Security Breach Cases

In a recent string of data security breach cases, plaintiffs whose information was collected by a corporation and later stolen have sought legal action against the corporation under a variety of legal theories. The victims tend not to seek a remedy against the actual identity thief because

locating and bringing a lawsuit against the actual identity thief is more difficult. With respect to a data security breach, the two most difficult issues to resolve are causation and damages. The following case law analysis is limited to breach of contract claims sought against a corporation for losing aggregated personally identifiable information.

In (Jones,2006 ) Jones used certain personally identifiable information to open a business checking account where she was the sole authorized signor. Jones learned that Bancorp authorized fi-audulent withdrawals from her account and that a separate fraudulent account had been opened in Jones's name. After the breach was discovered, Bancorp credited the fraudulently withdrawn funds to Jones's bank account, which was $1,860.00. Jones brought a breach of contract claim against Bancorp, and Bancorp replied with a motion to dismiss claiming that because the money was credited, Jones could not prove any damages flowing from the supposed breach. The district court denied Bancorp's motion to dismiss because Jones adequately pled a breach of contract claim. The district court believed that Jones might, by using the tools of discovery, show some damages stemming from her inability to access her funds during the weeks before it was credited back. As the proceedings moved forward, in Commerce 11,^^ Bancorp then moved for summary judgment on the breach of contract claim."*^ Although the district court's opinion did not expressly address the breach of contract claim in its analysis,^" it was able to analyze the negligence claim to detennine if the damages element of the breach of

contract claim still held merit.^' Regarding causation, Jones was not able to provide sufficient evidence linking Bancorp to the theft, nor was Jones able to demonstrate that she suffered any compensable injury stemming from the loss.^^ A motion to reconsider Commerce II was denied."