Description
ALERT
Employers Face Exposure for Cyberbreaches
May 3, 2016
Phillip M. Schreiber
Christopher G. Cwalina
Norma M. Krayem
HIGHLIGHTS:
A newly filed lawsuit in California and a recent decision from the U.S.
Court of Appeals for the Seventh Circuit serve as reminders to employers that the protection of sensitive employee information from cyberthreats should be a priority. In the Seventh Circuit decision, the Court of Appeals held that the increased risk of fraudulent charges and identity theft are injuries concrete enough to maintain a lawsuit. Given the prevalence of cyberattacks, employers have a duty to take reasonable steps to protect their employees' sensitive data housed on their human resource information systems (HRIS) and other systems from hackers. A newly filed lawsuit in California and a recent decision from the U.S. Court of Appeals for the Seventh Circuit serve as reminders to employers that the protection of sensitive employee information from cyberthreats remains a priority. California Lawsuit A lawsuit filed on April 20, 2016, in a California federal court against Sprouts Farmers Market Inc. alleges that Sprouts acted negligently when it failed to adequately protect its employees' personal data and failed to maintain that data in a manner that would protect against phishing scams. According to the allegations in the lawsuit, on or around March 14, 2016, Sprouts sent its employees' 2015 W-2 forms, Social Security numbers and other sensitive information to an unknown third party in response to what purported to be an email from a company senior executive requesting the information. Approximately 21,000 employees allegedly were affected by this data-phishing scam. The lawsuit, Julio Hernandez v.
Sprouts Farmers Market Inc., No. 3:16cv00958 (S.D. Cal.), was brought as a class action.
Sprouts purportedly offered its employees one year of free credit monitoring. But the complaint asserts that this is an insufficient response because its employees still run the risk of identity theft. Plaintiffs seek damages and an order for Sprouts to, among other things, take extensive measures to ensure its systems are adequately protected from future phishing scams and other cyberbreaches, inform the affected employees about the identity theft threats they face and what they can do to protect themselves, and to provide ongoing identity theft protection (not just credit monitoring services) to the affected employees. Notably, there is no allegation that any Sprouts employee was an actual victim of identity theft.
But as the Seventh Circuit recently confirmed in Lewert v. P.F. Chang's China Bistro, Inc., ___ F.3d ___ .
(7th Cir. 2016), being a victim of identity theft is not necessary to maintain a claim for damages in the aftermath of a data breach. Seventh Circuit Decision P.F. Chang's suffered a data breach at some of its restaurants, resulting in the compromise of its customers' credit card and debit card data. John Lewert, one of the named plaintiffs, used a debit card to pay for his meal at a P.F.
Chang's restaurant. Lewert did not observe any fraudulent charges to his card and did not cancel his card or purchase a credit monitoring service. However, Lewert spent time monitoring his credit card statements and his credit report to ensure no fraudulent charges were made to the card and that no new accounts had been opened in his name.
The Court of Appeals held that the increased risk of fraudulent charges and identity theft are injuries concrete enough to maintain a lawsuit. The court explained, "It is plausible to infer a substantial risk of harm from the data breach, because a primary incentive for hackers is sooner or later to make fraudulent charges or assume those consumers' identities." (Internal quotations and citations omitted.) Moreover, merely having to spend time and effort monitoring credit card statements and other financial information to guard against identity theft is a sufficient injury in itself to support a claim. Lessons for Employers Given the prevalence of cyberattacks, employers have a duty to take reasonable steps to protect their employees' sensitive data housed on their human resource information systems (HRIS) and other systems from hackers and other cybercriminals. What is reasonable depends on the size, nature and complexity of the business, but things to consider include assessment of the maturity of the security program, incident response capabilities, ongoing monitoring, vendor management, technical controls, taking corrective actions where weaknesses are found, and educating and training employees, particularly those who have access to sensitive data, about cyberthreats. A cyberattack on a company’s systems can easily and quickly cascade into the company’s customers, employees, governmental entities (when the company is a government contractor) and others.
A data breach of employee information, like a breach of customer information, can expose the employer to liability, potentially even in the absence of an actual instance of identity theft. Certain state and federal laws obligate the employer to issue notices to employees affected by a data breach and to have reasonable information security programs in place. Proactive measures to secure employee data is an investment that can pay dividends in the form of preservation of the employer's reputation, the avoidance of negative employee relations and cost savings.
Evaluating the current maturity state of the company’s information security and response programs is the best place to start. Further, there are regulations in place that impose often detailed minimum cybersecurity requirements on companies in certain industries. For more information about your company's duty to protect its employees' sensitive data, contact a member of Holland & Knight's Data Privacy and Security Team or Labor, Employment and Benefits Group. Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem.
