1E9Ct5D

IV.Liability for Data BreachesHaving realized that a cyber event is likely, the next step to managing the risk isunderstanding possible legal liabilities that may arise from the event. The first, andmost obvious, is the litigation that arises out of the disclosure of personal information,usually on theories of negligence, breach of fiduciary duty, and/or breach of contract.As noted above, these disclosures expose the business to the costs of notification lawsand may also give rise to suits and claims. Recently the Federal Trade Commissionwas allowed to go forward with a suit against Wyndham Hotels for failure to protectcustomer data. 15Class action lawsuits have also been filed against several of the large companiesthat have suffered data loss. Twenty-five class action lawsuits were settled in the wakeof the 2007 TJ Maxx data breach which involved the theft of over 45 million credit anddebit cards. The settlement included: up to $1million to customers without receipts; upto $10 million to customers with receipts, $6.5 million in Plaintiffs’ attorneys fees; andthree years of creditor monitoring, reported to cost $177 million. 1615 FTC v. Wyndham Worldwide Corp., No. 2:13-cv-01887-ES-JAD, 2014 BL 94785, 2014 ILRC 1615, 37ILRD 470 (D.N.J. Apr. 07, 2014).16 Cyber Risks: The Growing Threat, supra.