FOR PUBLICATION
UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT
LAURA KROTTNER; ISHAYA
SHAMASA, individually and on
behalf of all others similarly
situated, No. 09-35823
Plaintiffs-Appellants,
D.C. No.
v. 2:09-cv-00216-RAJ
STARBUCKS CORPORATION, a
Washington Corporation,
Defendant-Appellee.
JOSEPH LALLI, individually and on
behalf of all others similarly
situated, No. 09-35824
Plaintiff-Appellant,
v. D.C. No.
2:09-cv-00389-RAJ
STARBUCKS CORPORATION, a OPINION
Washington Corporation,
Defendant-Appellee.
Appeal from the United States District Court
for the Western District of Washington
Richard A. Jones, District Judge, Presiding
Argued and Submitted
October 6, 2010—Seattle, Washington
Filed December 14, 2010
Before: Alex Kozinski, Chief Judge, and Sidney R. Thomas
and Milan D. Smith, Jr., Circuit Judges.
20057
20058 KROTTNER v. STARBUCKS CORPORATION
Opinion by Judge Milan D. Smith, Jr.
KROTTNER v. STARBUCKS CORPORATION 20059
COUNSEL
Lynn Lincoln Sarko, Mark A. Griffin, and Gretchen Freeman
Cappio, Keller Rohrback L.L.P., Seattle, Washington; Mila F.
Bartos, Karen J. Marcus, and Eugene J. Benick, Finkelstein
Thompson LLP, Washington, DC; and Ben Barnow, Barnow
and Associates, P.C., Chicago, Illinois, for the plaintiffs-
appellants.
Gavin W. Skok and Karl J. Quackenbush, Riddell Williams,
P.S., Seattle, Washington, for the defendant-appellee.
20060 KROTTNER v. STARBUCKS CORPORATION
OPINION
M. SMITH, Circuit Judge:
Plaintiffs-Appellants Laura Krottner, Ishaya Shamasa, and
Joseph Lalli appeal the district court’s dismissal of their negli-
gence and breach of contract claims against Starbucks Corpo-
ration. Plaintiffs-Appellants are current or former Starbucks
employees whose names, addresses, and social security num-
bers were stored on a laptop that was stolen from Starbucks.
Their complaints allege that, in failing to protect Plaintiffs-
Appellants’ personal data, Starbucks acted negligently and
breached an implied contract under Washington law.
Affirming the district court, we hold that Plaintiffs-
Appellants, whose personal information has been stolen but
not misused, have suffered an injury sufficient to confer
standing under Article III, Section 2 of the U.S. Constitution.
We affirm the dismissal of their state-law claims in a memo-
randum disposition filed contemporaneously with this opin-
ion.
FACTUAL AND PROCEDURAL BACKGROUND
On October 29, 2008, someone stole a laptop from Star-
bucks. The laptop contained the unencrypted names,
addresses, and social security numbers of approximately
97,000 Starbucks employees.
On November 19, 2008, Starbucks sent a letter to
Plaintiffs-Appellants and other affected employees alerting
them to the theft and stating that Starbucks had “no indication
that the private information has been misused.” Nonetheless,
the letter continued,
As a precaution, we ask that you monitor your finan-
cial accounts carefully for suspicious activity and
take appropriate steps to protect yourself against
KROTTNER v. STARBUCKS CORPORATION 20061
potential identity theft. To assist you in protecting
this effort [sic], Starbucks has partnered with Equi-
fax to offer, at no cost to you, credit watch services
for the next year.
Krottner and Shamasa allege that after receiving the letter,
they enrolled in the free credit watch services that Starbucks
offered. Krottner alleges that she “has been extra vigilant
about watching her banking and 401(k) accounts,” spending
a “substantial amount of time doing so,” and will pay out-of-
pocket for credit monitoring services once the free service
expires. Lalli alleges that he “has spent and continues to
spend substantial amounts of time checking his 401(k) and
bank accounts,” has placed fraud alerts on his credit cards,
and “has generalized anxiety and stress regarding the situa-
tion.” Shamasa alleges that his bank notified him in December
2008 that someone had attempted to open a new account
using his social security number. The bank closed the
account, and Shamasa does not allege that he suffered any
financial loss.
