The United States Court of Appeals for the First Circuit recently held that the lawsuits brought by certain individuals against Hannaford Brothers Co. based upon a data breach in 2007 may proceed. In Anderson v. Hannaford Bros. Co., decided last month, the First Circuit held that the costs incurred by plaintiffs who sought to minimize their exposure to the data breach were cognizable damages under Maine law. Such “mitigation damages” included the costs of replacement credit and debit cards as well as the costs of identity theft insurance. The fact that certain plaintiffs had incurred such damages even though their own personal data had not breached did not preclude their claims. So long as those costs were reasonable and were actually incurred, they were a sufficient to permit the causes of action for negligence and breach of implied contract to proceed.