The U.S. Supreme Court turned away an appeal by Amazon’s Zappos unit, letting a lawsuit proceed over a 2012 hack that exposed the personal information of 24 million customers.

The online shoe and clothing retailer argued unsuccessfully that the customers couldn’t sue without proof of concrete injury, such as the impending misuse of their information. The suit, allowed by a San Francisco-based federal appeals court, seeks class-action status.

The rebuff is a setback for business groups, which urged the court to hear the appeal and tighten the rules for data-breach lawsuits. The U.S. Chamber of Commerce said companies face similar suits over alleged vulnerabilities in internet-connected cars, home-security systems, children’s toys and medical devices.

“The factual scenario this case presents — a database holding customers’ personal information is accessed, but virtually no identity theft or fraud results — is an increasingly common one,” Zappos argued. The company says only two dozen people have ever claimed their data might have been misused because of the breach.

A San Francisco-based federal appeals court let the suit go forward, saying the sensitive nature of the stolen data, which included credit card information, left customers vulnerable to identity theft. The appeals court pointed to people who said their email accounts had been commandeered or credit cards fraudulently charged.

The suing customers face “a substantial risk that the Zappos hackers will commit identity fraud or identity theft,” Judge Michelle Friedland wrote for a three-judge panel of the 9th U.S. Circuit Court of Appeals.

Advertising

Lawyers for the customers pressing the suit urged the Supreme Court to reject the appeal.

The high court had been holding the appeal while it considered a case involving Alphabet’s Google unit that raised similar issues. The justices sent that case back to a lower court to consider whether consumers pressing a privacy suit had legal standing to sue.

The case is Zappos.com v. Stevens, 18-225.

To contact the reporter on this story: Greg Stohr in Washington at gstohr@bloomberg.net

To contact the editors responsible for this story: Joe Sobczyk at jsobczyk@bloomberg.net, Laurie Asséo

For more articles like this, please visit us at bloomberg.com

©2019 Bloomberg L.P.