Does a data breach constitute a case or controversy for purposes of Article III standing? This is a threshold question that could dramatically change the course for data breach cases, yet the answer remains uncertain. If a court does not find standing, the proposed class cannot seek relief in court and plaintiffs’ relief would be limited to statutory damages and/or penalties imposed, for example, under various state data breach laws. In 2013, the United States Supreme Court’s decision in Clapper v. Amnesty International USA was widely seen to shut the courthouse door on data breach class actions. In 2015, however, some significant case law at the circuit court level called this belief into question. In a guest article, Christina H. Bost Seaton, a partner at FisherBroyles, surveys these developments and a case that could potentially change the landscape.