There is a great deal of misunderstanding concerning data security breach-related class actions. In large part the media and the legal media have exaggerated the quantity (and success) of class action litigation.
The following provides an overview of the risks associated with lawsuits following data security breaches.1
4%
The percentage of data breaches that lead to lawsuits. 2
|
3x
The increased odds of being sued if the breach was caused by a company’s unauthorized disclosure or disposal of data.3
|
6x
The decreased odds of being sued if a company provides free credit monitoring following a breach.4
|
52%
Settlement rate for data breach lawsuits.5
|
+30%
Increase in likelihood of settlement post class-certification. 6
|
10x
The increased odds of settlement where the cause of the breach is a cyber-attack.7
|
-25%
Decline in the quantity of data breach class action filings.8
|
-16%
Decline in unique defendants of class action filings.9
|
20
Number of different legal theories alleged by plaintiffs.10
|
What factors should you look at when considering the likelihood of receiving a class action complaint following a data breach:
-
Is a plaintiff’s firm looking at government records for information relating to your organization’s data security practices? For example, have they submitted requests to the FTC under the Freedom of Information Act?
-
Was the quantity of records lost lower, or greater, than the average number of records involved in recent class action lawsuits?
-
Did consumers suffer any direct monetary harm?
-
Could the data fields involved lead to identity theft?
-
Has there been any evidence of actual identity theft?
-
Did you offer credit monitoring, identity theft insurance, and/or credit repair services?
-
If so, what percentage of impacted consumers availed themselves of your offer?
-
Has the jurisdiction in which you are most likely to receive a lawsuit (g., where you are incorporated or primarily operate your business) permitted other data security class action complaints to proceed past the pleadings stage?
-
Has the media widely reported on your data breach?
-
If so, did the media report your data breach before, or after, the company notified impacted consumers?
