Krottner v. Starbucks Corp. (9th Cir. 2010) 628 F.3d 1139 remains good law and is not in conflict with later Supreme Court decisions. It holds that a real and immediate threat of injury from identity theft is sufficient for Article III standing. Here, plaintiffs adequately alleged a real and immediate threat of injury from identity theft due to a data breach at Zappos in which much of their personal identification information was released, including credit card numbers. That sufficed to satisfy Article III standing requirements. Also, standing is determined as of the date the complaint was filed, not as of the current date when the danger may have waned due to the passage of time.
Ninth Circuit Court of Appeals (Friedland, J.); March 8, 2018; 2018 WL 1189643