In a decision issued December 9, 2021, a Massachusetts Federal District Judge sitting by designation in the District of Puerto Rico dismissed a class action suit arising from a ransomware attack involving two Puerto Rico hospitals. In reaching its decision, the Court noted that the issue was whether a “pure ransomware attack” under which data is held hostage but not stolen is a sufficient injury to confer standing. The Court noted that the allegations in the case are sufficient to show that a pure ransomware attack occurred, but they provide only “speculative and conclusory” statements that any data was actually accessed, stolen or misused. The Court observed that there is no First Circuit precedent concerning whether the possibility of future misuse of data in a pure ransomware attack can confer standing. The Court relied in part on the hospitals’ communications to patients that there was no exfiltration of data to support a conclusion that patients suffered an injury at this time. Absent evidence of access and misuse of the data, the affected patients lack standing to sue.