Rising Data Breach Class Actions: Key Insights for Legal Defense and Cybersecurity Preparedness

Data breach class actions are increasing, with 2,040 cases filed in 2023. The Foley and Lardner firm cites a Lex Machina report calling that figure almost triple the number from 2022.

The report lists the federal districts with the highest number of consumer class actions, including data breach class actions, as the Central District of California, the Middle District of Florida, and the Northern District of Illinois.

Key industries targeted in these cases include financial services and health care. They often involve multi-district litigation. High-profile incidents such as the 2023 Progress Software MoveIt meltdown fuel the surge in class actions. Such actions frequently inevitably result in large-scale litigation and highlight the need for comprehensive supply chain risk management and vendor liability assessments.

Companies, especially in frequently targeted industries, should be prepared for potential legal challenges and claims even when there is no direct injury to plaintiffs. Depending on the district where the action is brought, companies facing a data breach class action in federal court should file a motion to dismiss that includes an argument that the lead plaintiff does not have standing.

For law firms, the key takeaway is the importance of advising clients to invest in robust cybersecurity measures and incident response plans. Multiple industry reports and anecdotal evidence show that businesses with an incident response playbook tested with tabletop exercises mitigate the cost of a data breach and have better defenses in litigation and regulatory proceedings.

In addition to tabletop exercises, companies should carefully vet vendor relationships to mitigate risks. Early involvement of legal counsel is crucial. Law firms can guide companies through complex litigation, addressing supply chain vulnerabilities, and ensuring proper legal defenses in multi-district actions.