Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As of late, there's been lots of reports of companies losing data due to "hackers". More often than not, this just boils down to lax security. I am looking for concrete examples of a breech where legal action was taken against a company where a breach occurred.

The purpose of having this information is to be able to explain to people (customers, clients) the importance of proper security.


migration rejected from Aug 27 '13 at 17:29

This question came from our site for system and network administrators. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as off-topic by Xander, TildalWave, Adi, tylerl, Gilles Aug 27 '13 at 17:29

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

This is entirely dependent on the local jurisdiction that the company resides in , or the jurisdiction of their customers. Can you rephrase this question so that it reflects a technical problem that you're trying to solve? Otherwise, this will likely get close votes. If you're not sure about any of this, please read the "help" link at the top : primarily – mfinni Aug 27 '13 at 14:27
As of late? Where were you when lulzsec was on the front page of all teh newspapers? – NULLZ Aug 27 '13 at 14:38
@brianv : I will gently suggest that you do your own research, especially if that research is something you'll be using to make money by selling security services to clients. If you don't have the time, then pay the money to Gartner or another research firm for their reports. – mfinni Aug 27 '13 at 14:53
Good subject in my opinion. Reminded me to add a bounty to mine which is similar… – zedman9991 Aug 27 '13 at 15:27
This question appears to be off-topic because it is about searching Google for examples of security incidents and their consequences. This is not a good fit for our Q&A format and unlikely to be of significant help to future users, particularly given the rapidity with which the relevant statutes changes and are re-interpreted. – Xander Aug 27 '13 at 15:31

This isn't a legal Q&A site, but the question does have significant interest in IT security. Theoretically, you can sue any other entity (either an individual or a corporation) for doing anything that causes you a "tort" or harm. The burden is typically on the plaintiff (the suer) to prove "negligence"; the defendant (the one accused of harm; the sued) must be shown:

  1. To have known or been reasonably expected to know that the situation presented a significant potential for harm to others,
  2. To have known or been reasonably expected to know what specific actions or measures should be taken in order to prevent, avoid or mitigate the potential for harm to others,
  3. To have failed to take some or all of these actions or measures, and
  4. That said failure was the direct or proximate cause of a significant realized harm to the plaintiff (or in a class action suit, to a large number of individuals primarily identified by some definable relationship to the defendant and their actions or inactions).

This is harder than it sounds, especially in situations of IT security:

  • Many relationships involving IT security that can result in harm are contractually based; the plaintiff is a subscriber to services performed by the defendant, or similar. The plaintiff is not always required to sign the agreement as such in order to be bound by it; for instance, the plaintiff may signal their agreement to the terms of a warranty or service agreement simply by using the product or service. Such contracts often contain clauses limiting damages, or forcing the subscriber to submit their dispute to arbitration instead of battling it out in court.

  • You typically have to be able to subpoena reasonably detailed documentation of the defendant's security processes. While the court can force the release of information, the defendant will fight any such request tooth and nail, as there is, practically always, a known weakness in process or implementation, whether it was exploited or not, that would become public record at trial and could cause other problems once known.

  • You usually have to be able to subpoena relatively willing witnesses that can testify to procedural or other failures inside the walls of the company; "whistleblowers". Someone's got to be willing to say that the company, their bread and butter, did something wrong. While intentionally false testimony given at trial is perjury, that's just as hard to prove; you have to have independent proof that not only was the statement false, but the person making that statement knew it was false when they made it.

  • Two wrongs don't make a right, but in civil law they often cancel out. You're also on trial here; you must show that you took reasonable action to avoid or mitigate harm in the same situation, whether you knew of or suspected any negligence by the defendant at the time. If the defendant can show that the leak was in fact caused by inadequate measures on your part, such as using the same password for every information service you access, or keeping a copy of said password in an accessible place, the defendant can turn it around on you and can even claim you caused them harm, if the leak of your sensitive information by you allowed the attacker to do damage on their side not limited to your account. Similarly, if you are harmed by, say, having your bank account information stolen, but don't immediately take steps to prevent further harm by reporting it to the proper authorities, then as soon as you knew there was a problem, all the damages happening after that time are on you.

  • Remember the situation that is causing you to file suit against them; they have money, you've lost enough money that it hurts. Of the two, who's more able to hire a good legal representation?

That said, failures by firms that store sensitive information about their customers can and have resulted in civil and criminal penalties, and in fact, this practice is apparently on the rise. Here are a few:

MAPCO Express: Facing class action lawsuit for breach of customers' credit card information.

LinkedIn: Facing a $5 million lawsuit for breach of sensitive data including hashed passwords of 8 million subscribers.

Trustwave, and the State of South Carolina: Found negligent in a suit brought by a state senator following a hacking of an S.C. government website.

A host of other reports of lawsuits filed can be found in the pages of SC Magazine.

Great answer, thank you! – BrianV Aug 28 '13 at 19:59
FWIW the FTC were involved in some of the more egregious cases, and took it seriously enough to distill from it all a security guide for businesses:… – HTLee Jun 18 at 8:40

Take a look at OSF DatalossDB for a catalog of incidents. Their incident log includes both "arrests made" as well as "lawsuits filed". From this data, you can perform whatever analysis you need.


Not the answer you're looking for? Browse other questions tagged or ask your own question.