On April 26, 2021, the United States Court of Appeals for the Second Circuit issued a unanimous opinion in McMorris v. Carlos Lopez & Associates, LLC affirming the dismissal, on Article III standing grounds, of a class action predicated on the plaintiffs’ alleged increased risk of identity theft or fraud arising out of their employer’s accidental email dissemination of their sensitive personal information to other employees within the company. The Second Circuit held that, although plaintiffs may in some cases establish standing based on an increased risk of identity theft or fraud following the unauthorized disclosure of their data, district courts should consider a number of factors related to the nature of the data and its exposure or misuse in determining whether an increased risk has, in fact, been adequately alleged or established. After considering those factors, the court concluded that the plaintiffs had failed to allege such an increased risk because, among other reasons, they did not allege that the disclosure was intentional or that their data (or the data of any other person whose data was disclosed) had been misused.