Practice Areas

Data Breach Attorney

An experienced data breach attorney can minimize potential damage when your Social Security Number (SSN), biometric data, and other sensitive details have been exposed or sold.

At Mason LLP, our civil litigation lawyers have been instrumental in class action cases, holding at-fault parties accountable for losing thousands of individuals. Whether you’re an individual whose personal information has been compromised or a business grappling with the fallout of a data breach, these legal professionals stand ready to defend your interests and secure the protection and compensation you deserve. Contact us for a free consultation to learn more about how we can assist.

What constitutes a data breach?

A data breach occurs when a company’s privacy protections fail, putting personal information at risk. Several factors, including hacking, unsecured data privacy systems, employee negligence, and malware can cause data breaches.

Breaches are often not recognized until long after the problem occurs. In some instances, no harm is done, yet the company must still be held liable. When data is stolen, sold, or otherwise affected, there may be lawsuits against the business and the responsible individuals.

What steps should you take if you experience a data breach?

The company is required to send written notice to anyone who could be affected. It does not mean you have been harmed, but you should take important steps as soon as you get the letter, including:

Read the notice carefully: The notice describes what information was compromised and how you could be impacted.
Examine your account with the company: Make a note of all your personal information on file.
Change your passwords: If available, change your password immediately and implement two-factor authentication.
Close the account: If this is not feasible, close your current account and reopen a new one to break the link between your data and the new account.
Protect your financial accounts: Update the passwords and security questions for banking, checking, investment, and retirement accounts.
Use credit monitoring programs: You may get free monitoring as part of a breach remedy, but you can reduce your risk of harm by proactively signing up for these services.
Check your credit reports regularly: Review your reports at least once a year by requesting a free copy through the Fair Credit Reporting Act.
Speak with a data breach lawyer: Contact a data breach law firm if you receive a notice. There may be class action lawsuits that could result in compensation settlements.

Data breach and consumer privacy claims are extremely complicated, requiring substantial evidence to demonstrate harm. Contact respected data breach attorneys with a strong background and experience in trying similar cases.

What evidence should I preserve to support my data breach claim?

You may be unaware of a data breach until you get a notice, perhaps months later. Some issues can indicate you are a victim, such as:

Rejected tax return
Request to verify your identity in person to the IRS
Unauthorized bank or credit card charges
Unauthorized credit report checks
Collection notices for bills you haven’t incurred
Denied credit or loan applications

Keep these documents to share with your data breach law firm if you receive a notice later.

What preventive measures can you take against a data breach?

While you cannot stop hackers from attacking companies that hold your information, you can take some actions to prevent sensitive data from being at risk. These include:

Initiate a credit freeze: Set up a credit freeze to prevent unauthorized attempts to open new accounts.
Use strong passwords: Use upper and lowercase letters, symbols, and numbers to make your password harder to guess.
Do not link your bank data: Most purchasing websites and even utility companies allow you to store payment information. Avoid listing your bank details when possible.
Protect all Social Security Numbers: Identity thieves frequently ruin a child’s credit history by using their SSN to open new accounts.
Avoid using public Wifi or Bluetooth devices: Hackers can steal payment and personal information through free WiFi networks or Bluetooth devices. Use your personal hotspot instead.

What options do data breach victims have for legal recourse?

The FTC oversees most instances of data theft, and victims can start by visiting the IdentityTheft.gov website to begin a complaint. You can also find a list of ongoing investigations to determine whether you were affected by those breaches. However, you still need to understand what other legal action is available.

When a company’s actions impact hundreds or thousands of people, they may bundle their lawsuits into class action or mass tort cases. Class action lawsuits identify one plaintiff who will represent all class members, with any settlement divided evenly among the class members. Mass tort actions conduct bellwether trials to determine the strength of the claims, but each plaintiff may receive individual damage demands if they win.

You should partner with a law firm with a strong background in leading, co-managing, and contributing to these legal actions. A skilled data breach lawyer from Mason LLP can advise you to pursue an individual case or move into a combined effort with similarly affected plaintiffs.

What remedies and compensation can a data breach victim receive?

While government agencies will investigate and prosecute the liable parties for any criminal actions, you can file a private lawsuit to seek damages for various ways your life has been affected. Some are quantifiable in terms of money lost (economic damages). Others are less tangible (non-economic.)

Some common damages you might pursue include:

Unauthorized charges to your credit cards and subsequent fees
Loss of funds from your accounts
Reductions or flags on your credit score
Denial of loan or credit applications
Future loss of income from a negative background check
Loss of freedom if your passport or driver’s license is flagged
Lost time spent fighting to protect your data
Cost of credit monitoring services for years or a lifetime
Emotional distress and mental anguish
Anxiety, depression, embarrassment, and fear

Your data breach attorney will examine your situation and help you identify every potential loss you have suffered. They will advise you on whether to file an individual claim or if you have grounds to join a larger action, such as a class action lawsuit or mass tort.

What are some resources for victims of a data breach?

