Source: https://www.litigationandtrial.com/2017/09/articles/attorney/equifax-data-breach-class-actions/
Timestamp: 2019-04-19 02:58:32+00:00

Document:
Equifax, which knows more about you than your own mother, (1) failed to maintain its servers, (2) was hacked and lost sensitive personal data for 143 million people, (3) concealed that fact for months, (4) blamed another company for the problem, then (5) finally admitted it caused the problem. To make matters worse, after the hack but before disclosing it, three executives sold off nearly $2 million in Equifax stock.
“What should I do to protect myself?” is a difficult question to answer. The Federal Trade Commission put up a page recommending checking your credit reports, placing a credit freeze, placing a fraud alert, and filing your taxes early so that a scammer doesn’t file them for you and obtain your tax refund. Brian Krebs has a much more thorough FAQ over here.
To call this situation “frustrating” would be an understatement. Virtually everyone with a credit history now bears the burden of making sure their own identity is safe due to Equifax’s negligence. People have already filed class-action lawsuits, and rightly so.Data breaches are depressingly common. According to the Privacy Rights Clearinghouse, in 2016 alone, there were 397 publicly-disclosed hacking or malware breaching incidents. Every year, around 70 data breach security class actions are filed against companies ranging from email providers to health insurers to restaurants. The cases involve everything from medical information (which is among the most valuable on the black market) to email addresses to Social Security numbers.
It is no simple matter to sue a company for losing your sensitive personal information. The cases raise issues of standing, pleading, proximate causation, class certification, common-law tort limitations, state statute interpretation, and damages calculations that would send a law student running from the classroom and into the safety of the job as a barista (where their data would be stolen anyway, like in the Krottner case discussed below). That is also why this post is so long and filled with conflicting case law.
If you want the TL;DR (“too long; didn’t read”): the most likely outcome is that, after several years of difficult litigation and objections to settlements and appeals of those objections, Equifax will agree to better corporate security procedures, provide credit monitoring, identity theft insurance, and fraud resolution services, along with compensation for documented damages up to $10,000 and a modest cash payment in the realm of $50. The lawyers representing the consumers and the lawyers representing Equifax will spend hundreds of thousands of hours on the case. The lawyers for Equifax will probably make millions of dollars, paid monthly as they send their bills to Equifax, and the lawyers for the consumers will also probably make millions of dollars at a comparable hourly rate but paid at the very end of the case. (What I described above is essentially what happened in the Anthem data breach security litigation, the most comparable example we have to the Equifax situation.) After questions of standing and class certification, perhaps the most critical question is whether Equifax violated the Fair Credit Reporting Act with its poor information security, and if that violation was “willful.” If so, then Equifax is on the hook for no less than $100 but no more than $1,000 for each violation.
If the protracted path the lawsuits will likely take towards a reasonable settlement strikes you as absurd, you’re not alone. I think it’s absurd. I think Equifax should swiftly conduct an investigation, open its records to the plaintiffs’ lawyers and their experts, and then offer the settlement I described above. But I doubt they’ll do that. Instead, they will probably raise each and every objection they can, dragging out the litigation and driving up the hours that the plaintiffs’ lawyers have to put into the case, so that every single victory for consumers in the case, no matter how slight, will have to be hard won. I hope I’m wrong, but this is what past cases teach us. This post outlines some of the many fights that will arise in the case and explains how the eventual settlement of the case will likely look.
For all the allure surrounding “zero day” exploits, in which a nefarious attacker discovers an unknown vulnerability in software, most computer security breaches are much more banal. Most unauthorized access involves either the use of phishing scams to trick people into revealing their passwords or known vulnerabilities in software that users or administrators failed to update in a timely manner. The Clinton campaign emails that were released by Wikileaks were obtained by way of a phishing scam directed at her campaign chairman, John Podesta. The WannaCry ransomware cryptoworm involved a known Windows vulnerability that had been patched two months before WannaCry was released. In the case of Equifax, the hack happened because Equifax failed to timely update its servers to correct a known vulnerability.
Over time, more information about the hack will be uncovered and disclosed. For example, why wasn’t the data encrypted or otherwise protected against an attack, and why was Equifax holding onto historical credit card data? After the breach, security researchers started poking around Equifax’s websites and noticed absurd problems, including a database protected by the account “admin” with the password “admin.” As it stands now, this already looks like textbook negligence. Equifax failed to do what millions of regular people do all the time: update their software to ensure that the latest security vulnerabilities have been patched.
