One week after\u00a0Equifax Inc. revealed a cybersecurity incident<\/a>\u00a0impacting some 143 million U.S. consumers, the credit reporting behemoth is facing legal and reputational repercussions of massive proportions.<\/p>\n For a legal department led by\u00a0corporate vice president and chief legal officer John Kelley III<\/a>, who seemingly has the last word on company security and compliance matters, the coming months and years are sure to be rife with high costs and what will likely be hard-fought battles to limit the damage done by class action suits.<\/p>\n Current external troubles for Equifax, which declined to comment for this story, began with the\u00a0Sept. 7 announcement<\/a>\u00a0that sensitive consumer information, such as Social Security numbers, driver\u2019s license numbers, birth dates and addresses, had been compromised. The incident, which was first discovered on July 29, prompted a\u00a0number of investigations<\/a>, backlash because of the\u00a0company\u2019s response<\/a>\u00a0and criticism due to a credit report monitoring site that\u2019s\u00a0vulnerable to hackers<\/a>. Added to that are more than 20 proposed class actions suits, and counting.<\/p>\n Just hours after the announcement of the breach, a\u00a0proposed class action suit<\/a>\u00a0was filed in the U.S. District Court for the District of Oregon in Portland, claiming Equifax negligently failed to maintain adequate technical safeguards to protect consumers. At least 22 proposed class actions have followed, claiming everything from\u00a0violation of the Fair Credit Reporting Act<\/a>\u00a0and\u00a0federal securities laws<\/a>\u00a0to\u00a0breach of contract and violation of the California Data Breach Act<\/a>.<\/p>\n Historically, data breach class actions have been far from a sure thing for consumers, largely because courts sometimes find that there\u2019s no tangible injury. In a\u00a0May 2 decision<\/a>, for instance, the U.S. Court of Appeals for the Second Circuit rejected the argument that the threat of future harm as a result of a data breach at a Michaels Stores Inc. location was enough to establish standing.<\/p>\n On the other hand, the\u00a0U.S. Court of Appeals for the District of Columbia<\/a>, the\u00a0Seventh Circuit<\/a>\u00a0and the\u00a0Third Circuit<\/a>\u00a0have all ruled recently that victims may pursue data breach claims without showing actual loss.<\/p>\n These cases are often dismissed because it\u2019s very difficult to show causation of harm, according to Laura Jehl, a partner at Baker & Hostetler, who was formerly general counsel and chief privacy and security officer at Resolution Health Inc., a subsidiary of Anthem Inc., where she helped handle a January 2015 cyberattack affecting 80 million customer records. If somebody steals a person\u2019s identity or goes and files a fraudulent tax return, she explained, it\u2019s a challenge to prove it was Equifax because it could be the result of any other of a number of breaches, which leads to courts having a \u201cdifficult time with standing.\u201d<\/p>\n What\u2019s more, if someone\u2019s identity is compromised, for many it\u2019s an uphill battle to show a tangible injury, as claims often center around the concern that there may be issues in the future, said Guillermo Christensen, partner at Brown Rudnick, who was formerly a CIA intelligence officer.<\/p>\n But with the cases against Equifax, given the high sensitivity of data that was compromised, he said plaintiffs might be able to get over this hurdle in court. \u201cI think you have a stronger potential to show that you are going to spend the rest of your life or the next couple of years, anyway, at risk of people taking advantage of [compromised] information and that that prospect will impact your choices and what you do and how you do things,\u201d he said.<\/p>\n It\u2019s one thing to have credit card info compromised, said Edward McAndrew, partner at Ballard Spahr. \u201cIt\u2019s quite another to have dates of birth, Social Security numbers, driver\u2019s licenses numbers accessed.\u201d<\/p>\n \u201cI think that\u2019s why the standing analysis is going to be far different here than any of the other data breach cases we\u2019ve seen,\u201d he added.<\/p>\n At the moment, there\u2019s a\u00a0push to consolidate<\/a>\u00a0all the class actions against Equifax into multidistrict litigation in the U.S. District Court for the Northern District of Georgia, but it\u2019s not yet decided if or where MDL will take place, and this could be key to the outcome for Equifax\u2019s legal department.<\/p>\n Initially, Jehl explained, these cases were often consolidated in the home district of the entity, which would be Georgia for Equifax, but more recently the jurisdiction where the predominant number of cases have been filed is also being considered.<\/p>\n \u201cThere\u2019s often a lot of strategizing among plaintiffs\u2019 counsel and among others in trying to get that center of gravity in a place where it may be more favorable,\u201d Jehl said.<\/p>\n Equifax and its in-house lawyers will also face costs in dealing with litigation and forensic investigations that could climb into the tens of millions of dollars.<\/p>\n History shows the high price tag of data breaches. Since\u00a0The Home Depot Inc.\u2019s breach<\/a>\u00a0in 2014, for example, the company has incurred roughly $200 million in pretax net expenses, according to a U.S. Securities and Exchange Commission\u00a0filing from earlier this year<\/a>. The\u00a02013 hack of Target Corp.\u2019s systems<\/a>, as of a 2015 SEC filing, had\u00a0cost the company around $160 million<\/a>\u00a0in net expenses. And after\u00a0Yahoo Inc.\u2019s two massive data breaches<\/a>, the company\u00a0reported in March<\/a>\u00a0$16 million in expenses, $5 million of which was associated with the ongoing forensic investigation and remediation activities and $11 million was associated with nonrecurring legal costs.<\/p>\n Given the enormity of this breach, it wouldn\u2019t be unexpected for Equifax to rack up a fairly hefty bill, McAndrew said. \u201cAbsent major class action litigation, the forensic investigative fees are usually greater by some multiplier than the legal fees. Now we\u2019re shifting into class action mode, though, so those fees are going to skyrocket,\u201d he said. \u201cI will not be surprised if, at the end of the day, Equifax\u2019s total for legal fees is in excess of $100 million.\u201d<\/p>\n For Equifax, legal and forensic costs will likely be \u201cenormous,\u201d Christensen echoed. For a breach of any size, you want to bring in a security firm\u2014Equifax is\u00a0reportedly relying on Mandiant<\/a>\u2014and then you want to bring in lawyers who know breach laws in every state and who can defend the company in litigation, he said. \u201cSo they are going to have a lot of people on their payroll for a long time to deal with this.\u201d<\/p>\n Not to mention, Christensen added, a corporate crisis like this can take away from a company\u2019s ability to conduct its regular business. \u201cIt\u2019s a big distraction that can have, obviously, long-term consequences for the health of the company,\u201d he said.<\/p>\n<\/p><\/div>\n One week after\u00a0Equifax Inc. revealed a cybersecurity incident\u00a0impacting some 143 million U.S. consumers, the credit reporting behemoth is facing legal and reputational repercussions of massive proportions. For a legal department led by\u00a0corporate vice president and chief legal officer John Kelley III, who seemingly has the last word on company security and compliance matters, the coming … <\/p>\n![\"\"](\"http:\/\/images.law.com\/contrib\/content\/uploads\/sites\/292\/2017\/09\/Equifax-Atlanta-HQ-Article-201709142225-1.jpg\")
<\/a><\/p>\nWill Class Actions Survive?<\/b><\/h2>\n
High Legal Costs<\/b><\/h2>\n
\n
Source link <\/a>
\n<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"