Plaintiffs-Appellants filed two nearly identical putative
class action complaints against Starbucks, alleging negligence
and breach of implied contract. On August 14, 2009, the dis-
trict court granted Starbucks’s motion to dismiss, holding that
Plaintiffs-Appellants have standing under Article III but had
failed to allege a cognizable injury under Washington law.
Plaintiffs-Appellants appealed, and we have jurisdiction under
28 U.S.C. § 1291.
DISCUSSION
[1] We have an independent obligation to examine stand-
ing to determine whether it comports with the case or contro-
versy requirement of Article III, Section 2 of the Constitution.
See Steel Co. v. Citizens for a Better Env’t, 523 U.S. 83, 95
(1998); see also Equity Lifestyle Props., Inc. v. Cnty. of San
Luis Obispo, 548 F.3d 1184, 1189 n.10 (9th Cir. 2008) (“The
20062 KROTTNER v. STARBUCKS CORPORATION
jurisdictional question of standing precedes, and does not
require, analysis of the merits.”). The case or controversy
requirement, which constitutes “the irreducible constitutional
minimum of standing,” Lujan v. Defenders of Wildlife, 504
U.S. 555, 560 (1992), requires that a plaintiff show
(1) it has suffered an ‘injury in fact’ that is (a) con-
crete and particularized and (b) actual or imminent,
not conjectural or hypothetical; (2) the injury is
fairly traceable to the challenged action of the defen-
dant; and (3) it is likely, as opposed to merely specu-
lative, that the injury will be redressed by a favorable
decision.
Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC),
Inc., 528 U.S. 167, 180-81 (2000). The party asserting federal
jurisdiction bears the burden of establishing these require-
ments at every stage of the litigation, as it does for “any other
essential element of the case.” Cent. Delta Water Agency v.
United States, 306 F.3d 938, 947 (9th Cir. 2002). On appeal
from a motion to dismiss, a plaintiff need only show that the
facts alleged, if proven, would confer standing. See id.
[2] It was undisputed before the district court that
Plaintiffs-Appellants had sufficiently alleged causation and
redressability, the second and third standing requirements. We
thus turn to the first standing requirement: whether Plaintiffs-
Appellants adequately alleged an injury-in-fact. Lalli’s allega-
tion that he “has generalized anxiety and stress” as a result of
the laptop theft is the only present injury that Plaintiffs-
Appellants allege. This is sufficient to confer standing, but
only as to Lalli. See Doe v. Chao, 540 U.S. 614, 617-18, 624-
25 (2004) (suggesting that a plaintiff who allegedly “was
‘torn . . . all to pieces’ and ‘was greatly concerned and wor-
ried’ because of the disclosure of his Social Security number
and its potentially ‘devastating’ consequences” had no cause
of action under the Privacy Act, but nonetheless had standing
KROTTNER v. STARBUCKS CORPORATION 20063
under Article III (ellipsis in original) (internal quotation
marks omitted)).
Plaintiffs-Appellants’ remaining allegations concern their
increased risk of future identity theft. Krottner and Shamasa
enrolled in credit watch services, but Starbucks provided
those services at no cost to affected employees. Krottner and
Lalli allege that they have been vigilant in monitoring their
accounts—that is, in guarding against future identity theft—
but they do not allege that any theft has actually occurred.
Shamasa alleges that someone attempted to open a bank
account in his name, but that the bank closed the account
before he suffered any loss.
[3] Although we have not previously determined whether
an increased risk of identity theft constitutes an injury-in-fact,
we have addressed future harm in other contexts, holding that
“the possibility of future injury may be sufficient to confer
standing on plaintiffs; threatened injury constitutes ‘injury in
fact.’ ” Cent. Delta Water Agency, 306 F.3d at 947. More spe-
cifically,
[a] plaintiff may allege a future injury in order to
comply with [the injury-in-fact] requirement, but
only if he or she “is immediately in danger of sus-
taining some direct injury as the result of the chal-
lenged . . . conduct and the injury or threat of injury
is both real and immediate, not conjectural or hypo-
thetical.”
