No actual injury’s no bar to data breach suit

[Audrey McNeil <audrey () riskbasedsecurity com>]

http://www.cincinnati.com/story/money/2014/09/27/actual-injurys-bar-data-breach-suit/16330683/

A federal court in Northern California recently ruled that victims of a
data breach could proceed with a lawsuit against Adobe System, Inc.,
despite the fact that none of the victims had yet been subject to identity
theft or any actual injury. According to the court, the imminent threat of
future harm was sufficient. That is good news not only for the plaintiffs
in this case, but potentially for future victims.

In the fall of 2013, Adobe reported hackers had breached the personally
identifiable information for 38 million Adobe users. Included in the hacked
information were names, Adobe IDs, passwords, credit and debit card
numbers, expiration dates, mailing addresses and e-mail addresses. Not
surprisingly, the breach led to a number of class action suits. Seven cases
were consolidated into one. The complaints centered around Adobe’s alleged
failure to maintain reasonable security practices to protect customers'
data and its failure to promptly notify customers following the breach.

While the class action filings may not come as a surprise, what may be
surprising is in many recent cases, plaintiffs have not come out on the
winning side. Many courts, following a 2013 U.S. Supreme Court case –
Clapper v. Amnesty International -- have held plaintiffs can proceed with a
lawsuit only if they can show an actual injury.

Victims of a data breach face two hurdles in courts that have adopted this
approach. First, in many cases, the class action suits get filed before any
harm occurs. Second, even if the plaintiff discovers some form of identity
theft, it's tough to prove that the particular theft arose from the
particular data breach. As a result, in many instances, a clear data breach
leaves victims with no meaningful remedy.

But the Adobe plaintiffs found a more sympathetic ear in Judge Lucy Koh. In
her view, the facts in Clapper – where a group of human rights activists,
journalists and lawyers challenged a wiretapping program and lost due to
their failure to show actual harm – didn’t apply in this case. Koh
concluded the hacking itself, in which the culprits obtained personal
information and decrypted credit card numbers, qualified as harm.

This decision is monumentally important in the area of data privacy. If it
winds its way to the Supreme Court, the ultimate ruling will dictate
whether and how data breach victims will be able to recover for hacker
attacks.

_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss
For inquiries regarding use or licensing of data, e-mail
        sales () riskbasedsecurity com 

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
YourCISO is an affordable SaaS solution that provides a comprehensive information security program that ensures focus 
on the right security.  If you need security help or want to provide real risk reduction for your clients contact us!