A New York federal court’s dismissal of a proposed data-breach class action against IBM and Johnson & Johnson’s health-care unit is the latest in a recent series of decisions demanding more than a breach notice and a feared future injury before allowing a federal case to proceed. The September 17 ruling follows the First Circuit’s June decision in Santos-Pagán v. Bayamón Medical Center, which likewise affirmed dismissal because the alleged identity-related harm was not plausibly traceable to the breach.
The IBM and J&J case involved a patient-support program whose users’ personal information was allegedly exposed in a 2023 incident. U.S. District Judge Nelson S. Román found that the plaintiffs had not adequately alleged concrete injuries traceable to that event — the same standing pressure point that has increasingly become a dispositive defense in breach litigation.
The decision also marked the second dismissal in the case. After the court dismissed the action on similar grounds in March 2025, the plaintiffs amended; the court concluded that the revised allegations still did not cure the complaint’s deficiencies.
The Court: Show the Damage
Taken together, the IBM and J&J ruling and recent appellate authority send a practical message to plaintiffs: data exposure, without more, does not necessarily establish Article III standing. Courts are increasingly examining both sides of the standing equation — whether the plaintiff alleges a concrete injury and whether that injury can plausibly be tied to the particular incident at issue.
That distinction mattered in Santos-Pagán. Even though the plaintiff alleged actual identity-related harm, the First Circuit found that the complaint did not plausibly connect a fraudulent cellphone account to the defendant hospital’s ransomware attack. The court rejected temporal proximity alone as a sufficient substitute for pleaded facts demonstrating traceability.
For defendants, the emerging line of cases offers a way to focus litigation on threshold jurisdictional deficiencies before the parties enter costly discovery over cybersecurity controls, incident response, causation, class certification, and damages.
The Road to an Early Exit
• Challenge standing from the start. Test whether plaintiffs allege a concrete injury sufficient for Article III standing, rather than a generalized concern that their information might someday be misused.
• Demand a plausible causal link. Require allegations connecting the claimed fraud, financial loss, remediation expense, or other harm to the specific breach—not merely to the fact that personal information was exposed.
• Do not concede traceability merely because plaintiffs allege actual misuse. Santos-Pagán demonstrates that even alleged identity-related fraud may not establish standing if the complaint lacks facts showing that the compromised data caused it.
• Build the dismissal record carefully. IBM and J&J’s second dismissal illustrates the value of identifying pleading defects with sufficient precision in the first motion to show that a later amendment still falls short.
• Seek dismissal with prejudice when amendment fails. Where plaintiffs have had a fair opportunity to cure identified pleading problems but repeat them, defendants have a stronger argument that further amendment would be futile.
The Bottom Line for Defendants
IBM and J&J’s victory does not create an absolute bar to data-breach suits. Plaintiffs who plausibly allege actual misuse, measurable losses, or another concrete injury — and facts credibly connecting that harm to the breach — may still establish standing.
But the ruling adds to a developing body of defense-friendly authority: a breach alone is not an injury, and an injury without a plausible connection to the breach is not enough. For defendants, that gives renewed force to an early motion focused on concrete harm and traceability.
