The Michael J. Bilandic Building, Chicago, home of the Illinois First District Appellate Court
CHICAGO — A state appeals panel has agreed with shelving a data breach lawsuit facing the Cook County Health and Hospitals System because judges said the plaintiffs haven’t adequately defined how they were actually harmed.
Terry Kimber and Veronica Martin sued the agency and medical transcription firm Perry Johnson & Associates in the wake of an April 2023 PJA data breach, according to court records. They alleged negligence, breaches of fiduciary duty and implied contract, unjust enrichment and Consumer Fraud and Deceptive Business Practices Act violations.
Cook County Circuit Court Chancery Division Judge Caroline Moreland dismissed the complaint, writing the complaint referenced only “speculative and conclusory, not imminent and substantial” harm. Kimber and Martin challenged that ruling before the Illinois First District Appellate Court.
Justice Aurelia Pucinksi wrote the panel’s opinion, filed Oct. 23; Justices Michael Hyman and Timothy Evans concurred.
Pucinski said the consolidated amended complaint includes “a litany of injuries resulting from the data breach,” including risk of identity and medical identity theft, the loss of the market value of their personally identifying health data, privacy violations, overpayment to Cook County Health for services that didn’t include adequate security, and the costs of time and opportunity related to mitigating their consequences. Martin also alleged the breach caused an increase in spam contacts via email, text and phone calls.
The panel noted that both defendants filed their own dismissal motions and said, with those motions pending, the Illinois Supreme Court in 2025 issued a ruling in Petta v. Christie Business Holdings, “which addressed standing in the context of a breach of a medical entity’s email servers,” Pucinski wrote.
Although Kimber and Martin outlined different ways criminals can exploit the type of data the breach exposed, the panel said, they failed to plead “any specific fraudulent activity” stemming from the incident. It said Martin’s concerns about increased spam activity isn’t specifically linked to the break and, treating both plaintiffs the same, agreed “the allegations fail to establish a substantial, imminent threatened injury sufficient to confer standing.”
Petta specifically held “increased risk” allegations can’t confer standing, the panel explained, adding that “each of the Illinois courts addressing standing based on a future injury in the context of a data breach only found standing where there was an actual or attempted misuse of the exposed data that was fairly traceable to the breach.”
The panel said the plaintiffs’ allegations could be considered similar to cases where the underlying incidents “might be characterized as targeted data breaches” as opposed to other crimes where exposure of sensitive data was incidental, but rejected the request to “infer an imminent criminal intent to use the exposed data for fraudulent purposes based on the circumstances of PJA’s data breach.”
Because their “allegations amount to circumstantial speculation about the intent” of third parties, Pucinski wrote, worries about a greater risk of identity theft are insufficient to establish standing to sue. Making the case, she continued, would require “the presence of a traceable misuse of the compromised data.” Failing to do so also “forecloses the injunctive and declaratory relief” requests.
Martin’s allegations of increased spam exposure, the panel said, could be used to establish standing but “there are no supporting facts tracing the spam to the data breach,” meaning the complaint falls short of the legal standard. Although the timing lines up, the panel said, Martin made no allegations the spam referenced the type of information the breach exposed, nor did she allege her contact information could only have been accessed through one specific breach incident.
The panel also said “efforts to mitigate a future injury will not confer standing unless the prospective injury is imminent and substantial” and found several reasons to reject claims related to the value of breached data, including that “personal information has not been recognized as a property right in Illinois courts” and also pushing back on an insistence on conferring standing when there’s no governing state law as there is for other types of privacy rights, such as for genetic or biometric information.
Neither Kimber nor Martin alleged they could sell the information that was in the breach, Pucinski noted, “and there is no nonspeculative way to assess the lost value.”
Finally, the panel said the plaintiffs forfeited their allegations of overpaying for services that lacked adequate data security protections because they didn’t include it in their appeal. It affirmed Judge Moreland’s dismissal and, since the plaintiffs didn’t request a remand, did not send the matter back to Cook County Circuit Court for further proceedings.
Kimber and Martin are represented by attorneys from the firms of Barnow and Associates and Milber PLLC, both of Chicago.
Cook County Health is represented by attorneys Scott Schmookler and Meagan VanderWeele, of the firm of Gordon Rees Scully Mansukhani, Chicago, serving as special assistant state’s attorneys.
PJA is represented by the firm of Cozen O’Connor, of Chicago.
