Plaintiffs in data-breach lawsuits commonly allege that the company was negligent in failing to secure their data, breached a contract or privacy policy that promised certain protections, or violated a specific data-protection statute that allows individuals to sue.

Which theories are available depends heavily on the jurisdiction, the type of data involved, and what representations the company made about its security practices.

Courts frequently require plaintiffs to show they suffered a concrete harm from the breach, such as actual financial loss or identity theft, rather than just the fact that their information was exposed.

This requirement has been a significant factor in many data-breach cases, and plaintiffs whose claims are based only on increased risk of future harm sometimes face additional hurdles establishing standing to sue.

Many data-breach claims point to specific promises a company made in its privacy policy or terms of service, arguing that failing to meet those commitments amounts to a breach of contract.

In addition, certain states and industries impose specific statutory data-security duties, and some of those statutes create a private right of action allowing affected individuals to sue directly.

Because a single breach can affect thousands or millions of people in essentially the same way, data-breach litigation is frequently brought as a class action rather than as individual lawsuits.

Class treatment can make it more practical to pursue a claim where any one person's individual damages might be relatively small, by combining many similar claims into a single case.