District Court dismisses data breach class action

Courts Class Action Data Breach Privacy/Cyber Risk & Data Security

On January 19, the U.S. District Court for the Southern District of New York dismissed a class action against a menswear company (defendant) accused of exposing personal information in a December 2020 data breach. According to the opinion, the plaintiff bought items on the defendant’s website in 2013, and more than six years later, hackers allegedly accessed the defendant’s backup cloud database and stole the personal information of the defendant’s online customers, including customers’ addresses, telephone numbers, email addresses, order history, Internet Protocol addresses, encrypted passwords, and partial credit card numbers. The defendant sent notices to affected customers, disclosing that “an unauthorized third party may have been able to view some of your account details, including your contact information and encrypted password.” The notice further explained that users’ encrypted passwords were protected so the actual passwords were not visible, and that users’ payment card information was not affected by the breach. The notice advised that the company was resetting the passwords and had logged users out of their accounts. In response to the message, the plaintiff allegedly changed his password, placed a security freeze on his credit, purchased credit repair and protection services, and purchased a robocall-blocking subscription. The plaintiff alleged that he “spent time dealing with the increased and unwanted spam, text[s], telephone calls, and emails” that he received after the data breach. In dismissing the lawsuit, the court explained that the plaintiff did not show he faced a “substantial” risk of identity theft or fraud. In addition, the court held that “given the nature and age of the data, the likelihood that its exposure would result in harm to [the plaintiff] is too remote to support standing.”