Plaintiff – one of the millions of people who have played Fortnite – sued Fortnite developer Epic Games based on a data vulnerability in the Fortnite platform and an apparent hacking incident that took place in 2018. After the case was moved from state court in Illinois to federal court there, and then to federal court in North Carolina, defendant moved to dismiss for failure to state a claim.
The court dismissed the case, finding that the court lacked subject matter jurisdiction, since plaintiff had not sufficiently alleged that he had suffered an “injury-in-fact”.
It held that the mere existence of a data vulnerability does not constitute injury-in-fact. Instead, a complaint must allege a sufficient factual basis from which to conclude either that plaintiff’s compromised data has been misused, or that it will be misused, such that concrete harms are actual or imminent.
In this case, plaintiff’s complaint contained no facts showing, or even suggesting, that his personal data had been used as a result of the cyber vulnerability. Plaintiff’s complaint did not even state that his data was taken, only that Fortnite had a cyber vulnerability that could have allowed hackers to access his data.
Plaintiff’s only alleged harms were “time and effort to mitigate the risk of identity theft” and “anxiety and anguish”. The court held that anxiety and anguish resulting from data breaches do not confer standing. And without a single fact alleged to show that future harms were certainly impending, the money, time, and effort spent by plaintiff were merely self-imposed harms in response to a speculative threat. In the court’s view, the threat of future injury was wholly speculative and insufficient for standing.
Krohm v. Epic Games, Inc., No. 19-173, 2019 WL 4861101 (E.D. N. Carolina, October 1, 2019)
About the Author: Evan Brown is a Chicago technology and intellectual property attorney. Call Evan at (630) 362-7237, send email to ebrown [at] internetcases.com, or follow him on Twitter @internetcases. Read Evan’s other blog, UDRP Tracker, for information about domain name disputes.