In Remijas v. Neiman Marcus, the court held increased risk of loss was imminent, noting: “Why else would hackers break into a ... database and steal consumers’ private information? Presumably, the purpose of the hack is, sooner or later, to make fraudulent charges or assume those consumers’ identities.”
The court's position is plausible. According to a 2017 study, "Consumers reported $905 million in total fraud losses in 2017, a 21.6% increase over 2016. The with a median amount lost was $429. 21% of the consumers who reported a fraud-related complaint lost money." https://www.experian.com/blogs/ask-experian/identity-theft-statistics/