How Many Equifax Lawsuit Have Been Filed?
More than thirty class actions have been filed so far, and it is likely that many more will be filed in the near future. Most of these will be filed in federal court, and a petition is already pending with the United States Judicial Panel on Multidistrict Litigation, a group of federal judges that decide whether or not all of the cases across the country in federal court should be “consolidated” into a single case for pretrial purposes. In all likelihood, that petition will be granted, just as it has been granted in prior data breach security litigations, including Ashley Madison, Anthem, Home Depot, Target, Zappos, and Sony.
These Are Open-And-Shut Cases, Right?
Alas, no. Equifax, like every other corporate defendant that stupidly exposes your data to scam artists, has a multitude of defenses available thanks to years of anti-consumer court decisions.
I’ve written about class action lawsuits many times in the past, and how the courts have made it particularly difficult for any sort of consumer class action to succeed, like when the Supreme Court made it harder to certify class actions with Comcast v. Behrend. For this post, however, I will stick to privacy and data breach related cases.
Do You Have Standing To Sue Equifax For Losing Your Personal Information?
The case was hailed by corporate defendants because it appeared to further limit the ability of consumers to bring class actions. Nonetheless, on August 15, 2017, the Court of Appeals for the Ninth Circuit released its new opinion in the case, finding that the plaintiff had indeed adequately alleged standing because the FCRA was meant to protect concrete interests and the alleged violations of it harmed those interests. We don’t know yet if the Supreme Court will review the case again and change the rules again.
Reilly v. Ceridian Corp., 664 F.3d 38, 40, 44 (3d Cir. 2011) (plaintiff-employees’ increased risk of identity theft theory too hypothetical and speculative to establish “certainly impending” injury-in-fact after unknown hacker penetrated payroll system firewall, because it was “not known whether the hacker read, copied, or understood” the system’s information and no evidence suggested past or future misuse of employee data or that the “intrusion was intentional or malicious”).
Beck v. McDonald, 848 F.3d 262, 277 (4th Cir., Feb. 6, 2017), cert. denied sub nom. Beck v. Shulkin, 137 S. Ct. 2307 (2017)(“We acknowledge that the named plaintiffs have been victimized by at least two admitted data breaches. … But absent a sufficient likelihood that Plaintiffs will again be wronged in a similar way these past events, disconcerting as they may be, are not sufficient to confer standing to seek injunctive relief.” Internal quotations omitted).
Underlying the cases are common allegations that sufficed to push the threatened injury of future identity theft beyond the speculative to the sufficiently imminent. In Galaria, Remijas, and Pisciotta, for example, the data thief intentionally targeted the personal information compromised in the data breaches. Galaria, 663 Fed.Appx. at 386, 2016 WL 4728027, at *1 (“[H]ackers broke into Nationwide’s computer network and stole the personal information of Plaintiffs and 1.1 million others.”); Remijas, 794 F.3d at 694 (“Why else would hackers break into a store’s database and steal consumers’ private information?”); Pisciotta, 499 F.3d at 632 (“scope and manner” of intrusion into banking website’s hosting facility was “sophisticated, intentional and malicious”). And, in Remijas and Krottner, at least one named plaintiff alleged misuse or access of that personal information by the thief. Remijas, 794 F.3d at 690 (9,200 of the 350,000 credit cards potentially exposed to malware “were known to have been used fraudulently”); Krottner, 628 F.3d at 1141 (named plaintiff alleged that, two months after theft of laptop containing his social security number, someone attempted to open a new account using his social security number).
Here, the Plaintiffs make no such claims. This in turn renders their contention of an enhanced risk of future identity theft too speculative. On this point, the data breaches in Beck and Watson occurred in February 2013 and July 2014, respectively. Yet, even after extensive discovery, the Beck plaintiffs have uncovered no evidence that the information contained on the stolen laptop has been accessed or misused or that they have suffered identity theft, nor, for that matter, that the thief stole the laptop with the intent to steal their private information.
Beck v. McDonald, 848 F.3d 262, 274 (4th Cir. 2017). That is to say, the mere possibility that maybe someone could have taken the sensitive personal information is not enough. But where it appears that sensitive personal information was actually accessed, particularly where the circumstances suggest a motive to use the information improperly, there is standing to bring a claim relating to the threat of future identity theft.
