The High Cost of Data Breaches featured image

The High Cost of Data Breaches

by John DiGiacomo

Partner

Data Breach

The following data breach examples show that whether you are a small startup or a big company with a long and storied history, a data breach can be a legal and financial nightmare. There were over 2290 cyberattacks and data breaches in 2020 alone, with the number and severity of data breaches rising every year. The cost of data breaches is rising, too, so far companies have cost companies settlements and fines totaling $1.3 billion, and rising. How much will a data breach cost? A lot. Here are some data breach examples and what six companies paid as a consequence.

1. Equifax — $575 Million in Fines and Settlements

The Equifax data breech is “the most humbling moment in out 118-year history,” remarked Equifax CEO Richard Smith. In this data breach, Equifax lost the personal and financial data of neared 145 million customers. This, after the company was warned of the breach by a researcher, and failed to inform customers after the vulnerability was discovered. In July 2019, the company was fined $575 million, with the potential to rise to $700 million. $300 million of the fine is slated to provide affected customers with free credit monitoring services.

2. Uber — $148 Million in Fines

Ride-hailing app Uber had 600,000 driver and 57 million user accounts hacked in 2016. This data breach example is a bit different. Instead of reporting the incident, the company paid the perpetrator $100,000 to keep the hack under wraps. These actions, however, cost the company dearly. The company was fined $148 million in 2018 — the biggest data-breach fine in history at the time (see above, now) — for violation of state data breach notification laws.

3. Yahoo! — $85 Million for 3 Billion Accounts (Perhaps the largest data breach example)

In 2013 Yahoo! (remember Yahoo!?) suffered a massive security breach that affected its entire database, about 3 billion accounts — almost the entire population of the web. The company, however, didn’t disclose this information for three years.

In April 2018, the U.S. Securities and Exchange Commission (SEC) fined the company $35 million for failing to disclose the breach. In September, Yahoo’s new owner Altaba admitted that it had settled a class action lawsuit resulting from the breach to the tune of an additional $50 million.

4. Home Depot — Close to $200 Million

In September 2014, Home Depot announced that it has suffered a massive data breach. At the time this was one of the largest data breach examples. An estimated 56 million customers’ personal and financial data was stolen including credit card information. This data was sold on the dark web to thieves and resulted in a “massive number” of fraudulent transactions on the customers’ credit and debit cards.

Home Depot was accused of lax cybersecurity and using an outdated malware detection system — seven years out of date according to the allegations — on Home Depot self-checkout kiosks at stores in dozens of locations across the United Stats. Home Depot was also accused of knowing about the problem in July 2014, several months before notifying authorities and customers of the breach. See report here.

Home Depot’s first settlement was in 2016. The company agreed to pay $19.5 million to settle open customer class actions. Then in March 2017, Home Depot agreed to pay another $27.25 million to settle with the banks.

To date, Home Depot has also paid out at least $134 million to credit card complies and banks and was ordered to pay $15.3 million in legal fees to the banks’ attorneys. See here.

5. Capitol One — $80 Million in Fines

In 2019 Captial One bank suffered a breach affecting 100 million people in the US and 6 million in Canada. Amazon Web Services software engineer Paige Thompson – had obtained personal information of Capital One credit card customers and people who had applied for credit card products via a configuration vulnerability in the company’s web application firewall in this data breach example.

The Office of the Comptroller of the Currency fined Capital One $80 millionfor “failure to establish effective risk assessment processes” when migrating operations to public cloud environment as well as a “failure to correct the deficiencies in a timely manner.”

6. Anthem Inc — $115 Millions to Settle Class Actions

In 2015, Anthem Inc, the largest U.S. health insurance company, was hacked and the personal information with respect to 79 million customers was stolen. The information included names, birthdays, social security numbers, addresses, email addresses, and employment and income information.

In June 2017, Anthem agreed to settle the lawsuits for $115 million which is the largest settlement ever for a data breach. More than 100 lawsuits — many were class actions suits — were filed after the data breach. Anthem claimed that it was not negligent with customer information and that no customers were injured.  In other words, a much different situation than the breaches at Home Depot and Target. According to reports, the $115 million is to be paid out to the customers as either two years’ worth of credit monitoring or a $50.00 cash settlement per class member.

The Cost of Data Breaches: More Than Just Fines and Settlements

In these data breach examples above, note the time lags between the breach and settlement – three to five years. The costs identified are just for the settlements. For the companies involved, the “costs” of these data breached includes three to five years of legal fees, expenses and filing costs in defending against the regulators. As an example, with respect to Target (another great example), the New York Times reported that, through March 2017, Target spent more than $202 million on settlements, legal fees, and other costs following the November 2013 breach.

Contact Revision Legal Today

If you need more information on the cost of data breaches and on preventing data breaches, contact Revision Legal. We are experienced data breach attorneys with the skills and dedication to help if you have suffered a data breach or if you need assistance in enhancing your cybersecurity. We can be reached by email or by calling us at 855-473-8474.

You Might Also Like:

10 Data Security Management Tips to Prevent a Data Breach

Your Company Needs A Data Protection Officer

2017 Data Breaches — Severity and Frequency On The Rise

Extra, Extra!
Recent Posts

Online Personal Data Privacy: Fight Over Universal Opt-Out Mechanisms

Online Personal Data Privacy: Fight Over Universal Opt-Out Mechanisms

Internet Law

Almost half of the States in the U.S. have enacted some version of an online personal or consumer data privacy statute. The statutes all use a similar framework that requires data collectors and processors to provide notices, obtain consent, and comply with mandates and prohibitions. For example, all of the online data privacy statutes require […]

Read more about Online Personal Data Privacy: Fight Over Universal Opt-Out Mechanisms

9th Circuit Partially Invalidates California’s Age-Appropriate Design Code Act

9th Circuit Partially Invalidates California’s Age-Appropriate Design Code Act

Internet Law

The Ninth Circuit Court of Appeals — located in San Francisco — partially struck down California’s Age-Appropriate Design Code Act (“CAADCA”). See Cal. Civ. Code §§ 1798.99.28 et seq. The CAADCA was passed in 2022 by the California State Assembly. The CAADCA was enacted to protect the online privacy of children — persons under the […]

Read more about 9th Circuit Partially Invalidates California’s Age-Appropriate Design Code Act

Put Revision Legal on your side