Litigation following a data security breach generally falls into two categories, says Peter Swire, a law professor at The Ohio State University and senior fellow with the Center for American Progress.
Litigation occurs between businesses when one suffers financial harm as a result of the breach incident, such as a bank seeking reimbursement from a retailer victimized by credit card fraud. Swire says it’s easy to prove financial harm between companies because there’s a record of the fraudulent transactions—and those monetary losses can total millions of dollars.
Class action lawsuits spring up almost immediately after word gets out about major data incidents, says Kirk Nahra, a partner at Wiley Rein and chair of its privacy group.
"It’s a race," he says. "And most of them are filed before anything bad has happened."
Often, companies reach settlements before the case ever goes to trial, even if there’s no evidence of actual harm.
But when there is proof of negligence or actual damage, the consequences for companies can be severe.
"Where companies lacked security practices and computers were put at risk of identity theft, it’s a pretty sympathetic case for the plaintiffs," Swire says.