Cyber Insurance Litigation

One of the most interesting circumstances arising from the Excellus data breach is the “ho-hum” attitude with which most readers will greet it. Data breach has become a fact of corporate life. Phishing, malware, cyber extortion and hacking are now terms with which we are all familiar. Readers do not need another article to warn them of the dangers of data breach.

Federal courts have done little to protect corporate data breach victims. In Remijas v. Nieman Marcus Group, 794 F.3d 688 (7th Cir. 2015), for example, class action plaintiffs were not required to show that they incurred any direct damage as a result of identity theft. In Federal Trade Commission v. Wyndham Worldwide, 799 F.3d 236 (3d Cir. 2015), the court held that the FTC maintained enforcement power over data breaches and could find, as a basis of liability, that the company's internal privacy network was inferior to what was portrayed in its public statements. Finally, in the Target Corporation Customer Data Security Breach Litigation, Case No. 0:14-md-02522 (D. Minn.), the court certified a class action of banks and other credit card issuers for the damages that they incurred in replacing credit cards.