Scott v. Pasadena Unified Sch. Dist., 306 F.3d 646, 656 (9th
Cir. 2002) (emphasis in Scott) (quoting City of Los Angeles v.
Lyons, 461 U.S. 95, 102 (1983)). Thus, in the context of envi-
ronmental claims, a plaintiff may challenge governmental
action that creates “a credible threat of harm” before the
potential harm, or even a statutory violation, has occurred. See
Cent. Delta Walter Agency, 306 F.3d at 948-50. Similarly, a
plaintiff seeking to compel funding of a medical monitoring
20064 KROTTNER v. STARBUCKS CORPORATION
program after exposure to toxic substances satisfies the
injury-in-fact requirement if he is unable to receive medical
screening. See Pritikin v. Dep’t of Energy, 254 F.3d 791, 796-
97 (9th Cir. 2001).
[4] In Pisciotta v. Old National Bancorp, the Seventh Cir-
cuit extended that reasoning to the identity-theft context,
holding that plaintiffs whose data had been stolen but not yet
misused had suffered an injury-in-fact sufficient to confer
Article III standing. 499 F.3d 629, 634 (7th Cir. 2007). In Pis-
ciotta, the plaintiffs’ only alleged injury was the increased
risk that their personal data would be misused in the future;
none alleged any completed financial or other loss. Id. at 632.
The court surveyed case law addressing toxic substance, med-
ical monitoring, and environmental claims in the Second,
Fourth, Sixth, and Ninth Circuits. Id. at 634 n.3 (citing Den-
ney v. Deutsche Bank AG, 443 F.3d 253, 264-65 (2d Cir.
2006) (toxic substances); Sutton v. St. Jude Med. S.C., Inc.,
419 F.3d 568, 574-75 (6th Cir. 2005) (medical monitoring);
Cent. Delta Water Agency, 306 F.3d at 947-48 (environmental
harm); Friends of the Earth, Inc. v. Gaston Copper Recycling
Corp., 204 F.3d 149, 160 (4th Cir. 2000) (en banc) (environ-
mental harm)). It concluded:
As many of our sister circuits have noted, the injury-
in-fact requirement can be satisfied by a threat of
future harm or by an act which harms the plaintiff
only by increasing the risk of future harm that the
plaintiff would have otherwise faced, absent the
defendant’s actions. We concur in this view. Once
the plaintiffs’ allegations establish at least this level
of injury, the fact that the plaintiffs anticipate that
some greater potential harm might follow the defen-
dant’s act does not affect the standing inquiry.
Id. at 634 (footnotes omitted). Because the plaintiffs had
alleged an act that increased their risk of future harm, they
had alleged an injury-in-fact sufficient to confer standing. Id.
KROTTNER v. STARBUCKS CORPORATION 20065
The Sixth Circuit, while not explicitly analyzing the issue,
appears to disagree. In Lambert v. Hartman, the plaintiff
alleged both that she had suffered financial loss as a result of
identity theft and that the theft had exposed her to the risk of
additional, future identity theft. 517 F.3d 433, 437 (6th Cir.
2008). The Lambert court held that the plaintiff’s actual finan-
cial injuries resulting from the theft of her personal data were
sufficient to confer standing. Id. It also noted, without analy-
sis, that the risk of future identity theft was “somewhat ‘hypo-
thetical’ and ‘conjectural.’ ” Id.
[5] On these facts, we reach a different conclusion. If a
plaintiff faces “a credible threat of harm,” Cent. Delta Walter
Agency, 306 F.3d at 950, and that harm is “both real and
immediate, not conjectural or hypothetical,” Lyons, 461 U.S.
at 102 (internal quotation marks omitted), the plaintiff has met
the injury-in-fact requirement for standing under Article III.
Here, Plaintiffs-Appellants have alleged a credible threat of
real and immediate harm stemming from the theft of a laptop
containing their unencrypted personal data. Were Plaintiffs-
Appellants’ allegations more conjectural or hypothetical—for
example, if no laptop had been stolen, and Plaintiffs had sued
based on the risk that it would be stolen at some point in the
future—we would find the threat far less credible. On these
facts, however, Plaintiffs-Appellants have sufficiently alleged
an injury-in-fact for purposes of Article III standing.
AFFIRMED.