Employers Face Exposure for Cyberbreaches

HIGHLIGHTS:

• A newly filed lawsuit in California and a recent decision from the U.S. Court of Appeals for the Seventh Circuit serve as reminders to employers that the protection of sensitive employee information from cyberthreats should be a priority.
• In the Seventh Circuit decision, the Court of Appeals held that the increased risk of fraudulent charges and identity theft are injuries concrete enough to maintain a lawsuit.
• Given the prevalence of cyberattacks, employers have a duty to take reasonable steps to protect their employees' sensitive data housed on their human resource information systems (HRIS) and other systems from hackers.

A newly filed lawsuit in California and a recent decision from the U.S. Court of Appeals for the Seventh Circuit serve as reminders to employers that the protection of sensitive employee information from cyberthreats remains a priority.

California Lawsuit

A lawsuit filed on April 20, 2016, in a California federal court against Sprouts Farmers Market Inc. alleges that Sprouts acted negligently when it failed to adequately protect its employees' personal data and failed to maintain that data in a manner that would protect against phishing scams. According to the allegations in the lawsuit, on or around March 14, 2016, Sprouts sent its employees' 2015 W-2 forms, Social Security numbers and other sensitive information to an unknown third party in response to what purported to be an email from a company senior executive requesting the information. Approximately 21,000 employees allegedly were affected by this data-phishing scam.

The lawsuit, Julio Hernandez v. Sprouts Farmers Market Inc., No. 3:16cv00958 (S.D. Cal.), was brought as a class action. Sprouts purportedly offered its employees one year of free credit monitoring. But the complaint asserts that this is an insufficient response because its employees still run the risk of identity theft. Plaintiffs seek damages and an order for Sprouts to, among other things, take extensive measures to ensure its systems are adequately protected from future phishing scams and other cyberbreaches, inform the affected employees about the identity theft threats they face and what they can do to protect themselves, and to provide ongoing identity theft protection (not just credit monitoring services) to the affected employees.

Notably, there is no allegation that any Sprouts employee was an actual victim of identity theft. But as the Seventh Circuit recently confirmed in Lewert v. P.F. Chang's China Bistro, Inc., ___ F.3d ___ (7th Cir. 2016), being a victim of identity theft is not necessary to maintain a claim for damages in the aftermath of a data breach.

Seventh Circuit Decision

P.F. Chang's suffered a data breach at some of its restaurants, resulting in the compromise of its customers' credit card and debit card data. John Lewert, one of the named plaintiffs, used a debit card to pay for his meal at a P.F. Chang's restaurant. Lewert did not observe any fraudulent charges to his card and did not cancel his card or purchase a credit monitoring service. However, Lewert spent time monitoring his credit card statements and his credit report to ensure no fraudulent charges were made to the card and that no new accounts had been opened in his name. The Court of Appeals held that the increased risk of fraudulent charges and identity theft are injuries concrete enough to maintain a lawsuit. The court explained, "It is plausible to infer a substantial risk of harm from the data breach, because a primary incentive for hackers is sooner or later to make fraudulent charges or assume those consumers' identities." (Internal quotations and citations omitted.) Moreover, merely having to spend time and effort monitoring credit card statements and other financial information to guard against identity theft is a sufficient injury in itself to support a claim.

Lessons for Employers

Given the prevalence of cyberattacks, employers have a duty to take reasonable steps to protect their employees' sensitive data housed on their human resource information systems (HRIS) and other systems from hackers and other cybercriminals. What is reasonable depends on the size, nature and complexity of the business, but things to consider include assessment of the maturity of the security program, incident response capabilities, ongoing monitoring, vendor management, technical controls, taking corrective actions where weaknesses are found, and educating and training employees, particularly those who have access to sensitive data, about cyberthreats.

A cyberattack on a company’s systems can easily and quickly cascade into the company’s customers, employees, governmental entities (when the company is a government contractor) and others. A data breach of employee information, like a breach of customer information, can expose the employer to liability, potentially even in the absence of an actual instance of identity theft. Certain state and federal laws obligate the employer to issue notices to employees affected by a data breach and to have reasonable information security programs in place. Proactive measures to secure employee data is an investment that can pay dividends in the form of preservation of the employer's reputation, the avoidance of negative employee relations and cost savings. Evaluating the current maturity state of the company’s information security and response programs is the best place to start. Further, there are regulations in place that impose often detailed minimum cybersecurity requirements on companies in certain industries.

For more information about your company's duty to protect its employees' sensitive data, contact a member of Holland & Knight's Data Privacy and Security Team or Labor, Employment and Benefits Group.
   

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem. Moreover, the laws of each jurisdiction are different and are constantly changing. If you have specific questions regarding a particular fact situation, we urge you to consult competent legal counsel.