Before the Merits

The setup

Bayamon Medical Center, a hospital in Puerto Rico, suffered a data breach in 2019 that exposed patients' personal information, the names, numbers, and identifiers collectively called PII.[1] Sometime later, Santos-Pagan discovered that someone had used her information to open a fraudulent cellphone account, and she spent about 800 dollars on steps to contain the harm.[1] She filed a proposed class action, a suit brought on behalf of many similarly affected patients, blaming the hospital's breach for the fraud.[1]

The hospital moved to dismiss, and the district court, the trial court, threw the case out for lack of Article III standing.[1] Article III of the Constitution limits federal courts to genuine disputes, and to sue, a plaintiff must show three things: a concrete injury, a defendant whose conduct caused it, and a remedy a court can provide.[2] The trial court found the middle element missing, ruling that Santos-Pagan had not tied her fraud to this breach. She appealed, and the First Circuit reviewed the question de novo, deciding it afresh without deferring to the trial judge.[1]

The question

The panel had no quarrel with the injury itself. A fraudulent account and 800 dollars in cleanup costs are concrete, actual harms rather than hypothetical ones, so the first element of standing was satisfied.[1] The fight was over the second element, traceability, the requirement that the injury be fairly traceable to the defendant's conduct and not the product of some independent third party.[2] Personal data is stolen and resold constantly, and any one person's information may sit in several breaches at once. So the question was narrow: had the plaintiff alleged enough to make it plausible, rather than merely possible, that the cellphone fraud flowed from this hospital's breach in particular?[1]

The reasoning, walked

The court measured the complaint against its own 2023 decision in Webb v. Injured Workers Pharmacy, where it had allowed a closely similar data-breach suit to go forward.[3] Webb matters because at the pleading stage, before any evidence is gathered, a court accepts the plaintiff's factual allegations as true and draws reasonable inferences in her favor, so the test is whether the alleged facts support a plausible inference of a causal link.[1] In Webb that inference held. Here, the panel concluded, it did not, and the difference lay in three specific gaps.[1]

The first gap was timing. In Webb the misuse followed the breach by about a year, a closeness in time that pointed toward a connection.[3] Santos-Pagan's complaint never said when the fraudulent account was opened, and she discovered it more than four years after the 2019 breach.[1] A gap that long, with no date attached, does not on its own point back to the hospital rather than to some later leak.[1]

The second gap concerned how carefully she guarded her data elsewhere. The Webb plaintiff had alleged that she otherwise protected her information, which made the breach the more likely source of the misuse.[3] Santos-Pagan offered no comparable allegation. She rested instead on the hospital's promises to keep her records safe, which said nothing about whether the fraudsters obtained her data from the hospital or from somewhere else.[1]

The third gap was the nature of the data. The complaint never alleged that the specific information needed to open a cellphone account matched the information the hospital held and exposed.[1] Without that link, the panel could not infer that the breach supplied the raw material for the fraud rather than a different source holding different data.[1]

Taken together, the panel held, the allegations left the causal chain speculative. Traceability at the pleading stage demands a plausible connection, and the classic formulation, drawn from Lujan v. Defenders of Wildlife, requires a causal link to the defendant and not to the independent action of some third party.[2][1] Because Santos-Pagan had not supplied one, she lacked standing, and the court affirmed the dismissal, closing the federal courthouse door to this complaint as pleaded.[1]

What turns on it

The ruling sharpens a line that matters more as breaches multiply. Standing doctrine asks not only whether someone was harmed but whether this defendant caused it, and when the same personal data may sit in a dozen stolen databases, proving which breach did the damage becomes genuinely hard.[2][5] The First Circuit did not say data-breach victims can never sue, since three years earlier, in Webb, it let such a case proceed.[3] It said the causal story must be pleaded with enough detail, timing, data types, and context, to make one breach the plausible source rather than a guess among many.[1]

That places real weight on facts a victim often cannot know at the outset, which is why the area stays contested across the federal courts, with judges divided over how much causal detail a breach plaintiff must muster before discovery.[5] The Supreme Court has tightened standing in recent years, insisting that a plaintiff show concrete, individualized harm rather than a bare statutory violation, and rulings like this one carry that instinct into the tangled forensics of stolen data.[4] What appears above traces the court's reasoning and where it drew the line, and is offered to explain the decision, not as legal advice.

