Data breach

Subscribe to Data breach

As I have noted in numerous posts on this site (most recently here), the plaintiffs’ track record in data breach-related securities class action lawsuits is mixed at best. To be sure, there have been cases in which plaintiffs’ have prevailed, but overall the plaintiffs’ track record in data breach-related securities suits has been poor. In the latest setback for plaintiffs in these kinds of cases, the Ninth Circuit has affirmed the trial court’s dismissal of the data breach-related securities suit filed against Zendesk. A copy of the Ninth Circuit’s March 2, 2022 Opinion in the Zendesk case can be found here.
Continue Reading Ninth Circuit Affirms Zendesk Data Breach Securities Suit Dismissal

In the latest example of claimants seeking to assert the newly revitalized type of claim for breach of the duty of oversight against corporate boards, plaintiff shareholders have filed a derivative lawsuit in Delaware Chancery Court against certain past and current directors of technology company SolarWinds, based on the massive cybersecurity incident involving the company’s software and systems discovered in December 2020. As discussed below, there are several interesting features of this lawsuit in light of recent developments involving claims for alleged breaches of the duty of oversight. A copy of the heavily redacted publicly available version of the plaintiffs’ complaint against the SolarWinds board can be found here.
Continue Reading Cybersecurity-Related Breach of the Duty of Oversight Claim Filed Against SolarWinds Board

Rachel Soich

As I have noted in prior posts on this site, cybersecurity issues can lead to D&O claims. In the following guest post, Rachel Soich, FCAS, MAAA. Consulting Actuary at Milliman, considers steps that companies can take to avoid cyber-related D&O costs. A prior version of this article previously was published in Milliman Insight. I would like to thank Rachel for allowing me to publish her article as a guest post on this site. I welcome guest post submissions from responsible authors on topics of interest to this blog’s readers. Please contact me directly if you would like to submit a guest post. Here is Rachel’s article.
Continue Reading Guest Post: Three Ways to Avoid Cyber-Related D&O Costs

In an interesting development, the U.S. District Court Judge overseeing the cybersecurity-related securities class action lawsuit pending against title insurance company First American Financial Corp. has granted the defendants’ motion to dismiss. The dismissal in the case is interesting because the company had in June 2021 agreed with the SEC to enter a cease-and-desist order and to pay a modest civil penalty to settle charges related to the same cybersecurity incident. The dismissal is also interesting because it shows how plaintiffs’ lawyers have struggled to get traction with cybersecurity-related securities suits. A copy of the Court’s September 22, 2021 order granting the motion to dismiss in the First American securities suit can be found here.
Continue Reading Cybersecurity-Related Securities Suit Dismissed

Peter Selvin

In the following guest post, Peter Selvin discussed the Fifth Circuit’s July 21, 2021 decision in Landry’s Incorporated v. The Insurance Company of the State of Pennsylvania (here), which considered the question of coverage under a commercial general liability policy of damages from a data breach caused by a third-party hacker. Selvin is a partner with Los Angeles-based Ervin Cohen & Jessup. A version of this article previously was published in the LA Daily Journal. I would like to thank Peter for allowing me to publish his article on my site. I welcome guest post submissions from responsible authors on topics of interest to this blog’s readers. Please contact me directly if you would like to submit a guest post. Here is Peter’s article.
Continue Reading Guest Post: CGL Coverage for Data Breaches: New Developments

In the agency’s latest move underscoring its emphasis on cybersecurity disclosure, the SEC has filed settled charges against the U.K. educational publishing and services company Pearson plc, alleging that the company misled investors about a 2018 data breach. The company, which neither admitted nor denied the charges, agreed to pay a $1 million civil money penalty. The administrative enforcement action, while not the first of its type, does highlight the agency’s heightened focus on cybersecurity disclosure issues. The agency’s August 16, 2021 cease and desist order can be found here. The agency’s August 16, 2021 press release about the order can be found here. Pearson’s statement about the proceeding can be found here.
Continue Reading SEC Charges Company Over Misleading Cybersecurity-Related Disclosures

A cybersecurity incident earlier this year at the technology company Ubiquiti has given rise to a securities class action lawsuit against the company and two of its executives. The lawsuit is the latest example of the D&O risk exposure relating to cybersecurity. As discussed below, the lawsuit’s allegation illustrates that the way that a company handles bad news can be an important litigation risk factor. A copy of the May 19, 2021 securities lawsuit complaint against Ubiquiti can be found here.
Continue Reading Internet Technology Company Hit with Data Breach-Related Securities Suit

Paul A. Ferrillo

As I noted in a prior post, the recent state-sponsored cyber incident carried out through an attack on SolarWinds has a number of important implications. As noted in the following guest post from Paul Ferrillo, the incident could also have important implications for the cyber insurance marketplace. Paul is a partner in the McDermott, Will & Emery law firm. I would like to thank Paul for allowing me to publish this article as a guest post on this site. I welcome guest post submissions from responsible authors on topics of interest to this blog’s readers. Please contact me directly if you would like to submit a guest post. Here is Paul’s article.
Continue Reading Guest Post: SolarWinds – Einstein Failed Us, and the Cyber Insurance Markets will Feel the Squeeze

In my round-up of the Top D&O Stories of 2020, which I published earlier this week, I noted that the recent massive state-actor hack of U.S. government agencies and technology companies underscored the fact that cybersecurity represents a significant operational and management risk for organization of every type. I also noted that cybersecurity-related issues represent an ongoing D&O claims risk. As if to confirm these propositions, the first securities class action lawsuit of the New Year was filed against Solar Winds, the network infrastructure management company whose breached software is believe to have contributed to the recent massive hack. As discussed below, the newly filed complaint highlights the fact that cybersecurity represents a significant potential source of management liability risk.
Continue Reading SolarWinds Hit with Securities Suit Based on Third-Party Governmental Actor Cyber Attack

Technology-based education firm K12, Inc., which hoped to be able to profit from the pandemic-related shift to virtual learning , has been hit with a securities class action lawsuit alleging that the company’s share price declined after school systems using its platform to address their online learning needs allegedly experienced disappointing results. A copy of the shareholder plaintiff’s November 19, 2020 complaint can be found here.
Continue Reading Online Learning Firm Hit with COVID-19-Related Securities Suit