Data Privacy + Cybersecurity team and AI practice chair Linn Freedman said she found it significant that, based on the reported facts, “no data was actually exfiltrated by the threat actor,” in the Massachusetts Lawyers Weekly article, “Data breach class action fails for lack of standing,” published on June 30, 2026. The article focuses on a recent First Circuit decision affirming the dismissal of a class action arising from a 2019 ransomware attack at a Puerto Rico hospital. The court concluded that the plaintiff failed to plausibly connect a fraudulent cellphone account opened in her name to the data breach and therefore lacked standing to pursue her claims. A notable fact in the case was that, according to the hospital’s breach notification, there was no indication that patient information had been exfiltrated or used by the threat actor during the attack.

“It makes a big difference in the analysis if it doesn’t look like they actually stole the [plaintiff’s information],” Linn said. “The chance of fraud is much less if the data just happened to be in the database that they accessed.” Read the article.