A global snapshot of data breach class actions

In brief

While we are yet to see a successful data breach class action in Australia, data breach class actions have become all too real for many major companies overseas. This article takes a look at some of the most high-profile data breach class actions that have occurred in other jurisdictions, to examine how the cases were framed and the various ways these claims have played out.

Key takeaways

• Different class actions, similar outcome. Recent times have seen several high profile data breach class actions brought against major companies in other jurisdictions like the US and Canada. Although each class action was brought in different circumstances – with varied causes of action and by different classes of affected individuals – the outcome has typically involved a large settlement at considerable financial cost and reputational damage for the company.
  • After Target suffered a cyberattack that compromised the credit and debit card information of 40 million customers, it faced a raft of class actions from three key stakeholders – consumers (in negligence, breach of contract and unjust enrichment, among others), financial institutions (in negligence) and shareholders (for breach of fiduciary duty). The former two categories of class action were successful, and resulted in settlements of $10 million and $39.4 million, respectively, while the shareholder suit was dismissed.
  • Yahoo suffered three data breaches between 2013 and 2016, which it revealed to the public in late 2016. It subsequently faced claims from consumers and shareholders under a number of specific US statutes, and settled the claims for a combined sum of $127 million.
  • A Canadian consumer class action against Home Depot in the aftermath of its 2014 data breach, which involved various cause of actions (including breach of confidence, breach of privacy, breach of fiduciary duty, breach of contract, negligent misrepresentation and negligence), resulted in Home Depot establishing a settlement fund of $13 million. Wendy's, AvMed and Anthem have also settled data breach class actions in the US within the past decade.
• These cases are not a reliable indicator of which claims would succeed in Australia. Given that most of the class actions settled before reaching open court, it is difficult to ascertain which of the many claims that the plaintiffs brought would have been successful in court. Moreover, these class actions were brought in foreign countries with laws that are in many respects more favourable to class action plaintiffs than Australian law. In a recent example close to home, a class action against the NSW Ambulance Service has been brought on the basis of alleged breach of confidence, breach of the tort of invasion of privacy, breach of contract and misleading and deceptive conduct. While this case remains on foot, it will be interesting to see which (if any) of these claims succeed in an Australian context. For more information, see our article Where are all the data breach class actions in Australia?.
• Settlements are not always lucrative for individuals. Despite settlement sums being substantial, affected individuals often receive a minimal sum once the settlement is divided amongst group members.
• Settlement often requires more than financial compensation. It may require the affected company to provide remedial services at no cost (eg identity/credit monitoring or fraud resolution services) or to undertake to implement upgrades to IT systems or tighter data-security policies and procedures.

Target

What happened?

More than 140 lawsuits (including several class actions) were filed against Target following a cyber-attack in which hackers stole credit and debit card information for 40 million Target customers,¹ as well as home and email addresses for an additional 70 million customers. The courts grouped these lawsuits into three categories – consumers, financial institutions and shareholders. For a more detailed summary of this case, see Spotlight: Cyber breach at Target.

Consumer class action

• The claim: Consumers accused Target of negligence in its handling of customer data, violation of state consumer laws and state data breach laws, breach of contract, breach of duty of care in relation to the failure to adequately protect customers' data, and unjust enrichment because part of the money paid for goods and services should have been, but was not, used by Target to provide adequate safeguards and security measures.
• The outcome: Target set up a US$10 million consumer fund for affected consumers, following from several class actions through which affected consumers with documented losses could receive reimbursement up to US$10,000. Target also agreed to pay legal fees and costs involved with administering the settlement payment. Between November 2015 and May 2017 more than 225,000 individuals submitted claims for reimbursement under the settlement.²

Financial institutions

• The claim: Financial institutions (making up 29 of the more than 140 claims) sought reimbursement from Target for costs arising from the breach, claiming that Target was negligent as its data security was insufficient and it had failed to implement or adhere to federal laws surrounding processing credit card payments. It was alleged that at least 40 million credit cards were compromised.
• The outcome: Target agreed to pay US $39.4 million to resolve claims brought by the banks, as well as settling with Visa for US$67 million and MasterCard for US$39 million.

Shareholder class action

• The claim: Target shareholders filed several derivative lawsuits (which were later consolidated) against Target's board, alleging that the directors had breached their fiduciary duties by failing to take sufficient steps to protect the company from a breach.
• The outcome: Ultimately, this claim proved to be unsuccessful and the case was dismissed on 7 July 2016.

Much like the plaintiffs in the Target class action, we expect that plaintiffs in Australia will seek to launch multiple claims in the hope that at least one is successful. Unfortunately, the fact that the majority of the Target claims have settled makes it difficult to determine which of the many claims would have succeeded at trial.

