The ABA Litigation Section reports that the U.S. Court of Appeals for the Fourth Circuit in Holmes v. Elephant Insurance Co. held that plaintiffs alleging a data breach affecting approximately three million individuals must demonstrate concrete, particularized injury to establish legal standing. The court rejected claims based on mere exposure to risk or time spent monitoring accounts, but found standing for two plaintiffs whose drivers' license numbers appeared for sale on the dark web. The Fourth Circuit's decision creates a split with five other circuit courts on the injury threshold required for data breach standing.