The Federal Trade Commission (FTC) guides those who suspect their personal information has been exposed. In addition, you can contact the company involved in the data breach to determine if they established a consumer support group. You should also contact your local law enforcement group, such as the police or your state’s Bureau of Investigation.

What are the existing U.S. federal data privacy laws?

Federal laws governing citizens’ private data include COPPA, HIPAA, the U.S. Privacy Act, and the Gramm-Leach-Bliley Act. These laws include:

COPPA: The Children’s Online Privacy Protection Rule requires websites marketing to children under 13 must obtain parental consent before collecting a child’s data. Parents or guardians have the right to access or delete the information.
HIPAA: The Health Insurance Portability and Accountability Act outlaws unauthorized collection, sharing, and dissemination of personal medical records without the person’s or person’s agent’s written consent.
U.S. Privacy Act of 1974: The Privacy Act of 1974 is one of the first laws describing how federal agencies must collect, manage, and use personal data. Under the Act, citizens have the right to know how their details are collected and used, and the right to request corrections.
Gramm-Leach-Bliley Act: The Gramm-Leach-Bliley Act requires all financial institutions to protect sensitive personal information and clearly explain how they safeguard that information to their customers.

RESOURCE

The Electronic Privacy Information Center (EPIC) provides a complete list of U.S. federal data privacy laws.

What are some notable laws governing data privacy?

Each U.S. state has its own data privacy legislation. One of the most robust is the California Consumer Privacy Act of 2018 (CCPA), which establishes new and stronger rights for those affected by a data breach in California. The Act gives consumers the right to know what information a company collects and shares, delete most of their collected information, and opt-out from sharing or selling their details.

The Illinois Biometric Information Privacy Act establishes some of the strongest rights for citizens to sue companies for collecting biometric data. Biometric data includes retina scans, fingerprints, and voiceprints. Penalties range from $1,000-5,000 per violation, depending on whether the act was accidental or intentional.

What actions must businesses take to protect consumers when they experience a data breach?

Under the guidance of the Federal Trade Commission (FTC), companies are advised to take specific critical actions after a data breach. According to federal and state laws, they must notify potentially affected consumers in writing. In some instances, this can be as few as 30 days.

They should also take every measure to protect and remove any exposed data. They should implement a plan to identify and rectify the problem and notify the appropriate law enforcement agencies.

What regulatory bodies are responsible for enforcing data breach laws?

Only California has a specific agency for investigating and enforcing its data privacy laws. Otherwise, the state’s Department of Justice and Bureau of Investigation investigate suspected breaches, and the Attorney General tries cases.

Protecting U.S. citizens’ right to data privacy falls to the Privacy and Data Protection Task Force of the Federal Communications Commission (FCC). The FCC investigates how leaks happen, whereas the Federal Trade Commission (FTC) is then responsible for holding the at-fault companies accountable through legal action.

What are the emerging trends and challenges around data protection and privacy?

The International Association of Privacy Professionals (IAPP) has identified four major trends for financial data privacy starting in 2024. These include:

Third-party tracking technologies: Third-party vendors that use tracking tools increase your risk of data exposure. The FTC does not regulate these vendors, so holding them accountable is challenging.
Artificial intelligence abuse: Chatbots and other AI measures can put a company at risk of data breaches. Rapid improvements in AI image and video quality could allow hackers to deep-fake your identity.
New regulations for data brokers: The Fair Credit Reporting Act (FCRA) currently does not regulate companies that collect and sell personal data to other businesses. State and federal initiatives are underway to bring them under the FCRA’s jurisdiction.
Stronger obligations for managing breaches: Recent actions by federal and state government agencies indicate a trend toward more robust responses when companies experience a data breach.

What are some recent data breach case studies?

Many data breaches are due to simple employee negligence. A Pegasus Airlines system administrator misconfigured part of the cloud software, exposing over 6.5 Terabytes of information. This data included personal information on crew members and details on flight plans.

In 2023, the Federal Trade Commission (FTC) notified five major tax preparation companies they violated federal privacy laws for sharing customer data. Google, H&R Block, and TaxAct faced lawsuits alleging unjust enrichment, breach of implied contract, deceptive business practices law, and violations of federal wiretapping law.

In 2022, a recently terminated Cashapp worker deliberately downloaded the personal information of over 8.2 million customers, including full names and financial details. A class action lawsuit against Cashapp’s parent company, Block, alleged the company failed to warn customers promptly and did not revoke the employee’s access after firing them.

Contact Mason LLP if you have suffered harm from a data breach

The attorneys at Mason LLP actively monitor data breach cases of state and federal privacy laws, so we are prepared to handle your unique situation. Our team is currently litigating many cases where cyberattacks, negligent companies, and identity theft unfairly harmed consumers.

If this has happened to you, you need a trustworthy law firm. A data breach is serious and can have life-altering consequences. Schedule a free consultation with a data breach attorney at Mason LLP by calling (202) 429-2290 or completing our online form today.