breach about the breach at least as early as mid december twenty third teen at the able to make any disclosures about that breach whatsoever until january twenty fourth when the holiday shopping season had passed conveniently now although this appeal raises several issues that are outlined in our opening brief there is a critical central issue that must be addressed and that potentially could result the entire appeal that is does disclosure of consumers payment card data to deeds through data breach that's allowed to occur by virtue of the retailers negligent deficient cyber security measures constitute an injury of fact giving such consumer standing to sue in federal court conclusion arguing that because consumers disclose payment card data to waiters and web sites the world over this data has no work to minimus intrinsic value and really isn't private at all so let me ask a question if it's true that your opponents argue that everybody who suffered fraudulent charges had those payments reimbursed do you c card issuers reimbursed at the one hundred percent level but of course that's not the law in the united states the law is that a consumer is liable for up to fifty dollars from you is whether in addition to these direct losses potentially on reimbursed depending on the card issuer what what's your what's your theory about such consumers and furthermore that those members of the putative class that did not suffer fraudulent charges do have standing by virtue of the threatened harm similar harm that we can see it already has a year's free credit monitoring said true where we're not yet except that there was never any actual notification of three hundred fifty thousand people that were notices sent to according to  bring it you can google this and i know that you know there's monthly charges for such credit monitoring normally in the twenty dollars range this twenty dollars a month or so and there were specific allegations who are to plaintiffs suffering  charges on those or their accounts that's correct your honor and a third who received a notice stating that her account had been compromised it's unclear if there were fraudulent charges executed on  defendant that kelley invokes these policies to essentially exculpated with any liability here those policies are not properly before the court the only evidence to the extent it can be considered evidence about these policies it is defended statement in its disclosure on its website and the ones that it mailed to certain sooners that stating that it's the policies of payment card brands such as these and master card provide that you have zero liability banks like chase right and you know furthermore on this issue of zero liability pop policy and so the proposition that these policies were to actively eliminate consumers costs associated with fraudulent charges and most or all of the time simply is not a proper subject of judicial notice furthermore it's not true many of us have anecdotal stories about this so are there any allegations in a complaint one of the that occurs to me looking at this issue hat you certainly should allege that the not the nine thousand two hundred people have had fraudulent charges right which is actually a fairly large number of people it made me start wondering about subclasses have you allege that anyone in this class already has had his or her identity stolen or it's just our youth is the allegation just prophylactic measures against a risk well your honor there is distinction being drawn and some of these papers between identity theft fraudulent charges exactly right i don't except that you know project charges are a form of identity theft somebody is taking your account making a charge with it purporting to be you and absconding with the money in some one way or another it's illegal and it is a form of identity theft darcey i believe under federal criminal statutes you're right it would be that there are other forms of identity theft one can assume your identity and open up accounts we haven't alleged that here but it is possible and depending on the personally identifying information that was may have  association of the name in a credit card number worse were common were stolen were revealed is very unclear what information has been disclosed that is  believe the main markets doesn't accept use a debit cards where you have to enter a pin but if they have a visa logo they can be used like a credit card it stright right so that's something you should talk about clapper a little bit your opponents relied very heavily on clap per to say that you have no standing because whatever harm occurred to the class isn't sufficiently in the right well clapper states the requirements for article three standing as requiring an injury that is concrete particularized particularized and actual or imminent fairly traceable to the trust challenge action and we just suppose by favorable ruling now that's a quote are out there is actual harm already so you don't really need to go to be through the analysis of whether an increased risk of future harm can provide standard now that analysis for this is your nine to two hundred thousand is it possible that that you just reached too far in terms of the size of the class and what we should do is invite the district court to reconsider that your honor this inquiry as to standing to bring suit under article three is distinct from the inquiry about standing as to pursue a class action on behalf of a given class there were only three inquiry right yet the rule twenty three issue should be addressed at the class or cations stage not the motion to dismiss stage this court has ruled this way and peyton versus county of kane in two thousand and two and including california consumers who have claims under the customer records act and or california is unfair competition law as well as a nationwide class or could be subclasses of people with fraudulent charges or those but i would argue that those whose information has been disclosed as pled in the complaint even if they have separate projects and charges they clearly have a substantial if not certainly impending risk of increased increased money please the court this is a purported consumer class action and such cases are often filed almost immediately after a company announces a cyber attack and they are often dismissed at the rule twelve stage because just because the consumer shops at a store when a cyber attack occurs does not automatically mean that the consumer suffered legally cognized the injury and that is often the basis for the dismissal of rule twelve often understand that's what occurred here in the district court recognizing the fundamental importance of the standing gate keeping functioning and determining whether the plaintiff plaintiffs had met their