Breach Costs Are Rising with the Prevalence of Lawsuits

by nlqip
April 23, 2024

Figure 1: Cost of confidential data breach – F5 Ponemon security survey

What do breach costs consist of? They can include anything from incident response investigation costs, remediation costs, reputation damage, loss of sales, operational downtime, and compliance penalties. Another significant cost that hasn’t historically been a major contributor to breach costs but is now becoming more and more frequent, is lawsuits. We decided to get some hard numbers to compare to our survey responses. Lawsuit settlements for large data breaches are public knowledge, so we compiled this review of data breach lawsuits resulting from cyber-attacks.

Class Action Lawsuits

The most common source of monetary damages in lawsuits comes from class action lawsuits, where a single plaintiff sues on behalf of a class of injured parties. Usually the suit represents all of the breached users in a single lawsuit. Other times, separate lawsuits are combined into a single class action lawsuit. Here is a summary of some of the more notable class action lawsuits from the past few years:

Defendant	Settlement	Year	Breach case	Justification
Stanford Hospital	$4.1 million	2010	Medical information of nearly 20,000 Stanford Hospital emergency room patients was published online¹	Violation of the Confidentiality of Medical Information Act
St. Joseph Health System	$3 million	2012	Breach of 31,800 patient health records ²	Violation of the Confidentiality of Medical Information Act (CMIA); negligence, violation of the California Unfair Competition Law, California Business and Professionals Code
LinkedIn	$1.25 million	2012	Cyber-criminals published 6.5 million user passwords online	Premium subscribers purchased service with the understanding that LinkedIn offered industry-standard security
Target	$39 million	2013	Malware compromised 42 million payment cards & names and addresses of 61 million customers⁴	Banks lawsuit to compensate for losses
Vendini	$3 million	2013	Events ticket seller website hacked; customer names, contact information, and payment card information were stolen⁵	Allowed customer information to be put at risk
MAPCO Express	$1.9 million	2013	Breach of the retailer’s computer systems⁶	Inadequate security systems
Neiman Marcus	$1.6 million	2013	Breach compromised the credit card data of approximately 350,000 customers⁷	Violation of state unfair business practice statutes, invasion of privacy, state data breach acts, unjust enrichment, breach of implied contract, and negligence
Home Depot	$13 million	2014	Breach of point-of-sale systems by payment card stealing malware⁸	Failure to implement adequate protection
Sony	$8 million	2014	Employees personal information exposed in a massive data breach⁹	Negligence and privacy violations
Yapstone	$4.9 million	2014	Use of unsecured web addresses caused- data exposure¹⁰	Failure to take reasonable steps to keep its users’ data secure.
Tampa General Hospital	$10,000	2014	Former employees inappropriately accessed patient information¹¹	Negligence, breach of fiduciary duty, breach of implied contract, violation of the Florida Deceptive and Unfair Trade Practices Act
PNI Digital Media	$250 per person	2014	Hackers used malware to capture user information on PNI servers¹²	Reimbursement for losses
Anthem, Inc.	$115 million	2015	Breach of 80 million current and former U.S. customers and employees¹³	Negligence, failure to provide adequate and timely notice
Ashley Madison	$11.2 million	2016	data breach exposed 36 million accounts¹⁴	Poor security and deceptive business practices
Seagate Technology	$5.75 million	2016	Scammed out of current and past employees’ W-2 forms¹⁵	Negligence

States Attorneys General Lawsuits

Class action suits by data breach victims aren’t the only lawsuits that impact breached organizations. States Attorneys General have also filed and won legal settlements on behalf of their citizens whose information was breached. Some “repeat customers” like Target and Ashley Madison received more financial judgements as a result of the same large breach.

Defendant	Settlement	Year	Breach case	Attorney(s) General
Nationwide Mutual Insurance	$5.5 million	2012	Breach affecting more than 1.2 million individuals because of failure to apply a critical security patch¹⁶	32 states and the District of Columbia
Target	$18.5 million	2013	Malware compromised 42 million payment cards & names and addresses of 61 million customers¹⁷	47 states and the District of Columbia
Adobe	$1 million	2013	Breach of Adobe public-facing servers to steal customer data¹⁸	15 state attorneys general
Cottage Health System	$2 million	2013, 2015	2 breaches exposed 55,000 patients’ data because of lack of encryption, password protection, or firewall¹⁹	California
Hilton	$700,000	2015	Data breach of 350,000 payment cards; defendant lacked reasonable data security and waited too long to report²⁰	New York and Vermont
Ashley Madison	$11.2 million	2016	Data breach exposed 36 million accounts	13 states plus the District of Columbia

Federal Trade Commission Lawsuits

At the national level, the Federal Trade Commission (FTC) has never been shy about stepping up with its own lawsuits against organizations that fail to protect customer data. Again, we see repeats, like Ashley Madison.

