Can You Sue for Identity Theft?
You may be able to bring a civil lawsuit after identity theft, but identity theft by itself does not establish a claim against every company that previously possessed your personal information.
A potential lawsuit often depends on how the identity thief obtained the information, whether another organization failed to protect it or violated an applicable law, whether that conduct can be connected to the identity theft, and what harm resulted.
Those questions become particularly important when identity theft follows a data breach, unauthorized account access, or another incident involving sensitive personal information.
Net Law Advocates represents plaintiffs nationwide in identity theft, data breach, cyber, and privacy matters. We evaluate the events that led to the identity theft, the organizations that possessed the information, the resulting harm, and the laws that may apply.
Who Can Be Sued After Identity Theft?
The person who steals or uses another person’s identity is one potential wrongdoer.
In many situations, however, victims do not know who committed the underlying fraud. The identity thief may be anonymous, overseas, or otherwise difficult to identify.
A separate legal question is whether an organization that possessed or handled the victim’s personal information may bear civil responsibility.
Depending on the circumstances, potential defendants could include an organization that experienced a data breach, a vendor that processed the information, a financial institution, a consumer reporting agency, or another entity whose conduct allegedly contributed to the harm.
The existence of a relationship with the victim does not automatically create liability.
The evidence and applicable law determine whether a claim exists.
What Must Be Established in an Identity Theft Lawsuit?
There is no single federal “identity theft lawsuit” that applies to every victim and every situation.
Potential claims vary based on the defendant, conduct, jurisdiction, information involved, and harm suffered.
Several issues commonly matter.
A Legal Duty or Violation
A plaintiff generally needs a legally recognized basis for holding the defendant responsible.
Depending on the circumstances, potential claims may involve negligence, consumer-protection statutes, privacy laws, contract-related theories, credit-reporting requirements, or other state or federal law.
The fact that a company experienced a breach does not automatically establish negligence.
Likewise, a statutory violation does not automatically mean every affected person can recover damages.
Causation
The plaintiff may need to connect the defendant’s conduct to the identity theft and resulting harm.
This can be one of the most important issues in a data breach case.
A person may have had the same Social Security number, email address, payment information, or other data exposed through multiple sources over time.
An attorney may therefore examine what information the defendant possessed, what was compromised, what information the thief actually used, and the timing of the events.
Injury and Harm
The nature of the plaintiff’s injury can affect both standing and damages.
Actual fraudulent accounts, unauthorized transactions, tax identity theft, credit problems, or other documented misuse can present different legal circumstances from a breach in which information was exposed but never used.
Available Remedy
Even when unlawful conduct occurred, the law must provide a remedy available to the plaintiff.
Some statutes permit private lawsuits. Others are enforced primarily or exclusively by government agencies.
Available damages and other relief also vary.
Does Actual Identity Theft Matter to Legal Standing?
It can.
Plaintiffs bringing claims in federal court must satisfy Article III standing requirements.
The Supreme Court has explained that a plaintiff seeking damages must demonstrate concrete harm and that a statutory violation by itself does not automatically satisfy Article III. In TransUnion LLC v. Ramirez, the Court emphasized that plaintiffs must have been concretely harmed by the alleged violation to seek damages in federal court.
The Court also distinguished concrete harm from a risk of future harm standing alone.
Actual identity theft may provide evidence of concrete injury that does not exist in a case based only on possible future misuse.
Standing remains dependent on the particular claims and injuries alleged, and state courts may operate under different standing rules.
Do You Need to Lose Money to Bring an Identity Theft Claim?
Not necessarily, but the answer depends on the claim and jurisdiction.
Direct financial loss is one of the clearest forms of harm, but identity theft can create other consequences.
A victim may experience fraudulent debt, damaged credit, tax problems, inaccurate medical records, account loss, collection activity, or other injuries.
Some statutes may provide statutory damages when their specific requirements are satisfied.
Courts also distinguish between actual harm and a risk that harm may occur in the future. The availability of damages for time, mitigation expenses, emotional distress, future risk, and other claimed injuries can depend heavily on applicable law and the facts.
