Empirical Analysis of Data Breach Litigation

Legal and Regulatory Obligations Regarding Data and Information Security

“…• The odds of a firm being sued in federal court are 3.5 times greater when individuals suffer financial harm, but over six times lower when the firm provides free credit monitoring following the breach (Romanosky et al, 2012). • Being a slow adopter means that you defer the initial costs to increase security; but, if a particular risk triggers, it's likely to be more expensive for slow adopters.…”

Information Lost (Apologies to Milton)

“…The FTC alleges that these failures led to fraudulent charges on consumers' accounts, millions of dollars in fraud loss… http://www.ftc.gov/opa/2012/06/wyndham.shtm In response, Parsippany, N.J.-based Wyndham moved to dismiss the complaint… saying.. that the FTC "singled out" Wyndham in "unprecedented litigation." … that the commission has neither the expertise nor the statutory authority to establish data security standards for the private sector," http://www.scmagazine.com/wyndham-hotels-challenges-ftc-security-suit-over-breaches/article/258559/ Romanosky, Hoffman, and Acquisti (2012) find that the probability that a firm will be sued is 3.5 times higher when financial data are involved. Settlement is 30% more frequent when there is allegation of financial loss, even higher for compromised medical information and if a class action lawsuit is a threat.…”