Breach Class-Action Defence Lab
Practise defending a breach class action. Three fictional clients, three decisions: who has standing and what to file, what to preserve before it expires, and how to value and structure a settlement that a court will approve.
Each fact pattern is scored on seven decisions, with a seeded "how it played out" step, named classic mistakes, and a case memo and register you can download with Pro. The best answer is the defensible practice, because several of these questions differ by court.
Not legal advice. Educational practice only, not legal advice. The people, companies, domains and facts are fictional. Rules differ by jurisdiction and change, so check current primary sources and take advice from a qualified lawyer before relying on anything here.
Not legal advice. Educational practice only, not legal advice. The people, companies, domains and facts are fictional. Rules differ by jurisdiction and change, so check current primary sources and take advice from a qualified lawyer before relying on anything here.
You are defence counsel at Hallworth Defence Group LLP
Hallworth Defence Group LLP is a fictional law firm that defends companies in data breach class actions. Three clients call at different stages: a fresh complaint, a looming preservation problem, and a settlement that must survive a federal judge. You decide how to triage, what to file, what to preserve and how to value and structure a deal. All parties are fictional. The rules named are real and were checked against the sources listed on the page.
- 1Issue spotting: What is the real problem in this fact pattern?
- 2Governing rule: Which rule or test decides it?
- 3Strategy: What do you file or do first?
- 4Evidence and record: What record do you build or keep?
- 5Defence moves: Which defences, positions and steps belong in the first response? Tick every one that belongs.
- 6Risk and exposure: What do you tell the client about risk and exposure?
- 7Next step: What do you do next?
- 8See how it played out, from a seeded outcome
3 fact patterns. Pro keeps the rules in a fold-out and hides the hints. A good record choice uncovers hidden complications as you go. Passing score is 70%.
Loading…
TL;DRWhat this lab is
4 points
- A fictional-client practice lab for breach litigators: three fact patterns on triage and standing, preservation, and settlement valuation, with seeded outcomes.
- It is built from real rules (TransUnion, Third Circuit Clemens, Federal Rules 12, 23, 26 and 37) that were checked against primary or authoritative sources, listed on the page.
- Educational practice, not legal advice. Rules vary by jurisdiction and change.
- Pro lab: free to try with 3 Pro tool runs in total, shared across all Pro tools. Downloading the case memos and CSV register is Pro only.
Sources checked
Every rule named in this lab was checked against these pages on 2026-11-02. Law changes, so read the current text before you rely on any of it.
Four plaintiffs, four different injuries
- TransUnion LLC v. Ramirez, No. 20-297 (U.S. June 25, 2021), opinion (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Every class member must have Article III standing to recover individual damages; mere risk of future harm, standing alone, is not a concrete harm in a damages suit unless the exposure itself causes a separate concrete harm; risk of harm can support forward-looking injunctive relief if sufficiently imminent and substantial; plaintiffs bear the burden.
- Clemens v. ExecuPharm Inc., No. 21-1506 (3d Cir. Sept. 2, 2022), precedential opinion (Third Circuit website) (court opinion, checked 2026-11-02). Third Circuit: no bright-line rule against standing based on risk of identity theft; non-exhaustive factors (whether the breach was intentional, whether data was misused, nature of the data); for damages, a plaintiff can satisfy concreteness by alleging that exposure to the risk caused additional concrete harms such as emotional distress or credit-monitoring spend; whether a claim is made out is a separate question. Also describes how other circuits have treated intentional attacks.
- Federal Rules of Civil Procedure, Rule 12 (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Rule 12(b)(1) and (b)(6) defenses; Rule 12(d): matters outside the pleadings presented on a 12(b)(6) motion convert it to summary judgment; Rule 12(h)(3) dismissal at any time for lack of subject-matter jurisdiction.
The logs that expire on Friday
- Federal Rules of Civil Procedure, Rule 37 (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Rule 37(e): ESI that should have been preserved in anticipation or conduct of litigation, lost because a party failed to take reasonable steps and not restorable or replaceable; (e)(1) prejudice allows measures no greater than necessary; (e)(2) intent to deprive is required for presumption, adverse-inference instruction, dismissal or default.
- Federal Rules of Civil Procedure, Rule 26 (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Rule 26(b)(1): discovery of nonprivileged matter relevant to a claim or defense and proportional to the needs of the case, with the listed proportionality factors; Rule 26(f) discovery-plan conference.
The settlement that must survive the judge
- Federal Rules of Civil Procedure, Rule 23 (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Rule 23(a) prerequisites, 23(b)(3) predominance and superiority, 23(e)(1)-(5): court approval after a hearing on a finding that a settlement is fair, reasonable and adequate considering the listed factors, identification of side agreements, objector payments need court approval.
- TransUnion LLC v. Ramirez, No. 20-297 (U.S. June 25, 2021), opinion (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Every class member must have Article III standing to recover individual damages; mere risk of future harm, standing alone, is not a concrete harm in a damages suit unless the exposure itself causes a separate concrete harm; risk of harm can support forward-looking injunctive relief if sufficiently imminent and substantial; plaintiffs bear the burden.
Frequently asked questions
Is this legal advice?
No. It is educational practice with fictional clients. Rules vary by jurisdiction and change, so check current primary sources and take advice from a qualified lawyer.
Does a data breach plaintiff have standing if their data was only exposed?
It depends on the court and the facts. The Supreme Court has said that, for damages, a mere risk of future harm is not enough unless the exposure itself causes a separate concrete harm. The Third Circuit has applied factors such as whether the attack was intentional, whether data was misused and how sensitive it was. Other courts apply these ideas differently.
When does the duty to preserve evidence start?
Under Federal Rule 37(e) it concerns information that should have been preserved in the anticipation or conduct of litigation, so it can start before a complaint is filed. The lab teaches documenting reasonable steps.
Does the lab tell me what a breach class action settlement is worth?
No. Values are fact-specific and the lab states none. It teaches a risk-weighted method and the court-approval factors in Rule 23(e).
Do I need Pro to use the lab?
The lab is free to try with 3 Pro tool runs in total, shared across all Pro tools. Downloading the memos and register is Pro only.
Where do the rules come from?
Each fact pattern lists the opinions and rules opened to check it, with the date checked. The Sources block on the page shows them all.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.