Jessica v. Ohio Dept. of Job & Family Servs.

Citations

• 2025 Ohio 2604

Syllabus

Judgment reversed. The trial court erred by granting Ohio Department of Job and Family Services (\ODJFS\)'s Civ.R. 12(B)(6) motion to dismiss for lack of standing. The plaintiff filed a class action against ODJFS alleging claims for negligence, breach of implied contract, breach of fiduciary duty, and invasion of privacy following a data breach at Ohio's unemployment compensation system. Relying on persuasive federal authority, we found the plaintiff's risk of identity theft or fraud resulting from the data breach to be an injury-in-fact. The risk of identity theft or fraud was a concrete injury because it bore a close relationship to a common law claim for invasion of privacy. The risk of identity theft or fraud was imminent because: (1) the plaintiff alleged the cybercriminals targeted, obtained, and stole her and the class members' personal information from ODJFS's system; (2) the cybercriminals misused the class members' data to defraud ODJFS out of $189,184.62 and allegedly posted the class members' personal information for sale on the dark web; and (3) the stolen data included plaintiff's name, address, and social security number which made it more likely the plaintiff would be subject to identity theft or fraud in the future. The plaintiff also alleged facts demonstrating her lost time, mitigation expenses, and emotional distress resulting from the data breach were concrete, present injuries. Because the plaintiff alleged her injuries were fairly traceable to ODJFS's inadequate security measures and redressable through monetary damages, the plaintiff had standing to pursue her claims against ODJFS.