Moreover, the laws of each jurisdiction are different and are constantly changing. If you have specific questions regarding a particular fact situation, we urge you to consult competent legal counsel. . Authors Phillip Schreiber is experienced in employment discrimination and wage and hour class and collective action litigation before federal and state administrative agencies and federal and state courts. Mr. Schreiber also is experienced in issues relating to drug and alcohol testing, the WARN Act, the Family and Medical Leave Act, the Illinois Prevailing Wage Act, military leave, wrongful discharge, employee handbooks, employment contracts, covenants not to compete, separation agreements, unemployment compensation benefits claims and various other employment related matters. Mr. Schreiber is experienced in traditional labor matters, including union elections, contract arbitration and proceedings before the National Labor Relations Board. 312.715.5784 | phillip.schreiber@hklaw.com Christopher G.
Cwalina is a partner in Holland & Knight's Washington, D.C., office and co-chair of the Cybersecurity and Privacy Team. He concentrates his national practice primarily on privacy and data security compliance; litigation; defending companies in investigations initiated by state attorneys general, the FTC and other government agencies; responding to security breach incidents; establishing international compliance frameworks for companies; and developing and writing company policies and procedures. Mr.
Cwalina has managed some of the largest data breaches in the country. He regularly serves as a “breach coach” – leading companies from a variety of industries through crisis management and the intricacies of managing the competing interests of affected customers, consumers, regulators, Congress, consumer groups, media, law enforcement, payment processors and other third parties involved when large breaches occur. 202.469.5230 | chris.cwalina@hklaw.com Norma Krayem is a senior policy advisor in Holland & Knight's Washington, D.C., office and co-chair of the firm's Cybersecurity and Privacy Team, as well as a member of the Public Policy & Regulation Group. Ms.
Krayem provides strategic advice on key issues in a range of areas, including homeland security, transportation, defense, international trade and environmental, as well as appropriations issues for all aspects of critical infrastructure. She also focuses on the impacts of cyber risks on the banking and financial services, energy, communications, university and retail industries. Ms.
Krayem has more than 20 years of experience addressing major issues within the national policy-making arena and has worked both in and with state, local and federal governments, as well as Fortune 500 clients to develop strategies designed to build and maintain a competitive edge. 202.469.5195 | norma.krayem@hklaw.com Attorney Advertising. Copyright © 1996–2016 Holland & Knight LLP. All rights reserved. .
Court of Appeals for the Seventh Circuit serve as reminders to employers that the protection of sensitive employee information from cyberthreats should be a priority. In the Seventh Circuit decision, the Court of Appeals held that the increased risk of fraudulent charges and identity theft are injuries concrete enough to maintain a lawsuit. Given the prevalence of cyberattacks, employers have a duty to take reasonable steps to protect their employees' sensitive data housed on their human resource information systems (HRIS) and other systems from hackers. A newly filed lawsuit in California and a recent decision from the U.S. Court of Appeals for the Seventh Circuit serve as reminders to employers that the protection of sensitive employee information from cyberthreats remains a priority. California Lawsuit A lawsuit filed on April 20, 2016, in a California federal court against Sprouts Farmers Market Inc. alleges that Sprouts acted negligently when it failed to adequately protect its employees' personal data and failed to maintain that data in a manner that would protect against phishing scams. According to the allegations in the lawsuit, on or around March 14, 2016, Sprouts sent its employees' 2015 W-2 forms, Social Security numbers and other sensitive information to an unknown third party in response to what purported to be an email from a company senior executive requesting the information. Approximately 21,000 employees allegedly were affected by this data-phishing scam. The lawsuit, Julio Hernandez v.
Sprouts Farmers Market Inc., No. 3:16cv00958 (S.D. Cal.), was brought as a class action.
Sprouts purportedly offered its employees one year of free credit monitoring. But the complaint asserts that this is an insufficient response because its employees still run the risk of identity theft. Plaintiffs seek damages and an order for Sprouts to, among other things, take extensive measures to ensure its systems are adequately protected from future phishing scams and other cyberbreaches, inform the affected employees about the identity theft threats they face and what they can do to protect themselves, and to provide ongoing identity theft protection (not just credit monitoring services) to the affected employees. Notably, there is no allegation that any Sprouts employee was an actual victim of identity theft.
But as the Seventh Circuit recently confirmed in Lewert v. P.F. Chang's China Bistro, Inc., ___ F.3d ___ .