In the Equifax case, hackers broke into the database for a company in the business of possessing and using personally identifiable information and obtained “names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers,” as well as “credit card numbers” and “dispute documents with personal identifying information.” That would likely be sufficient to confer standing on plaintiffs who allege the threat of future identity theft under any of the above cases.
Ironically, the only Circuit Court that doesn’t seem to have grappled with this issue much is the Eleventh Circuit, which is the appellate court for the Northern District of Georgia, the federal court where Equifax is based, and where the current petitions for consolidation have argued the cases should be heard for pre-trial purposes. The closest they came to the issue was Resnick v. AvMed, Inc., 693 F.3d 1317 (11th Cir. 2012), which found standing for plaintiffs who had already been victims of identity fraud. There’s a good chance, however, that the Eleventh Circuit will rule on these issues before the Equifax case reaches them, because the same issues arose in the Community Health Services data breach litigation, although earlier this year the district court denied the plaintiffs an interlocutory appeal on the issue. We’ll thus have to wait and see what the Eleventh Circuit does.
If Equifax Victims Have Standing, Do They Have A Claim?
At first blush, this seems ridiculous: of course the victims have a claim! Alas, the law is not so simple. There is no single “data breach” claim.
In data breach security lawsuits, the most commonly alleged claim is negligence, the same common law state tort used for car accidents, slip-and-falls, and dog bites. Negligence involves the defendant breaching a duty it had to the plaintiff and thereby causing the plaintiff harm, the familiar “duty-breach-causation-harm” elements taught to every 1L in law school. The LawFare blog had a post on the duty element earlier this week, collecting a couple cases hostile to the victims of data breaches, like the questionable Pennsylvania Superior court case Dittman v. UPMC, 2017 PA Super 8, 154 A.3d 318, 320 (2017), which inexplicably held it was “unnecessary to require employers to incur potentially significant costs to increase security measures when there is no true way to prevent breaches altogether,” which is akin to holding that there is no true way to prevent car accidents altogether, and so no person can be held accountable for drinking before driving.
Some courts also apply the “economic loss rule,” which prohibits negligence claims where the plaintiff has suffered only financial losses, but not any physical harm. The economic loss rule is more like a slice of Swiss cheese than a “rule,” given the vast number of exceptions recognized by most states, but it can sometimes still preclude negligence claims arising from purely economic losses.
The second most commonly alleged claim is a violation of state consumer protection laws, which come under various names, including unfair and deceptive practices, unfair competition, unfair trade practices, consumer fraud, and so on. Each state has a different consumer protection act, and each state’s courts have interpreted their act differently, so this becomes a prolonged state-by-state analysis raising all of the same issues, such as whether consumers have standing to raise claims involving future threats of harm, whether the act covers data breaches, and whether the act is enforceable by consumers or just by the state attorney general. The opinion in the Target case linked above includes a thorough description of most of these issues, as does the opinion in the Sony case.
After negligence and unfair practices come a whole host of potential claims depending on the states involved, including everything from breach of contract, to breach of implied contract, to negligent misrepresentation, to unjust enrichment, and so on. For each claim, all of the same issues come up relating to standing, duty, and whether or not the claim can truly be used for a data breach case.
The Equifax situation, however, opens up the use of an interesting theory: because Equifax is a credit reporting agency, it is subject to the Fair Credit Reporting Act. Under 15 U.S.C. § 1681e, consumer reporting agencies “shall maintain reasonable procedures designed to … limit the furnishing of consumer reports…” Equifax’s failure to do so could subject them to liability under 15 U.S.C. § 1681n, which creates civil liability for “willful noncompliance” with the FCRA, and 15 U.S.C. § 1681o, which creates civil liability for “negligent noncompliance” with the FCRA. I’ve already seen complaints against Equifax that allege these claims. We can expect to see extensive arguments about whether or not Equifax’s actions constitute “noncompliance” at all, and whether or not that noncompliance was “willful.” Equifax is likely quite worried that, under some interpretations of the FCRA’s “willful noncompliance” statute, there is no need to prove actual damages, and each violation comes with a penalty “of not less than $100 and not more than $1,000.” 143 million times $100 is quite a lot; 143 million times $1,000 is even more. “Section 1681n, which creates the cause of action for willful violations, also does not impose the consequential-damages requirement that defendants wish to add to the statute.” Beaudry v. TeleCheck Servs., Inc., 579 F.3d 702, 705 (6th Cir. 2009).
