A hacker stole personally identifiable information, including Social Security numbers, addresses, birth dates, and insurance details, from the database of Athens Orthopedic Clinic. Current and former patients alleged that the data was offered on the dark web, that they faced a substantial risk of identity theft, and that they incurred costs for credit monitoring and fraud alerts. One named plaintiff alleged fraudulent credit-card charges soon after the breach. The trial court dismissed the putative class action, and the Court of Appeals held that the plaintiffs had not alleged a legally cognizable injury. The Georgia Supreme Court reversed in part. It held that allegations of a large-scale criminal data breach, an imminent and substantial risk of identity theft, and reasonable mitigation costs were sufficient to plead injury for negligence purposes. Because that error may have affected the rulings on implied contract, unjust enrichment, statutory injunctive relief, and declaratory relief, the Court vacated those holdings and remanded for reconsideration. The Court did not decide the ultimate merits or class certification.