Tenth Circuit Broadens CFAA ‘Loss’ Beyond Technological Harm–Moxie V. Nielsen (Guest Blog Post)

Key Takeaways

• Tenth Circuit allows investigation costs as CFAA “loss” without tech harm
• Courts now may accept $5,000 expense claims to survive dismissal
• Decision risks turning ordinary credential misuse into federal computer crime
• Potential circuit split as other circuits still require technological damage

Pulse Analysis

The Computer Fraud and Abuse Act (CFAA) has long been anchored to technological harm, a principle clarified in the Supreme Court’s 2021 Van Buren decision. Yet lower courts diverged on whether the statute’s “loss” provision required proof of data corruption or could encompass broader response costs. This doctrinal split left practitioners uncertain about the viability of civil CFAA claims tied to internal investigations, prompting a patchwork of dismissals and approvals across districts.

In Moxie Pest Control (Utah) LLC v. Nielsen, the Tenth Circuit broke new ground by affirming that any reasonable cost incurred in responding to unauthorized access qualifies as a CFAA “loss,” even absent tangible system damage. The court emphasized the plain‑text language of §1030(e)(11), effectively lowering the evidentiary bar for plaintiffs to survive a motion to dismiss. By accepting a $5,000 investigative expense as sufficient, the ruling opens the door for a surge in CFAA lawsuits where the primary injury is the expense of forensic analysis or internal review, rather than actual impairment of computer systems.

The broader impact could be significant. If other circuits adopt the Tenth Circuit’s approach, the CFAA may become a versatile tool for competitors, platforms, or even advocacy groups to litigate over credential misuse and data access without demonstrating technical disruption. Conversely, courts that retain the technological‑harm requirement may view the Tenth’s stance as an overreach, potentially leading to a definitive circuit split that the Ninth Circuit could resolve in upcoming cases like Perplexity AI’s appeal. Practitioners should now reassess pleading strategies, ensuring that loss allegations are either tightly linked to system damage or, where appropriate, framed around concrete investigative expenditures to meet the emerging standard.