Yahoo

What happened?

A series of ongoing lawsuits have followed three data breaches which occurred between 2013 and 2016 but were not revealed to the public until late 2016.

• The first breach occurred in 2013, when hackers gained access to Yahoo accounts and stole users' login details, country codes, dates of birth, phone numbers and post codes. Yahoo did not disclose this breach until 2016, when it announced that the accounts of 1 billion users had been affected. However, in October 2017, Yahoo announced that the 2013 breach had actually affected every user account – approximately three billion users.
• The second breach occurred in late 2014, when a handful of high-level Yahoo employees fell for an email scam. Breached were 500 million Yahoo user accounts and email addresses, dates of birth information and passwords were disclosed. In 2016 it was reported that the stolen data was purchased on the dark web by three separate buyers for around $300,000 apiece.³
• The third breach occurred sometime between 2015 and 2016, when hackers used forged cookies to access Yahoo users' accounts. Essentially, this meant that hackers were able to access Yahoo accounts for long periods of time, without needing a password.

While the class actions brought against Yahoo focused on these three breaches, it is worth noting that previous breaches (one as early as 2003) formed part of the evidence in the consumer class action, on the basis that Yahoo should have been put on notice of the need to enhance its data security, well before these attacks occurred.

Shareholder class action

• The claim: These data breaches, and the delay in their disclosure, proved to be particularly problematic for Yahoo in light of its potential sale to Verizon Communications. Following Yahoo's announcement of the data breach on 22 September 2016, Yahoo's share price began to fall rapidly (initially falling 3.06%, and then a further 6.11% in December).
• Yahoo shareholders brought a class action under the Securities Exchange Act of 1934 alleging that Yahoo had made false and misleading statements regarding the company's business, operational and compliance policies. The case centred around a drop in the company's share price, and the impact that this had on the value of Yahoo's sale to Verizon.⁴ For more on its settlement with the SEC, see Yahoo continues to pay the price for its 2014 data breach.
• The outcome: In April 2018, the class action settled for $80 million.⁵

Consumer class actions

• The claims: The main consumer class action faced by Yahoo in the US grouped together affected individuals from a number of jurisdictions (US, Israel, Australia and Venezuela) and also involved a separate class for small businesses who held Yahoo accounts.

  In addition to making claims under specific statutes in the US, the different jurisdictional and user groups have made claims for breach of express contract, breach of implied contract, breach of implied covenant of good faith and fair dealing, fraudulent inducement and negligence.⁶

• The outcome: In March this year, Yahoo sought to have the class action dismissed.⁷ The company was unsuccessful in shrugging off most of the claims, and instead it opted for settlement. On September 17, Altaba, the company that resulted from Verizon's acquisition of Yahoo, announced that it had agreed to settle the consumer class action suit for a sum of $47 million.⁸ A motion for preliminary approval of the settlement is expected on 22 October.⁹

Home Depot

What happened?

In 2014, Home Depot suffered a high-profile data breach that targeted its self-checkout systems, resulting in unauthorised access to third-party vendor credentials and over 50 million debit and credit card details. The breach led to 44 lawsuits across the US and Canada.

Consumer class action

• The claims: Of particular note was a class action lawsuit brought in Canada on the basis of negligence, breach of confidence, breach of privacy, breach of fiduciary duty, breach of contract and negligent misrepresentation.¹⁰ In this case, it was argued that there were three heads of damage to consumers from the credit card breach: (i) the risk of a fraudulent charge; (ii) the risk of identity theft; and (iii) the inconvenience of monitoring credit card statements for potential fraud. Interestingly, in this case, despite a lack of evidence that any class member had actually suffered a fraudulent charge, a substantial settlement was reached by the parties and approved by the court.
• The outcome: A $13 million settlement fund was established to compensate affected individuals for documented losses as well as time spent remedying issues relating to the breach (up to $5,000). Home Depot also provided affected individuals with access to free identity monitoring services for 18 months.

Wendy's

What happened?

Between October 2015 and June 2016 Wendy's suffered a data breach when compromised third-party credentials were used to access the company's point-of-sale systems. More than 1,000 locations were affected, and the payment card data of an unknown number of customers were accessed, including each customer's name, account number, expiration date, PIN code and card-verification number. The breach was discovered and reported in January 2016, when Wendy's noticed unusual activity at its restaurant locations. At this stage, Wendy's reported that the breach affected fewer than 300 restaurants. However, by 9 June 2016, once further investigations had been undertaken, Wendy's issued a press release¹¹ disclosing the earlier representations regarding the limited scope of the data breach were not complete, and that the breach had continued for a further six months after its discovery in January 2016. In 2016, Wendy's was subject to a class action brought by affected customers, as well as a shareholders' derivative class action brought against current and former directors and executive officers.