And, of course, the FCRA comes with its own long trail of complicated case law. An article by two defense lawyers in the American Bar Association’s Business Law Today explained how corporations can use Spokeo and other cases to thwart consumers’ attempts to certify a class action, which would leave each consumer fighting the case on their own.
Here’s the point: to many consumers’ surprise, bringing a claim against a company that negligently lost your sensitive personal information is hardly simple, because there’s no unified “data breach” cause of action, and companies like Equifax use every opportunity they have to limit the number of claims the consumers have.
What Can I Expect From The Equifax Lawsuits?
You can expect to wait. As I mentioned towards the beginning of this post, it would be fantastic if Equifax would swiftly investigate what happened, open up its records to the consumer lawyers, and then offer a reasonable settlement. But that never happens. Instead, defendants challenge standing, challenge the causes of action alleged by the plaintiffs, challenge the certification of a class action, object to the discovery requests made by the plaintiffs (here’s a recent post of mine that goes deep into the discovery “proportionality” standard in the Federal Rules of Civil Procedure, and the many ways defendants use it to avoid producing evidence), failed to provide all of the documents they have relating to discovery requests, move for summary judgment, and seek interlocutory appeals before they ever sit down to discuss her reasonable settlement offer. Then, even once a settlement is reached, it has to be approved by the court, a process that can take years itself given the number of objections and appeals that class-action settlements typically raise these days.
As one example of the protracted courses these cases take, Target revealed a security breach in December 2013 and litigation began immediately. Target first entered into a settlement in the consumer class-action cases in November 2015, but several class members filed objections, resulting in an appeal and a remand, and in May 2017 the district court approved the new settlement — but that settlement itself requires approval by the appellate court, so the consumers are still waiting.
So What Kind Of A Settlement Are We Talking About?
The Target settlement, which involved credit card and debit card information along with names, mailing addresses, email addresses, and phone numbers, provided for consumers to be reimbursed for all of their documented losses from the data breach, up to a maximum of $10,000, which is more than anyone in the class could prove they incurred. The average award is likely around $40, and more than 225,000 people submitted claims to the settlement. Assuming the current settlement is approved, Target will reform its data security practices, the class will be paid $10 million total, and the lawyers for the class will be paid around $6.75 million (paid separately from the $10 million).
The Home Depot settlement, which involved 40 million consumers’ payment data and 53 million customers’ email addresses, provided for a $13 million fund for consumers, $6.5 million for internet and “dark web” monitoring services, and $7.5 million in attorney fees.
The proposed settlement in the Anthem data breach security litigation (a settlement which hasn’t yet been approved by the court and which will likely be subject to objections and appeals, too) is somewhat similar, but with some extra credit monitoring. Class members will receive two years of identity fraud insurance, identity theft insurance, and fraud resolution services. Anyone who has their own credit monitoring can receive cash, which will likely be between $36 and $50. Additionally, $15 million will be set aside for class members to accommodate out-of-pocket claims up to $10,000. The lawyers will seek up to $37.9 million for attorney fees and $3 million in reimbursements for costs they spent (we don’t know yet what the court will approve, that’s just the highest the lawyers can request according to the settlement agreement).
A quick fact to think about regarding Equifax: in the Anthem litigation, approximately $23 million (paid by Anthem) will be spent just on giving class members notice and administering the settlement. If this sounds ridiculous, it’s because there are nearly 50 million class members. The settlement administrators are going to try to mail all of them postcards with detachable claim forms and buy 180 million impressions on social media to let people know about the settlement. All in all, it’s a fairly cheap way — less than $0.50 per class member — to involve 50 million people in something.
The Anthem case is the most analogous to Equifax: names, dates of birth, Social Security numbers, and health care ID numbers were stolen, along with other data, which is why I think it’s a reasonable place to look for guidance on how the Equifax case will be resolved.
If you’re interested in more details, I have a thread on Twitter where I’m collecting analyses from security experts.

References: v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 § 1681
 § 1681
 § 1681
 v.