Was AvMed's data breach the proximate cause of the identity theft?

You Be the Judge Resnick v. AvMed, Inc. 693 F.3d 1317 United States Court of Appeals for the Eleventh Circuit, 2012 Facts: Juana Curry and William Moore, customers of AvMed insurance, took care to protect their private information. They destroyed mail that contained sensitive data and avoided uploading any such information online. Despite their care, they both became victims of identity theft. Unknown identity thieves opened bank accounts in Curry's name and changed her home address with the US. Postal Service. Someone opened an E*Trade account in Moore's name. Curry and Moore blamed AvMed. About a year earlier, two unencrypted laptops containing the health information, Social Security numbers, names, addresses, and phone numbers of 1.2 million AvMed customers had been stolen from the company's ofces. The plaintiffs sued AvMed for negligence, claiming the company breached its duty to keep customer information secure and this breach caused their identity theft. Curry and Moore argued that if it had not been for AvMed's carelessness, they would not have been victims of identity theft. AvMed led a motion to dismiss, arguing that the plaintiffs could not prove that the breach caused their injuries a year later. You Be the Judge: Was AvMed's data breach the proximate cause of the identity theft? Argument for Plaintiffs: Your honors, my clients are prudent people who guard their personal information. They are careful when sharing and buying online. Sometimes they even shred their mail. My clients shared their information with AvMed to secure insurance, and lo and behold, someone used that same information to open unauthorized bank accounts. The only way the thieves could have accessed the sensitive data was through AvMed's breach. Had it not been for AvMed's negligence, my clients would not have suffered identity theft. Argument for AvMed: Your honors, with all due respect, welcome to the twenty-rst century. Identity theft is a reality in all of our lives. The Federal Trade Commission estimates that each year this crime affects 9 million peoplemore than the population of New York City. And we are all at risk: Even the most careJl person shares potentially sensitive information every day when she gives her credit card to a waiter, les her taxes online, or registers for a coupon. In this case, the only thing that the plaintiffs can show is that their information was on a stolen laptop and that they were victims of identity theft at year later. Was AvMed the only company that had the plaintiff's information? Seems unlikely. There is simply no way to prove a causal connection between the AvMed breach and the subsequent identity thefts