The setup

The Klamath Project is a federal irrigation system run by the Bureau of Reclamation, the agency that manages much of the West's engineered water.[1] It draws from Upper Klamath Lake to water roughly 240,000 acres of farmland, while the same lake and the river below it are habitat for two endangered fish, the Lost River and shortnose suckers, and for the threatened coho salmon.[1] In dry years the demands collide directly, because water kept in the lake for the suckers, or sent downriver for the salmon, is water the farms do not get.[1]

To satisfy the Endangered Species Act, the federal wildlife agencies had issued biological opinions, formal scientific findings that set the minimum lake levels and river flows the fish require.[1][5] In 2021, amid severe drought, Oregon's water regulator ordered the Bureau to stop making those environmental releases and to honor state water rights instead.[1] The Yurok Tribe and others had already sued over the project's operating plan, the farmers' groups intervened to defend their deliveries, and the federal government asked the court to declare that the Act governed the project regardless of the state order.[1]

The trial court split the case in two. The first phase would decide only whether the Act applied to how the project is run, while a later phase would sort out the tribes' water rights, which are senior claims tied to their fishery.[1] In February 2023 the court ruled for the government on phase one, holding the Act applied and displaced the state order, and the losing parties appealed. The posture matters here: the panel was not deciding who owns the water, only whether one federal statute constrains the Bureau's operation of the works.[1]

The question

Section 7 of the Endangered Species Act forbids a federal agency from taking action likely to jeopardize a listed species.[5] The Supreme Court has since clarified that this duty attaches only to discretionary agency action, conduct the agency has real latitude to shape, and not to steps another law simply commands it to take.[3] So the question was whether operating the Klamath Project, under water-delivery contracts written decades ago, is the kind of discretionary action the Act reaches, or a set of fixed obligations that leaves the Bureau no room to act for the fish.[1] The panel took the legal question up de novo, owing no deference to how the district court had resolved it.[1]

The reasoning, walked

Writing for the majority, Judge Gould began with a 1999 Ninth Circuit decision, Klamath Water Users Protective Ass'n v. Patterson, which had already held that the Act governs the Bureau's operation of this very project.[2][1] That precedent, the majority said, still controls. The core of Section 7 is a firm command to protect listed species, and it applies to agency actions unless some specific conflicting mandate strips the agency of choice.[1]

The farmers argued that two later cases had changed the rules, the Supreme Court's Home Builders decision and the Ninth Circuit's 2024 ruling in Natural Resources Defense Council v. Haaland, both of which confine the Act to discretionary conduct.[3][4] The majority read those cases narrowly. They govern whether a competing legal duty eliminates an agency's discretion in a particular action, not whether the Act applies to the water project at all, and here the Bureau retained discretion.[1]

The source of that discretion, the majority found, was in the contracts themselves. Most of the delivery agreements promise water only when it is available and excuse the government during shortages caused by drought or 'other causes.'[1] The panel read that catch-all to include legal unavailability, water the Bureau cannot lawfully release because the Act requires it to stay in the lake or the river. On that reading, honoring the Act does not breach the contracts, because the contracts already bend to it.[1] The majority added that deciding the Act applies is not a judicial taking of anyone's property, since it does not determine who holds water rights, and that federal courts may resolve this federal question without waiting for the separate state water-rights case.[1]

Judge Nelson dissented on the central point. In his view the majority had skipped the analysis the newer cases demand.[1] A shortage clause that limits the government's liability, he wrote, is permissive. It shields the Bureau from being sued when water runs short, but it does not affirmatively grant the agency authority to redirect water to fish.[1] Pointing to the Haaland decision, he maintained that a duty to obey a mandatory legal command is not itself a source of discretion, and that the majority should have examined each contract on its own terms.[4][1] At least one agreement, he noted, appears to impose a non-discretionary duty to deliver, which on the majority's own logic should place that contract beyond the Act's reach.[1]

What turns on it

Underneath the water fight is a clean doctrinal disagreement about how a statute switches on.[1] Both judges accept that Section 7 governs only discretionary action. They divide on where discretion comes from, with the majority finding it in contract language that makes delivery contingent, and the dissent insisting discretion must be an affirmative power to act for the species rather than mere permission to withhold water when there is none.[1][4]

For the basin the practical stakes are immediate, because the ruling keeps the Endangered Species Act in control of a scarce resource during drought, ahead of the farmers' deliveries and short of the still-undecided tribal rights.[1][6] For the law it sharpens a question the Supreme Court's discretion rule left open, namely how much latitude an agency needs before its routine operations count as the kind of choices the Act can govern, a question likely to recur wherever old water contracts meet modern environmental duty.[1][3] What appears above is an explanation of the court's reasoning and the split within it, not legal advice.