US Appeals Court Lowers Burden of Proof for Data Breach Lawsuits
The 4th Circuit Court has ruled that publishing data on the dark web can be considered damaging, potentially increasing the stakes for breached companies.
An October decision by the 4th US Circuit Court of Appeals in Virginia altered the risk calculus of data breaches, making it easier for litigants to sue breached companies in certain situations.
- The case involved an insurance company data breach, resulting in the leak of driver's license information for nearly 3 million customers.
- Previously, courts had ruled that having certain types of data stolen was not sufficient to prove damages, requiring proof of actual damage or evidence of actual fraud.
Dark web data publication alone may be damaging.
This decision could raise extortion stakes, rewrite CISOs' risk calculus, and increase breached companies' lawsuit exposure.
Author's summary: Court ruling eases data breach lawsuit requirements.