When hackers breach a business’s systems, class actions are sure to follow. Often, however, these suits have faltered right out of the starting gate. Citing the Supreme Court’s 2013 decision in Clapper v. Amnesty International, many federal district judges have dismissed these suits, holding that consumers whose personal data have been compromised—but who have not actually incurred any fraudulent charges or suffered identity theft—lack standing under Article III of the U.S. Constitution.

This week, the Seventh Circuit declined to follow these decisions. This may subject businesses that collect consumer data to an elevated threat of class-action liability in Illinois, Indiana, and Wisconsin federal courts.