Key Points

  • The First District held that patients whose data was exposed in a 2023 breach of a Cook County Health transcription vendor lacked standing because neither alleged actual or attempted misuse of the data.
  • The court treated traceable attempted misuse as the determinative factor under the Olson test, outweighing the targeted nature of the attack and the sensitivity of the data.
  • Martin's increased-spam allegation was conclusory and not fairly traceable to the breach because she did not allege that the spam used or concerned the exposed data.
  • Mitigation costs cannot confer standing absent an imminent and substantial injury, and diminished value of personal information is not a cognizable injury because Illinois courts have not recognized a property right in personal information.
  • The overpayment theory was forfeited on appeal, and the court affirmed dismissal with prejudice without remanding for amendment because plaintiffs did not request it.

An Illinois appeals court on Oct. 23 upheld the dismissal of a proposed class action by Cook County Health patients whose medical and personal information was taken in a 2023 hack of the hospital system's transcription vendor. The court held that the patients lacked standing to sue because they did not allege that anyone had tried to use the stolen data to commit fraud.

A three-judge panel of the Appellate Court of Illinois, First District, affirmed Cook County Circuit Judge Caroline K. Moreland's dismissal with prejudice of the suit brought by Terry Kimber and Veronica Martin against Cook County Health and Hospitals System and Perry Johnson & Associates Inc., the vendor. Justice Pucinski wrote the opinion, and Justices Hyman and Evans joined it.

The decision makes attempted fraud the deciding question when Illinois courts weigh whether a data-breach victim can sue over a risk of future harm. Surveying four earlier Illinois rulings, the panel concluded that each court had found standing only where some plaintiff alleged misuse traceable to the breach. The panel rejected the patients' argument that the deliberate nature of the hack was enough on its own.

An unauthorized third party accessed Perry Johnson files holding the private information of 1.2 million Cook County Health patients between about March 27 and May 2, 2023. The files included names, dates of birth, addresses, medical record numbers and medical information, and the Social Security numbers of about 2,600 people. The hospital system notified patients by letter on Nov. 2, 2023, and Kimber sued five days later.

The consolidated complaint asserted negligence, implied-contract and other claims, including violations of the state Consumer Fraud and Deceptive Business Practices Act. The patients claimed an imminent risk of identity theft, lost value of their personal data, time and money spent guarding against fraud, and overpayment for care that lacked adequate data security. Martin also alleged an increase in spam calls, texts and e-mails after the breach. Judge Moreland found those harms "speculative and conclusory, not imminent and substantial."

Standing is the requirement that a plaintiff have a real stake in a dispute. In Illinois it calls for an injury that is "distinct and palpable," "fairly traceable" to the defendant and likely to be redressed by the relief sought. A threatened injury can qualify if it is imminent, but the Illinois Supreme Court held in Petta v. Christie Business Holdings Co., a 2025 decision, that an "increased risk" of identity theft is insufficient.

Pucinski applied a three-part test from an earlier First District decision, Olson v. Ferrara Candy Co. That test asks whether the attack targeted the data, whether any of the data has already been misused, and whether the information is sensitive. "Illinois courts treat the second factor as determinative," she wrote. The plaintiffs in Olson and in Flores v. Aon Corp. had standing because some of them alleged fraudulent charges, while the plaintiffs in Petta and in Maglio v. Advocate Health & Hospitals Corp. alleged none.

"We take the presence or absence of attempted fraud to be the critical factor," Pucinski wrote. Kimber and Martin pleaded no attempted fraud, so the case followed Maglio and Petta.

The patients had argued that the hack was a targeted theft of valuable data, unlike Maglio, where thieves stole four office computers, and Petta, where an intruder was trying to intercept a financial transaction. The panel agreed that the data was sensitive and that the patients faced a higher risk of identity theft, but it held that the risk fell short of an imminent injury. "We are skeptical of the imminence of an injury that requires us to rely on speculation about an unknown third party's intent or motivations," Pucinski wrote.

The court also rejected Martin's spam claim as conclusory and untraceable to the breach. Martin did not allege that her phone number or e-mail address was exposed in the breach, or that the spam mentioned her health information or either defendant. Her original complaint had described that contact data as "unregulated data available elsewhere." "Because the spam did not use or concern the exposed data, the spam cannot be said to be fairly traceable to the data breach," the opinion said, adding that the spam's timing alone was not enough.

The panel distinguished Flores and Olson, where courts had also found standing for plaintiffs alleging only spam. In each of those cases, it said, at least one other plaintiff had alleged a specific misuse of nonpublic information exposed in the breach.

The court also held that "efforts to mitigate a future injury will not confer standing unless the prospective injury is imminent and substantial." On lost data value, Pucinski wrote that "personal information has not been recognized as a property right in Illinois courts." She contrasted the Biometric Information Privacy Act and the Genetic Information Privacy Act, under which the General Assembly created special standing rules, with the Personal Information Protection Act, which governs the data in this case and lacks such rules.

"The General Assembly has carved out special standing rules for other types of informational injuries but has not done so for the underlying data in this case," Pucinski wrote. Accepting the diminished-value theory, she added, "would create a rule that any data breach exposing similar PII/PHI would be per se actionable," referring to personally identifying and health information.

The court held that the patients forfeited the overpayment theory by failing to argue it on appeal. The ruling on future risk also disposed of their requests for injunctive and declaratory relief over the defendants' current data practices.

Lawyers for the patients included Ben Barnow of Barnow and Associates, P.C. Cook County Health and Hospitals System was represented by Scott L. Schmookler of Gordon Rees Scully Mansukhani, acting as a special assistant state's attorney.

The dismissal with prejudice stands. The panel declined to send the case back for an amended complaint, noting that the plaintiffs "did not ask that the case be remanded with instructions to allow an amended complaint."