When Elephant Insurance was hacked and millions of driver’s license numbers were exposed, the Fourth Circuit confronted a crucial privacy law dilemma: Is data theft alone enough to sue, or must harm be public and provable? This case exposes how U.S. courts still undervalue privacy in the digital age — and why the elephant in the room is far from irrelevant.