burden of coming forward with specific allegations and facts to demonstrate that they've met the well established tests applying a test he found going carefully through their various claimed injuries that none of them met the test and kind of a cursory investigation actually i thought by the district court but here's what worries me i mean there there's no doubt that the people that neiman marcus notified had been subject to this data breach had already suffered the data breach so their  identity theft that presumably is why they offered eight years free credit monitoring and even if which i believe is not i don't think this fact is before us even if some people had their their fraudulent charges reimbursed identity theft victims at least according to the bureau of justice statistics spend a lot of money to put monitoring provisions into place that money probably is well spent according to be j s about fourteen percent of identity theft victims experience out of pocket losses of a dollar or more but the average c seventeen one thousand seven hundred sixty nine dollars you know it's a it's a real immediate interest it seems to me i think it is true that if this was a case where there was  an indication of identity theft having occurred no no i'm let's just back up and say this is a case where the person knows thanks to neiman marcus is notification that his or  her credit card information has been compromised and so the person is already right now in a position needing to take some preventive medicine measures to ensure that no greater loss occurs and so why isn't that an imminent loss well i'd say two things your honor first of all the line between a credit card information being compromised and not other sensitive identifying information  not social security numbers or driver's license numbers or things that really logically would allow someone to steal someone's identity if it's just payment card data the courts have made it clear that the line between that payment card data and identity theft is quite a sp well but wait a minute i mean your post and argues that this might mean at the class certification stage not at the standing stage there might be narrowing of the proposed class i mean you have a lot of people actually have had fraudulent charges and in fact federal identity theft statute would include the use of somebodies payment card so but what i'm looking at is the immediate need to spend money to ensure that the compromise of the information doesn't yield of worse damage there's just a huge amount of money spent in the economy each year on precisely that experience offers these things for twenty bucks a month you know you want i think it be i think this record to get it right that that the risk of identity theft here is neither certainly impending no worry even if the substantial risk test is used but there's a substantial risk here and i think and i  think one of the things to look at care why do we even markets offer them the monitoring that well neiman marcus in an abundance of caution not only offered monitoring but the my opponent is wrong they gave a notice to everyone who had shopped at neiman marcus in the store or online for a year even though all the evidence showed that the cyber attack was occurring for about a two or three material in the store so the it is it is do or gerd to and proper to provide this good customer care by saying we'll provide you with free credit monitoring and identity theft insurance of up to one million dollars if you look at the allegations of this complaint it is the plaintiff's birder to come forward with was that specific allegations that show they suffer an injury or something is imminent but there are things that weren't there sixty thousand  suspicious behavior alerts at noon mark has received well sixty thousand alerts were alerts and this is in the record were alerts that something a piece of software was being executed in the temporary directory that's what it said and it is normal for some companies in the i t world to have a software that acts that is executed in the temporal directory so it wasn't an alert it was a notice that this was occurring and it was normal in the neiman marcus system so while there has been one press the allegation is based on the article the article is that of the poll point here is that listen to us talking about these presumed facts you know that this is such an early stage you when i think only if we think that people should should ignore these compromises if their payment card information and potentially more we don't know and that companies like neiman marcus are behaving in an economically irrational way to offer a million dollars worth of credit insurance it seems to me that's evidence itself in the record that there's something right now that's a problem which would take you out of clapper clapper of course is a case that has five layers of hypotheticals before you get to the phone call your phone call to your friend in england being overheard by the n s a here we have an a at that that's already occurred or a compromise it's already occurred and earn a concrete amount of money necessary to fix the exposure i'm not trying to agree with the concrete amount of money and i think one thing that i would ask the court to do with a very carefully at ho the allegations are in this complaint we it is not our position that there is no data breach case whether it involves payment card data or more sensitive data that would not lead to moving beyond twelve but if you look at this complaint there are no specific allegations of what cost the plaintiffs have suffered of what the why they would believe that payment card data being potentially compromised and the district court drew very liberal inferences in their favor in finding that it was either actual or imminent regarding the charges but then determined that that that was not concrete and to say that any that every cyber attack where payment cards are potentially compromise would lead to consumers being able to come into court and allege with the specter of identity theft that therefore were they have and imminent risk is really contrary to what we believe is a proper understanding of both clapper and this longstanding test about how to understand imminence when i do that but you know what i'm still trying to think about is whether what you're describing is a situation that should be addressed either  certification stage or the merits of state or whether what you're really describing is something properly understood as standing and the very first start is just this isn't clapper whether it's some other case where there is account they complained of these are these are credits and that the seven hundred fifty dollars you think that's an instantaneous transaction i can tell you it