No identity theft occurred, but company still liable after data breach

So far, courts have been reluctant to penalize companies who suffer data breaches in cases where no customers can show they were the victims of identity theft. But that could be changing, if this recent lawsuit is any indication.