UNITED STATES COURT OF APPEALS FOR THE THIRD CIRCUIT ____________

No. 21-1506 ____________

JENNIFER CLEMENS, Appellant

v.

EXECUPHARM INC.; PAREXEL INT’L CORP. ____________

On Appeal from the United States District Court for the Eastern District of Pennsylvania (Civil No. 2-20-cv-03383) District Judge: Honorable Gerald J. Pappert ____________

Argued December 14, 2021 ____________ Before: GREENAWAY, JR., KRAUSE, and PHIPPS, Circuit Judges.

(Filed: September 2, 2022) Mark S. Goldman Goldman Scarlato & Penny 161 Washington Street 8 Tower Bridge, Suite 1025 Conshohocken, PA 19428 J. Austin Moore [ARGUED] Norman E. Siegel Barrett J. Vahle Caleb J. Wagner Stueve Siegel Hanson 460 Nichols Road Suite 200 Kansas City, MO 64112

Counsel for Appellant Shifali Baliga Kristine M. Brown Donald M. Houser [ARGUED] Alston & Bird 1201 West Peachtree Street One Atlantic Center, Suite 4900 Atlanta, GA 30309 Mathieu Shapiro Obermayer Rebmann Maxwell & Hippel 1500 Market Street Centre Square West, 34th Floor Philadelphia, PA 19102

Counsel for Appellees

2 ____________

OPINION OF THE COURT ___________

GREENAWAY, JR., Circuit Judge.

In this appeal, Jennifer Clemens asks us to reverse the District Court’s dismissal of her complaint seeking equitable and monetary relief in connection with a data breach that resulted in the publication of her sensitive personal information on the Dark Web. Clemens argues that her injury was sufficiently imminent to constitute an injury-in-fact for purposes of standing. We agree. Accordingly, we will vacate the judgment of the District Court and remand for consideration of the merits.

I. Background1

Clemens is a former employee of ExecuPharm, Inc. (“ExecuPharm” or “the Company”), a subsidiary of the global biopharmaceutical company Parexel International Corp. (“Parexel”). As a condition of her employment, Clemens was required to provide ExecuPharm with sensitive personal and financial information, including her address, social security 1 Where, as here, the challenge to a District Court’s subject matter jurisdiction was made on the face of the pleadings, we accept all “well-pleaded factual allegations as true and draw all reasonable inferences” in favor of the plaintiff. In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 633 (3d Cir. 2017).

3 number, bank and financial account numbers, insurance and tax information, her passport, and information relating to her husband and child. In exchange, Clemens’s employment agreement provided that ExecuPharm would “take appropriate measures to protect the confidentiality and security” of this information. J.A. 41 ¶ 58. Based on the complaint’s allegations, ExecuPharm did not perform its obligation.

After Clemens had left ExecuPharm, a hacking group known as CLOP accessed ExecuPharm’s servers through a phishing attack in March 2020, stealing sensitive information pertaining to current and former employees, including Clemens. Specifically, the stolen information contained social security numbers, dates of birth, full names, home addresses, taxpayer identification numbers, banking information, credit card numbers, driver’s license numbers, sensitive tax forms, and passport numbers. In addition to exfiltrating the data, CLOP installed malware to encrypt the data stored on ExecuPharm’s servers. Then, CLOP held the decryption tools for ransom, threatening to release the information if ExecuPharm did not pay the ransom. Either because ExecuPharm refused to pay or for nefarious reasons u