according to my personal experience but never mind that you know statistics it isn't you know it can take hours of time it can take weeks to call and be put on hold and find your way through computer menus and you know i would think that you and your partners in it your l digital decision it is absolutely proper for the defendant to come in and make a factual challenge to standing and that allows for other evidence to be brought in extrinsic evidence to be brought in for the district court to examine it because standing needs to be determined at each stage of the proceeding so examining at evidence that neiman marcus brought in outside of the four corners of the complaints proper but was it really competent evidence you just saying we are we are tte take our word for it all these other people reimburse at one hundred percent when in fact you will take debit cards if there is no hand debit cards fall under the i think they fall into the electronic funds transfer act and you could actually be liable for everything in your account it's not they don't work like credit cards credit cards could still leave you fifty dollars in the hole depending on who the issuer is and what its policies are it seems to me they're just fact issue on fact issue here that we're not properly  up either by your presentation or anywhere else well with respect to the plaintiffs here this complaint doesn't allege any of those things it doesn't argue any of those things it doesn't argue that there was a potential  asking for a fact pleading of a really extraordinary level beyond one billion scrubbed i don't think that's right with regard to standing with regard to standing it is the plaintiffs burden at this stage to allow the court to feel satisfied that there is a case or controversy and what that's that's the problem is it's a judgment call and what judge would have been outlining and is assumed to fall on the side of your opponents rather than your side in other words you've got the fact that names addresses phone numbers driver's license and all that information was disclosed by this mauer well first of all that's the allegation that well they mentioned so security numbers and driver's license numbers without any reason to say that and we put in an apex digital allows this we put in competent evidence including sworn testimony from even marcus the chief information officer before the senate judiciary committee that explained the scope involve social security numbers or driver's license numbers and even marcus did disclose way beyond the people who potentially were compromised this ninety two hundred as the district court found is not people who we know had their damages when they come to to that stage but it seems to me at that at this stage on sir on the standing issue it's a less that there's less demand certainly there's a difference between damages to the marriage stage but it is their burden to establish through either allegations or when we put facts in the record facts that contradict ours that there is an injury and if the injury has not occurred they need to show that it is imminent an of providing incentives to companies certainly companies should not be penalized for poor prices and have a little bit that's a knowledge in the fact that there is something out there well they did acknowledge that look we had this malware that was in our system this number of our customers had their credit cards use and were visible to the malware and to make we did to make everything as convenient as possible for our customers we are offering this service that should to hold that against them as an indication that the to say that means that automatically was an injury i think it actually actually it's fun just to fall in the broader line of cases though where you think you can medical monitoring cases and so forth there's a whole line of cases where you have suffered the injury up front by the exposure so to speak you know whether it's exposure to his investors or whether it's exposure to malware whether it's exposure or something else and that's understood to be in so far as it exists imminent you're done right now it's not tomorrow's problem i think is if it was the riley course in the court in the third circuit that addressed this that said once that exposure has happened there is an immediate physical injury to your body it changes even if it's never contaminated where i say that the risk of the contamination immediately injures their crops lowers the value because of the perception so they have to spend money that is very different in the situation here ok thank you i want to wrap up ok fine thank you very much anything are the details of our allegations i mean i think they're pretty detailed this is not a rule nine case this is a case of the rule a and if you look at the allegations around paragraph forty five to fifty six in the first a minute complaint we allege time that these plaintiffs were deprived of the use of their herd access to their cards we describe in some detail the steps that for instance plaintiff frank had to go through we did not necessarily quantify that mail to time spent but there certainly was time spent we i suppose could amend to include such detail but the district court terminated our case and i don't want to bound mr hofmann's point that once standing is put it in a shoe it was up to you to come forth with factual details to support your position well the district court didn't rely on any of the facts in this declaration that day he actually says he's not relying on them doesn't think i believe that's right yeah certainly doesn't try and and the evidence that was submitted  this are largely self serving statements i would say by the defendant what we do allege that these plaintiffs received several of them received the individual notices in the mail from defendant concerning the breach indicating that they were part of this breach they made purchases even within the limited time frame of the defendant in minutes the malware was collecting data from its system and as a side note we do not accept the defendant's position there because it seems very strange that the malware just stopped collecting data in october and in between october and january when they say they finally disabled it but even accepting that limited time frame we have plaintiffs we allege that they made purchases in paragraph six in the time frame that defended missed the malware was collecting data and i'd just like  take to persuade say the district court in this case that standing exists it presents a very high bar to such cases and creates the person sent of or retailers to employ the cheapest c i cyber california they did not provide adequate notice and we have standing on that basis as well thank you all right thanks very much thanks to both count