7th Circuit Court Restores P.F. Chang’s Data Breach Class Action

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

The Seventh Circuit Court revived a previously-dismissed proposed class action lawsuit against P.F. Chang’s China Bistro Inc. that was filed over the restaurant’s data breach. The decision was a reversal of the lower court’s ruling that the customers could not pursue data breach claims due to lack of standing.

The Seventh Circuit’s appellate panel determined that “It is plausible to infer a substantial risk of harm from the data breach, because a primary incentive for hackers is ‘sooner or later to make fraudulent charges or to assume those consumers’ identities[.]’”

The panel decided that plaintiffs Lucas Kosner and John Lewert sufficiently alleged facts to support standing based on their stated injuries in the claim. Kosner alleged that he actually had fraudulent transactions attempted with his card and Lewert claimed to have spent money, as well as time and effort, into monitoring his financial information to protect himself against fraudulent charges and identity theft.

In its appeal decision, the Seventh Circuit Court referenced a precedential ruling from last July in the Remijas, et al. v. The Neiman Marcus Group LLC class action lawsuit. The appellate court panel ruled that customers who had credit card information stolen in the Neiman Marcus data breach had standing to sue the company not only as a result of fraudulent charges, but also for preventing fraud with credit monitoring purchases.

In their class action lawsuit against P.F. Chang’s, Kosner and Lewert referred to the same kind of injuries that the Neiman Marcus case referred to, namely future increased risk of fraudulent charges and identity theft, the appellate panel stated.

The panel went on to state that the allegations that Lewert and Kosner alleged were plausible, and made note that P.F. Chang’s initial statement following the breach indicated that it was unsure how many of the restaurants were affected.

Later, P.F. Chang’s announced that an analysis led to the conclusion that only 33 of its restaurants were affected, and the panel said that the company will have the opportunity to provide further evidence to explain how the breach actually occurred and which restaurants were determined to be affected.

The panel also noted that it has not been determined if the breach affected more locations that P.F. Chang’s has suggested or if each restaurant holds its data behind a separate firewall.

“When the data system for an entire corporation with locations across the country experiences a data breach and the corporation reacts as if that breach could affect all of its locations, it is certainly plausible that all of its locations were in fact affected,” the panel stated.

The two plaintiffs filed separate lawsuits in June 2014 that were later consolidated. The lawsuits were dismissed in December 2014 with the judge ruling that both plaintiffs failed to allege any actual harm, and that their speculation about future harm possibly occurring did not qualify as actual injury.

Following the panel’s decision, the proposed class action lawsuit against P.F. Chang’s has been remanded to the lower court to continue proceedings.

The customers are represented by Joseph J. Siprut of Siprut PC, Katrina Carroll and Kyle A. Shamberg of Lite DePalma Greenberg LLC, and Richard R. Gordon of Gordon Law Offices Ltd.

The P.F. Chang’s Data Breach Class Action Lawsuit is John Lewert and Lucas Kosner v. P.F. Chang’s China Bistro Inc., Case No. 14-3700, in the U.S. Court of Appeals for the Seventh Circuit.

UPDATE: On Jan. 25, 2017, Lewert and Kosner asked the court to deny P.F. Chang’s motion to dismiss the data breach class action lawsuit. The plaintiffs allege P.F. Chang’s failed to respond to its requests for discovery.