Data Breaches May Cost Corporations and Their Directors Dearly

Publication
March 20, 2017

Yahoo! has taken several hits in the last six months for failing to protect its users' electronic information. Its September, 2016 announcement of a massive 2014 data breach that exposed the email addresses and other personally identifiable information ("PM") of approximately 500 million accountholders derailed its proposed merger with Verizon and sent Yahoo! stock prices plummeting. Mere months later, in December, 2016, Yahoo! announced a second attack in which hackers exposed or stole information for another 500 million users. The United States Department of Justice has announced the indictment of two Russian hackers believed to be responsible for the security breach.

Earlier this month, Yahoo! announced that an independent internal investigation revealed that Yahoo!'s senior executives, including CEO Marissa Mayer, "failed to properly comprehend or investigate" the 2014 security breach. Yahoo!'s general counsel resigned without severance for his department's inadequate response to the breaches, and Mayer agreed to forego her annual bonus and stock award.

Yahoo! users have filed at least 23 lawsuits in multiple jurisdictions, which have now been consolidated for multidistrict litigation in federal court in San Jose, California.

On January 24, 2017, Yahoo!'s shareholders filed a derivative lawsuit in Delaware Chancery Court against Yahoo!, Mayer and other Yahoo! executives. The complaint in Oklahoma Firefighters Pension Fund and Retirement System et al. v. Eric Brandt et al., is sealed, but is reported to allege that Yahoo! and its executives breached their fiduciary duties to shareholders by failing timely to disclose data security breaches to Yahoo! accountholders. This appears to be the first case of its kind, in which a company's handling, or mishandling, of a data breach, might expose the company and its officers and directors to liability to the company.

Florida companies suffer data breaches or attempted data breaches every day. The stringent reporting requirements in Florida's data breach statute, Chapter 501.171, require companies to take "reasonable measures" to protect and secure electronic data that contains personal information, to report breaches that affect 500 or more individuals in Florida to state regulatory authorities, and to give prompt notice to each individual in the state whose personal information was accessed as a result of a data breach. Companies that discover that 1,000 or more individuals were affected must also notify all consumer reporting agencies. Florida law deems all violations of the statute as unfair and deceptive trade practices, exposing companies to civil liability as well as civil penalties of up to $500,000.00 per breach.

Related Practices
RELATED PEOPLE
YOU MIGHT ALSO LIKE
News October 29, 2024
Bilzin Sumberg is pleased to announce that Chief Executive Officer & Managing Partner Albert E. Dotson, Jr. has been recognized among the 2024 Florida Trend 500 Most Influential Business Leaders in the ‘LAW’ category.
Press Release October 29, 2024
Bilzin Sumberg is proud to announce that the firm has been awarded the 2024 P3 Award for its Culture and Diversity category.The Culture and Diversity award recognizes both the rich diversity of Bilzin Sumberg’s public-private partnerships (P3) practice group, as well as the wider firm’s ...
News October 22, 2024
Bilzin Sumberg continued its long-standing tradition of putting community service at the center of firm culture as it hosted its fifth annual Matters of the Heart Pro Bono Awards, which took place at the firm’s Miami office on October 15th.
VIEW MORE