On October 9, the U.S. District Court for the District of South Carolina dismissed without prejudice a consolidated complaint brought by seven members of a credit union whose personal information was compromised in a 2024 data breach. The court held that the plaintiffs lacked standing due to a failure to allege injuries traceable to the credit union’s conduct.

The court noted that while three of the seven plaintiffs alleged injury in fact due to fraudulent charges to their bank accounts or credit cards, the complaint did not plausibly allege those injuries were traceable to the defendant’s conduct because the plaintiffs failed to plausibly connect the information compromised in the data breach to the fraudulent charges.

Ultimately, the court granted the credit union’s motion to dismiss, finding none of the plaintiffs had standing to pursue money damages or injunctive relief based on the current pleadings. However, the court allowed the plaintiffs 30 days to amend their complaint to address purported traceability defects.