Defendant	Settlement	Year	Breach case	Reason
Ashley Madison	$1.6 million	2016	Data breach exposed 36 million accounts²¹	Deceived consumers and failed to protect; defendants assured users their personal information was private and securely protected
Vtech	$650,000	2015	Unauthorized party accessed VTech customers, 6.4 million children and 4.9 million adults²² ^, ²³	Failed to provide direct notice to parents or obtain verifiable consent from parents as required under the Children’s Online Privacy Protection Act (COPPA)

Shareholder Lawsuits

Publicly held companies can also be subject to shareholder lawsuits. Yahoo got hit with an $80 million data breach-related securities class action lawsuit²⁴ for negligence and failing to protect and inform consumers. Shareholders were especially angry since this breach cut $350M from the sale price to Verizon.²⁵

Future Pending Lawsuits

These are just a few examples; many more lawsuits are adjudicating now. In the coming months and years, we can look forward to resolution of the following lawsuits:

Arby’s — class action lawsuit regarding POS malware and failure to properly secure its customers’ payment card data
CareFirst — lawsuit for 2014 compromise of approximately 1.1 million customers’ data
Chipotle — lawsuit regarding a 2017 data breach in which the company failed to adequately protect personally identifiable information
Equifax — An unprecedented 50-state class-action lawsuit tied to the 2017 breach of 145.5 million individuals’ data
Forever 21 — lawsuit for 2017 breach of payment card data due to encryption being turned off on some POS devices
GameStop — class action lawsuit for deceptive trade of consumer shopping data exposed on the company’s online store between August 10,2016 and February 9, 2017
GameStop — class action lawsuit for the 2016 theft of payment card data under inadequate cybersecurity
Intercontinental Hotels — class action lawsuit related to 2017 POS malware infection
P.F. Chang — class action lawsuit for exposure of 7 million payment cards in 2014
Sonic restaurants — class action lawsuit alleging negligence regarding a point-of-sale (POS) hack that exposed customer payment card data
Sprouts natural foods store chain — class action lawsuit relating to a phishing scam and the loss of employee W-2 information
Sunrun — class action lawsuit for 2017 hack into the company’s payroll system, leaking thousands of employee’s financial data
Tempur Sealy — class action lawsuit regarding malware infection in 2016 that stole payment card data at hosting provider Aptos’ platform
Uber — lawsuit alleging substantial negligence in the loss of data of 50 million customers and 7 million drivers

Assume Breach—and Have Good Lawyers on Retainer

As you can see, there are many justifications for a data breach lawsuit, including breach of contract, negligence, breach of covenant of good faith, unfair competition (breached organization is spending less than its peers’ standard on cyber-defense), misrepresentation or deceptive acts (related to cyber-defense practices), breach of fiduciary duty, and violation of state breach notification laws.

It’s been said that bulls do not win bullfights, people do; and people do not win people fights, lawyers do.²⁶ Even if an organization does well in a lawsuit settlement, there are still attorney fees to consider. Adobe racked up $1.18 million in legal fees ²⁷ while Ashley Madison spent $3.7 million on its defense.²⁸ Target takes the prize with a whopping $202 million in legal fees and related costs associated with its breach.²⁹ Indeed, lawyers are even more expensive than security personnel! With breaches breaking out everywhere, it pays to support your legal team with a solid plan for dealing with liability and a good foundational security posture. Even if you aren’t at fault, if you get hit with a breach, you can expect a lawsuit, or lawsuits, to come your way.

More to come in our Application Protection Report July 25th

The perspective to write this article was actually derived from a Ponemon survey we conducted for an upcoming security flagship report. We asked security pros to estimate the potential damage of a breach, and decided to chase down some hard numbers to compare against their estimates. Be on the lookout for more in-depth analysis and findings to come in our Application Protection Report, which will be published here on F5 Labs on July 25, 2018!

Source link
lol

Figure 1: Cost of confidential data breach – F5 Ponemon security survey What do breach costs consist of? They can include anything from incident response investigation costs, remediation costs, reputation damage, loss of sales, operational downtime, and compliance penalties. Another significant cost that hasn’t historically been a major contributor to breach costs but is…