As the basis for standing, the Neiman Marcus plaintiffs alleged:

The plaintiffs conceded that:

The court characterized the plaintiffs' alleged harms as falling into two categories for purposes of its analysis:

The court held without any analysis that aggravation and loss of time was sufficient injury with respect to the 9,200 customers who incurred fraudulent charges. In response to the argument that the other putative class members were at risk of future injury, Neiman Marcus argued that the plaintiffs' allegations were insufficient because, as a matter of policy, card companies reimburse fraudulent charges and therefore all future fraud that any plaintiff incurred would be reimbursed. The court rejected this argument, noting that it revealed a potential factual dispute over the universality of bank reimbursement policies.

The court then distinguished Clapper, under which the district court dismissed the case, from the case at hand. In Clapper, the Supreme Court held that the plaintiffs did not have standing to challenge certain provisions of the Foreign Surveillance Intelligence Act (FSIA) because they could not show that their communications with suspected terrorists were actually intercepted by the government. The court noted that although the Clapper plaintiffs' suspicions that their communications were being intercepted were too speculative to support standing, Clapper did not reject the premise that substantial risk of injury was sufficient to support standing.

In distinguishing Clapper, the court cited with approval the decision in In re Adobe Sys., Inc. Privacy Litig., No. 66 F.Supp.3d 1197 (N.D. Cal. Sept. 4, 2014), a case in which the US District Court for the Northern District of California found that under similar circumstances Clapper did not foreclose standing in a data breach case. The court noted that the plaintiffs alleged that the hackers deliberately targeted Neiman Marcus to obtain their credit card information, while in Clapper there was no evidence that any of respondents' communications either had been or would be monitored. Thus, unlike in Clapper, the court noted, there is “no need to speculate as to whether [the Neiman Marcus customers'] information has been stolen and what information was taken" (quoting In re Adobe Sys., 66 F.Supp.3d at 1215 (citing Clapper, 133 S.Ct. at 1148). As in Adobe, the court noted, the Neiman Marcus customers should not have to wait until hackers commit identity theft or credit card fraud to sue because there is an objectively reasonable likelihood that the injury will occur, in part because waiting for the threatened harm to materialize would make it harder for the plaintiffs to argue that the injury was fairly traceable to the defendant's conduct.

The court also noted that the plaintiffs had alleged a plausible risk of harm because:

The court went on to note that while the plaintiffs may not ultimately be able to provide a factual basis for their injuries, they are not required to do so at the pleading stage.

With respect to mitigation damages, expenses the plaintiffs alleged they incurred in purchasing identity theft protection, the court once again distinguished Clapper, which held that the costs the plaintiffs incurred to avoid injury were insufficient to confer standing. The court noted that Clapper dealt with speculative harm arising out of conduct that may not have even happened to the plaintiffs. In contrast, in the case at hand, an affected customer who was notified that her card was at risk might think it necessary to subscribe to a credit monitoring service. The court went on to note that it was "telling" that Neiman Marcus itself offered one year of credit monitoring and identity theft protection to its customers in the wake of the breach and that it was unlikely to do so if the risk could be safely disregarded. These costs, the court held, "easily" qualified as a concrete injury.

The court refrained from deciding whether the plaintiffs' allegations of overpayment for products and the right to the value of one's personal information might suffice as Article III injuries.

Neiman Marcus argued that the plaintiffs could not show that their injuries were traceable to the data breach rather than to one of several other large breaches that took place around the same time. The court rejected this argument, noting that just because a breach at some other store might have caused the plaintiffs' private information to be exposed does nothing to negate the plaintiffs' standing to sue. Rather, that issue would be one of allocating responsibility under traditional tort doctrines. The court went further, finding that at the pleading stage, it was sufficient for standing purposes that Neiman Marcus admitted that 350,000 cards might have been exposed and that it contacted members of the class to tell them they were at risk.

Finally, as to redressability, Neiman Marcus argued that the plaintiffs' injuries cannot be redressed by a judicial decision because they have already been reimbursed for the fraudulent charges. The court found that while that may be true for the actual fraudulent charges alleged, it was not true for the alleged mitigation expenses or the future injuries. The court found it important that although some credit card companies offer zero liability policies under which the customer is not held responsible for any fraudulent charges, those policies do not defeat a finding of injury-in-fact because they are a business practice, not a federal requirement.