A bank’s reimbursement of a fraudulent charge therefore does not necessarily answer every question about whether legally recognized harm remains.
Identity Theft After a Data Breach
A significant category of potential identity theft litigation begins with a data breach.
Suppose a company maintains customers’ names, Social Security numbers, and dates of birth. Those records are acquired during a cybersecurity incident. A customer later discovers a fraudulent account opened using the same identifiers.
Those facts may support investigation into whether the breach and fraud are connected.
But sequence alone does not establish causation.
Our discussion of identity theft after a data breach addresses how the information exposed, timing, method of misuse, and other possible sources can affect that analysis.
What Types of Identity Theft May Support Legal Claims?
Identity theft can take several forms, and the evidence and potential defendants can differ considerably.
Financial Identity Theft
Financial identity theft can involve fraudulent loans, credit accounts, financing, or other financial activity established under another person’s identity.
Relevant evidence may include credit reports, applications, collection notices, account-opening records, and breach notifications.
Social Security Identity Theft
A stolen Social Security number can potentially be used across several systems.
Social Security identity theft may involve financial accounts, employment, taxes, benefits, or other fraudulent activity.
Account Takeover
An account takeover may involve stolen credentials, phishing, credential stuffing, compromised email, or weaknesses in authentication and recovery processes.
Determining how access occurred can be critical to identifying whether another organization may bear responsibility.
Medical Identity Theft
Medical identity theft can create distinct injuries involving insurance benefits, medical bills, prescriptions, or inaccurate healthcare records.
Tax and Employment Identity Theft
Misuse of an SSN may appear in tax or wage-reporting systems.
Tax identity theft and employment identity theft involve different conduct even though both may create IRS-related records.
What Evidence Can Help an Identity Theft Lawsuit?
Documentation can be particularly important when the legal claim depends on connecting a security incident to later fraud.
Useful evidence can include:
- Data breach notification letters
- Credit reports
- Fraudulent account applications
- Bank and credit-card statements
- Unauthorized transaction records
- Collection notices
- IRS correspondence
- Social Security earnings records
- Medical or insurance records
- Login and security alerts
- Password-reset notifications
- FTC Identity Theft Reports
- Communications with companies investigating the fraud
- Records of financial losses and expenses
- Documents showing credit denials or other consequences
The Federal Trade Commission’s IdentityTheft.gov service allows victims to report identity theft and create an Identity Theft Report and personalized recovery plan.
Preserving these records can serve both recovery and potential litigation.
What Rights Do Identity Theft Victims Have Under the FCRA?
Identity theft can create inaccurate information on consumer credit reports.
The Fair Credit Reporting Act provides specific rights concerning information resulting from identity theft.
Under 15 U.S.C. ยง 1681c-2, a consumer reporting agency generally must block information identified as resulting from alleged identity theft within four business days after receiving specified documentation, including appropriate proof of identity, an identity theft report, identification of the fraudulent information, and the consumer’s statement that the information does not relate to a transaction by the consumer.
The Consumer Financial Protection Bureau likewise explains that identity-theft victims can request that fraudulent information be blocked from their consumer reports using an identity theft report and supporting documentation.
FCRA claims have their own requirements and should not be assumed merely because identity theft occurred.
Can You Sue the Company That Was Hacked?
Potentially, but a hack does not automatically make the company legally liable.
The investigation may consider whether the organization failed to use legally required or reasonable safeguards, violated an applicable privacy or consumer-protection law, breached contractual obligations, failed to comply with duties concerning personal information, or engaged in other actionable conduct.
The standard can depend on the jurisdiction and the nature of the organization.
Healthcare providers, financial institutions, employers, retailers, technology companies, and other organizations may operate under different legal frameworks.
Some cybersecurity and privacy regulations are enforced by government agencies and do not independently give individuals a private right to sue.
An attorney must identify an actual legal claim available to the affected person rather than assuming that every security requirement creates a private lawsuit.
What If a Vendor Was Hacked Instead?
Third-party vendors frequently maintain personal information on behalf of other organizations.
A payroll company may process employee data. A healthcare vendor may maintain patient information. A cloud provider may host customer records.