Consumer class action

• The claim: Wendy's customers filed a class action alleging that Wendy's failed to use proper data security to protect customers' payment card data, and failed to provide notice that the credit card information had been compromised. The class action alleged breach of implied contract, breach of consumer protection laws and negligence.
• The outcome: In July 2016, the class action was dismissed, on the basis that the claims alleged were 'highly speculative'. In 2017, the plaintiffs filed a second amended complaint, and moved for certification of a nationwide class of customers, broadening the potential number of affected individuals who could join the consumer class action. Following this, the parties entered into mediation, ultimately reaching a settlement agreement in May 2018.

Shareholder derivative class actions

• The claim: The claim was brought against certain members of Wendy's board and particular executive officers on the basis of alleged breaches of state privacy laws and breach of fiduciary duty.¹²
• The outcome: A further derivative class action was brought, and the two class actions were consolidated. Upon the consolidation of the claims, settlement discussions commenced, and on 6 May 2018, preliminary approval of the settlement was sought. The settlement specifies¹³ that Wendy's must introduce a board-level Technology Committee, additional security services and implement additional processes, policies and procedures. Further, Wendy's D&O insurer agreed to pay $950,000 as an award of attorneys' fees and reimbursement of expenses to the shareholders' counsel.

AvMed

What happened?

In 2009, two laptops owned by health insurance provider AvMed were stolen, and the names, social security numbers, address and phone numbers of more than one million customers were compromised.

Class action

• The claims: A claim was brought on the basis of negligence, breach of contract and unjust enrichment, for the company's failure to properly protect the data.

This was a particularly interesting case, as even individuals who were unable to prove loss were able to claim damages. This was because even where an individual had not been the victim of identity theft, the matter was pleaded on the basis that AvMed was unjustly enriched by the receipt of insurance premium in exchange for insufficient measures to protect their data. While AvMed attempted to have this claim struck out, the Eleventh Circuit ultimately concluded the plaintiffs had a viable unjust enrichment case, and reasoned that the monthly premiums paid by customers should have been used by AvMed to cover the costs of adequate data security, which the company failed to do.¹⁴

• The outcome: In 2014, the parties reached a $3 million settlement.

Anthem

What happened?

In February 2015, Anthem disclosed that hackers had accessed health insurance records during a data security breach that occurred sometime between December 2014 and February 2015. This resulted in the theft of personally identifiable information and personal health information of around 80 million current and former health insurance plan members.

Consumer class action

• The claim: A class action, consolidating claims across a number of states in the US, was brought by affected individuals claiming that Anthem failed to take security precautions to protect their data. The class action claimed negligence, unjust enrichment, breach of statute (consumer protection, medical privacy, insurance privacy and data breach notification statutes) and breach of contract.¹⁵
• The outcome: A US$115 million settlement agreement was approved by a federal judge in California on 20 August 2018.¹⁶ Most of the settlement fund will be used to fund two more years of credit monitoring and fraud resolution for affected individuals. However, as part of the settlement sum, Anthem is required to make changes to its data security systems and policies, as well as increase its cybersecurity budget.

This case provides an interesting insight into how loss is quantified, and certainly confirms that despite large settlement sums being reached, often affected individuals will receive minimal recovery once a settlement sum is divided amongst group members. In this instance, District Judge Lucy H. Koh noted that the settlement, representing approximately 14.5% of the class members total claims, was 'within the range of reasonableness after taking into account the costs and risks of litigation'.

New South Wales Ambulance Service

What happened?

Between 14 January and 1 February 2013, a contractor of the NSW Ambulance Service accessed, compiled, and sold the medical records of ambulance employees without their knowledge or consent.

Employee Class Action

A claim has been brought on behalf of all NSW Ambulance employees whose sensitive health and personal information was involved in the incident, against both the Health Administration Corporation and Waqar Malik, a contractor of the NSW Ambulance Service. The class action has been brought on the basis of alleged breach of confidence (in equity), breach of contract, breach of the tort of privacy, and misleading and deceptive conduct. As well as damages for breach of contract and misleading and deceptive conduct, the plaintiffs are claiming losses sustained as a result of psychiatric illness, distress, embarrassment and injury to feelings as a result of the breach. This case provides an interesting insight into how data breach class actions might be pursued in Australia, and we will be watching this case with great interest to see which (if any) of the claims are successful.