CIVIL LIABILITY & CLASS ACTIONS

Post-Breach Litigation & Settlements

Track landmark civil class actions, shareholder derivative lawsuits, and consolidated judicial settlements arising from major enterprise cyberattacks and data breaches.

Key Facts

Analysis of landmark post-breach class action settlements, derivative suits, and judicial discovery rulings.
Courts increasingly reject corporate assertions of attorney-client privilege over third-party incident response reports.
Financial institution class actions routinely recover tens of millions for card reissuance and fraudulent charge absorption.
Securities fraud claims target discrepancies between corporate public marketing and known internal vulnerabilities.

In re Equifax Inc. Customer Data Security Breach Litigation

$425,000,000 Consumer Relief ($1.4B Total)

Docket: No. 1:17-md-02800-TWT (N.D. Ga.) | Defendant: Equifax Inc.

Plaintiff Class: 147 Million U.S. Consumers whose SSNs and credit reports were compromised

Causes of Action: Negligence, unjust enrichment, state consumer protection act violations, failure to safeguard PII

Judicial Holding & Precedent: Largest data breach class action settlement in history. Court approved comprehensive consumer compensation fund, free credit monitoring for life, and mandatory minimum of $1B in technology security capital expenditures.

Associated Attack Record: View Breach Case Dossier →

In re Home Depot, Inc., Customer Data Security Breach Litigation

$175,000,000 (Consolidated Financial & Consumer)

Docket: No. 1:14-md-02583-TWT (N.D. Ga.) | Defendant: The Home Depot, Inc.

Plaintiff Class: 56 Million Payment Cardholders + Thousands of Financial Institutions

Causes of Action: Negligence per se under FTC Act § 5, third-party beneficiary contract breach, card reissuance costs

Judicial Holding & Precedent: Established landmark precedent allowing issuing financial institutions to sue merchant directly for card reissuance and fraud mitigation expenses following point-of-sale malware breaches.

Associated Attack Record: View Breach Case Dossier →

In re Target Corporation Customer Data Security Breach Litigation

$39,400,000 Financial Banks + $18,500,000 Multistate AGs

Docket: No. 0:14-md-02522-PAM (D. Minn.) | Defendant: Target Corporation

Plaintiff Class: Class of financial institutions that issued cards compromised during intrusion

Causes of Action: Common law negligence, failure to maintain basic firewall segregation for vendor portal

Judicial Holding & Precedent: Court denied Target motion to dismiss bank claims, holding that retailers owe a foreseeable duty of care to issuing banks when storing unencrypted customer credit data.

Associated Attack Record: View Breach Case Dossier →

In re Capital One Consumer Data Security Breach Litigation

$190,000,000 Consumer Settlement

Docket: No. 1:19-md-02915-AJT (E.D. Va.) | Defendant: Capital One Financial Corp.

Plaintiff Class: 98 Million U.S. Consumers and 6 Million Canadian Residents

Causes of Action: Negligent cloud configuration, failure to audit SSRF vulnerabilities, deceptive trade practices

Judicial Holding & Precedent: Federal magistrate ordered disclosure of third-party forensic incident response report (Mandiant), ruling it was not protected by attorney-client privilege because it was widely shared with business executives.

Associated Attack Record: View Breach Case Dossier →

In re SolarWinds Corp. Securities Litigation

$26,000,000 Investor Settlement

Docket: No. 1:21-cv-00138-RP (W.D. Tex.) | Defendant: SolarWinds Corp., Former CEO, Former CISO

Plaintiff Class: Shareholders who purchased SolarWinds stock prior to disclosure of Orion breach

Causes of Action: Securities Exchange Act Section 10(b) and Rule 10b-5 fraud for misleading cybersecurity statements

Judicial Holding & Precedent: Court allowed securities fraud claims to proceed against SolarWinds based on public statements on security website contradicting internal executive emails regarding known password weaknesses.

Associated Attack Record: View Breach Case Dossier →