at least one plaintiff alleged an actual misuse of data, which made the risk of future harm sufficiently imminent and concrete. Thus, none of those cases involved the issue presented here: “whether the plaintiffs had standing absent any demonstrated identity theft.”

Supreme Court’s TransUnion decision. Furthermore, the federal cases upon which the employees relied predated the U.S. Supreme Court’s decision in TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), which involved a claim that a credit reporting agency failed to use reasonable procedures to ensure the accuracy of their credit files in violation of the Fair Credit and Reporting Act and that some of the misleading credit reports were disclosed to third parties. The Court determined that the plaintiffs whose reports were not disclosed did not suffer a concrete harm, even though they faced a risk of future disclosure. This risk of future harm, standing alone, could not constitute an injury-in-fact for Article III purposes in a lawsuit seeking damages, concluded the Court. Significantly, subsequent cases in the Seventh Circuit that have applied TransUnion to data breach claims have emphasized the need for allegations of actual data misuse to establish standing.

Speculative harm insufficient. In light of the relevant and controlling caselaw, the appeals court concluded that the risk of future harm and the actions taken to protect against that risk, as alleged here, were too speculative to confer standing to pursue their claims, absent a demonstration that identity theft or data misuse had already occurred. Without allegations of any previous identity theft or data misuse suffered by themselves or any other members of the class, they failed to allege sufficiently imminent or certainly impending future injury and instead established only a “mere possibility of future harm.”

Injunctive relief considerations. Further discussing the employees’ bid for injunctive relief, the court reiterated that even if the employer was negligent by failing to adequately protect their data, they failed to plausibly allege that they faced an imminent risk of future harm as a result of the data breach. Moreover, they failed to explain how requiring the employer to implement new data security practices would protect against the future risk of the data that was already subject to the data breach being misused. Their particular allegations also did not suggest that the employer was subject to a different or an increased risk of a cyberattack as compared to other organizations.

The case is No. 2024AP1882.

Judge: Stark, L.

Attorneys: Andrew J. Schwaba (Schwaba Law Firm) for Michael Bauer. John A. Haase (Godfrey & Kahn) for Fincantieri Marine Group, LLC. Erik J. Pless (One Law Group) for Starr Insurance Holdings.

Companies: Fincantieri Marine Group, LLC; Starr Insurance Holdings

Cases: ComputerFraudPrivacy ClassActions ContractClaims RemediesDamages TortClaims StateLawClaims WisconsinNews