On February 16, 2018, the U.S. Supreme Court denied certiorari to review CareFirst’s appeal of the U.S. Court of Appeals, D.C. Circuit’s decision in Attias v. Carefirst, Inc., 865 F.3d 620 (D.C. Cir. 2017).  The D.C. Circuit held that the threat of harm from a data breach is enough to satisfy the “injury in fact” standing requirement.    Other circuit courts of appeal have reached the opposite conclusion.  Unfortunately, the U.S. Supreme Court will not be addressing that circuit split this session.  See our previous entry on the CareFirst case.