Data Breach Suits Average Filing Within 4 Weeks of Breach Announcement

Private civil litigation is “now a probability, not a possibility,” after a major data breach, warned the Quinn Emanuel law firm Friday. It counted 36 major data breach class actions as having been filed in 2021, a 44% increase from 2020, it said: “Private plaintiffs typically race to the courthouse to jockey for position, with complaints now brought on average within four weeks of a breach announcement.” Defendants should expect to see “novel injury theories with increasing frequency as data breach law continues to mature,” it said. Litigation exposure “will be difficult to gauge in the near term, especially given the dearth of clear precedent and material differences in both the standing and merits analyses undertaken by different jurisdictions,” it said. Litigation risk will also increase as data breaches become more prevalent and affect greater numbers, “as even nominal damages -- when aggregated -- can produce extraordinary recoveries,” it said. Though most data breach cases are brought on behalf of plaintiffs whose personally identifiable information was actually or potentially accessed, “spillover into other areas is likely,” it said: “Shareholders may increasingly seek to hold executives and board members liable for failing to adopt ‘reasonable security measures’ to prevent cybercrime.”