An appellate court in Illinois reinstated a data breach class action complaint against a Chicago-based candy company employer, concluding the plaintiffs had standing to pursue damages because the alleged misuse of their personal information constituted an actual injury.