(7th Cir. 2016), being a victim of identity theft is not necessary to maintain a claim for damages in the aftermath of a data breach. Seventh Circuit Decision P.F. Chang's suffered a data breach at some of its restaurants, resulting in the compromise of its customers' credit card and debit card data. John Lewert, one of the named plaintiffs, used a debit card to pay for his meal at a P.F.
Chang's restaurant. Lewert did not observe any fraudulent charges to his card and did not cancel his card or purchase a credit monitoring service. However, Lewert spent time monitoring his credit card statements and his credit report to ensure no fraudulent charges were made to the card and that no new accounts had been opened in his name.
The Court of Appeals held that the increased risk of fraudulent charges and identity theft are injuries concrete enough to maintain a lawsuit. The court explained, "It is plausible to infer a substantial risk of harm from the data breach, because a primary incentive for hackers is sooner or later to make fraudulent charges or assume those consumers' identities." (Internal quotations and citations omitted.) Moreover, merely having to spend time and effort monitoring credit card statements and other financial information to guard against identity theft is a sufficient injury in itself to support a claim. Lessons for Employers Given the prevalence of cyberattacks, employers have a duty to take reasonable steps to protect their employees' sensitive data housed on their human resource information systems (HRIS) and other systems from hackers and other cybercriminals. What is reasonable depends on the size, nature and complexity of the business, but things to consider include assessment of the maturity of the security program, incident response capabilities, ongoing monitoring, vendor management, technical controls, taking corrective actions where weaknesses are found, and educating and training employees, particularly those who have access to sensitive data, about cyberthreats. A cyberattack on a company’s systems can easily and quickly cascade into the company’s customers, employees, governmental entities (when the company is a government contractor) and others.
A data breach of employee information, like a breach of customer information, can expose the employer to liability, potentially even in the absence of an actual instance of identity theft. Certain state and federal laws obligate the employer to issue notices to employees affected by a data breach and to have reasonable information security programs in place. Proactive measures to secure employee data is an investment that can pay dividends in the form of preservation of the employer's reputation, the avoidance of negative employee relations and cost savings.
Evaluating the current maturity state of the company’s information security and response programs is the best place to start. Further, there are regulations in place that impose often detailed minimum cybersecurity requirements on companies in certain industries. For more information about your company's duty to protect its employees' sensitive data, contact a member of Holland & Knight's Data Privacy and Security Team or Labor, Employment and Benefits Group. Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem.
Moreover, the laws of each jurisdiction are different and are constantly changing. If you have specific questions regarding a particular fact situation, we urge you to consult competent legal counsel. . Authors Phillip Schreiber is experienced in employment discrimination and wage and hour class and collective action litigation before federal and state administrative agencies and federal and state courts. Mr. Schreiber also is experienced in issues relating to drug and alcohol testing, the WARN Act, the Family and Medical Leave Act, the Illinois Prevailing Wage Act, military leave, wrongful discharge, employee handbooks, employment contracts, covenants not to compete, separation agreements, unemployment compensation benefits claims and various other employment related matters. Mr. Schreiber is experienced in traditional labor matters, including union elections, contract arbitration and proceedings before the National Labor Relations Board. 312.715.5784 | phillip.schreiber@hklaw.com Christopher G.
Cwalina is a partner in Holland & Knight's Washington, D.C., office and co-chair of the Cybersecurity and Privacy Team. He concentrates his national practice primarily on privacy and data security compliance; litigation; defending companies in investigations initiated by state attorneys general, the FTC and other government agencies; responding to security breach incidents; establishing international compliance frameworks for companies; and developing and writing company policies and procedures. Mr.
Cwalina has managed some of the largest data breaches in the country. He regularly serves as a “breach coach” – leading companies from a variety of industries through crisis management and the intricacies of managing the competing interests of affected customers, consumers, regulators, Congress, consumer groups, media, law enforcement, payment processors and other third parties involved when large breaches occur. 202.469.5230 | chris.cwalina@hklaw.com Norma Krayem is a senior policy advisor in Holland & Knight's Washington, D.C., office and co-chair of the firm's Cybersecurity and Privacy Team, as well as a member of the Public Policy & Regulation Group. Ms.
Krayem provides strategic advice on key issues in a range of areas, including homeland security, transportation, defense, international trade and environmental, as well as appropriations issues for all aspects of critical infrastructure. She also focuses on the impacts of cyber risks on the banking and financial services, energy, communications, university and retail industries. Ms.
Krayem has more than 20 years of experience addressing major issues within the national policy-making arena and has worked both in and with state, local and federal governments, as well as Fortune 500 clients to develop strategies designed to build and maintain a competitive edge. 202.469.5195 | norma.krayem@hklaw.com Attorney Advertising. Copyright © 1996–2016 Holland & Knight LLP. All rights reserved. .
