Consumers face hurdles in Equifax lawsuits
But identity theft cases tend to fare better than others
Anyone looking for a legal payday over the Equifax breach — not so fast.
The credit reporting company’s recent disclosure of a cyberbreach that compromised personal data for nearly half the nation’s population may seem certain to produce wins in lawsuits.
However, consumers and the Atlanta-based company are likely to face major legal challenges as they gear up for battle over the more than 70 class-action lawsuits filed against Equifax since the Sept. 7 disclosure.
“These are difficult cases, for sure,” said David Berger, a partner in the Oakland, Californiabased Gibbs Law Group, who has represented clients in class-action lawsuits involving data breaches and whose firm has filed a case against Equifax.
Plaintiffs in class-action cases typically must show they suffered financial or other harm in order to establish legal standing to sue.
Equifax said personal information for 143 million people was compromised, making the incident one of the largest in U.S. history. As of now, however, court records show relatively few plaintiffs have alleged they were victimized by stolen identity scams linked to the breach.
Shannon McNulty, a partner and class-action case specialist at the Clifford Law Offices, estimated last week the Chicago-based firm was averaging 20 calls an hour from potential clients fearing Equifax-related harm. Yet roughly one of those 20 said they had spotted evidence of suspicious activity in their credit records, said McNulty, whose firm has filed a suit against the company.
That could change, as cyber thieves attempt to make broader use of the stolen data and the impact of Equifax’s electronic compromise becomes clearer.
Monitoring costs
Not all victims must show they were victimized by identity theft. Others may seek legal standing to sue by arguing that the breach required them to spend money for monitoring and or locking their credit records — expenses that may continue indefinitely.
There is no consistent standard that federal court districts across the U.S. use to decide the issue of legal standing in cyberbreach cases. However, most have ruled that the theft of personal consumer data “is sufficient to establish standing,” said Kevin Sharp, a former federal judge in Tennessee who’s now a managing partner for the Sanford Heisler Sharp law firm, which has also sued Equifax.
Yet when it comes to prevailing in court in class-action lawsuits involving electronic intrusions, “cases involving substantial allegations of identity theft will generally fare better than those without,” Gibbs Law Group attorneys Aaron Blumenthal and Andre Mura wrote in a September article in Trial, a legal community-focused magazine.
People who sue Equifax generally will also be required to prove what’s legally known as causation. That involves producing evidence that shows the harm they suffered was caused by the credit-reporting giant’s loss of their personal information — and not from a breach elsewhere.
Equifax has offered a year’s worth of free credit monitoring and waived the usual fees charged for those who opt to place a freeze on their credit records. But those efforts likely will do little to deter lawsuits.
Facts that could help plaintiffs
The company said last week that it “was aware of” the electronic weakness identified by the U.S. Consumer Emergency Readiness Team in March, the apparent cause of the breach. In response, Equifax said it “took efforts to patch any vulnerable systems.”
Additionally, hackers surreptitiously worked inside Equifax’s computer network as early as March, two months before the company said consumer data was first accessed, The Wall Street Journal reported Thursday.
Full details of those issues ultimately could “provide strong evidence for the plaintiffs,” McNulty said.
However, the company last week provided an early signal suggesting it may try to block some legal discovery requests. Equifax said a forensic assessment of the intrusion and its damage conducted by independent cybersecurity firm Mandian was “privileged” — meaning consumer lawyers likely would have to fight for the findings.
Equifax has contacted its insurers to help fund costs related to the cyberbreach. In a statement, the company said it “carries cybersecurity, crime, general liability and other lines of insurance, and we have begun discussions with our carriers regarding the incident.”