When the vendor experiences the security incident, determining potential responsibility can require examining both the vendor and the organization that entrusted it with the information.
The answer depends on their respective conduct, contracts, legal duties, security practices, and the law governing the claim.
A vendor’s involvement can complicate the case, but it does not prevent a potential lawsuit when the evidence supports one.
Can Identity Theft Claims Be Brought as a Class Action?
Sometimes.
A breach affecting many individuals can lead to litigation seeking class treatment when the requirements of Rule 23 or applicable state procedures are satisfied.
But the existence of a large breach does not automatically mean the case will be certified as a class action.
Questions concerning common issues, individual injuries, causation, damages, and applicable law can affect whether class treatment is appropriate.
Our data breach class action resource explains those procedural issues in greater detail.
Some circumstances may instead support individual claims or other forms of coordinated litigation.
What Compensation May Be Available?
Potential compensation depends on the legal claims and provable harm.
Depending on the circumstances and applicable law, claimed damages might involve:
- Unreimbursed financial losses
- Fraudulent debt
- Credit-related harm
- Costs incurred responding to identity theft
- Lost time where legally compensable
- Emotional distress where legally recoverable
- Other consequential damages
- Statutory damages under laws that provide them
Not every category is recoverable in every case.
The applicable statute or cause of action determines what damages may be pursued, and the plaintiff must satisfy the requirements for that relief.
Does Reimbursement by a Bank End a Potential Case?
Not necessarily.
Reimbursement can eliminate or reduce one category of financial loss, but identity theft may produce consequences beyond the particular fraudulent transaction.
For example, a victim may also experience fraudulent accounts, credit problems, tax issues, repeated account compromise, or other identity misuse.
At the same time, reimbursement can affect the damages analysis.
A plaintiff generally should not assume that a refunded transaction either eliminates every possible claim or guarantees that some other compensable injury remains.
The complete consequences need to be evaluated.
How Long Do You Have to File an Identity Theft Lawsuit?
There is no single deadline applicable to every identity theft case.
Statutes of limitation depend on the claims, jurisdiction, defendant, and sometimes when the plaintiff discovered or reasonably should have discovered the relevant facts.
Some statutes contain their own limitations periods.
Because different claims can have different deadlines, a person considering legal action should not assume that the time spent resolving the underlying identity theft automatically extends the deadline to sue.
What Does an Attorney Evaluate?
An identity theft lawsuit generally requires reconstructing a sequence of events.
An attorney may examine:
- What personal information the relevant organization possessed.
- How and when that information was compromised.
- What information the identity thief later used.
- Whether the breach and misuse can reasonably be connected.
- What security or privacy duties applied.
- What injuries the victim actually experienced.
- Which state or federal laws may provide a claim.
- Which parties may bear legal responsibility.
- What evidence supports the damages being claimed.
- Whether the claim is timely.
The purpose is to separate a legally supportable case from the understandable assumption that someone must be liable simply because identity theft occurred.
When May an Identity Theft Lawsuit Be Worth Evaluating?
Attorney review may be particularly appropriate when there is documented identity misuse together with evidence connecting that misuse to a known breach or security failure.
Relevant facts can include actual fraudulent accounts, tax or employment identity theft, significant financial losses, damaged credit, repeated account compromise, medical identity theft, or other documented consequences.
A breach involving the exact identifiers later used in the fraud may also warrant closer examination.
None of those facts guarantees a lawsuit will succeed. They can, however, provide a stronger factual basis for investigating legal responsibility.
Speak With Net Law Advocates About an Identity Theft Lawsuit
Identity theft can involve several parties, multiple sources of compromised information, and different state and federal laws. Determining whether a lawsuit is available requires more than identifying the fraud. The source of the information, the defendant’s conduct, causation, injury, and applicable law all matter.
Net Law Advocates represents plaintiffs nationwide in identity theft, data breach, cyber, and privacy matters. If your identity was stolen and you believe a company, organization, or data-security failure contributed to the harm, contact Net Law Advocates at 888-913-2318 for a free, confidential consultation.