Data Breach Lawsuits Based On Failure To Encrypt Personal Information
When a company collects Social Security numbers, financial information, medical records, employee files, login credentials, or other sensitive data, protecting that information should be a fundamental part of its cybersecurity practices. Encryption can provide an important layer of protection by making information unreadable without the appropriate key or process. When sensitive personal information is stored or transmitted without adequate encryption, and attackers gain access to it, victims may face identity theft, financial fraud, account takeovers, tax fraud, medical identity theft, and other consequences. A failure to encrypt does not automatically establish liability in every data breach case, but it can become important evidence when determining whether an organization used reasonable security measures. At Net Law Advocates, we represent consumers, employees, patients, customers, and other plaintiffs throughout the United States who have been harmed by data breaches and inadequate cybersecurity practices.
Why Encryption Matters When Companies Store Personal Information
Encryption transforms readable information into a protected form that generally cannot be understood without the proper cryptographic key or process. It can be used to protect data stored on servers, databases, laptops, portable devices, and backups, commonly called data “at rest.” Encryption can also protect information while it moves between systems or across networks, commonly called data “in transit.”
The distinction can become extremely important after a breach. A criminal who obtains properly encrypted information without acquiring the encryption key may have data that is substantially more difficult to exploit. If the same criminal downloads an unencrypted database containing names, Social Security numbers, birth dates, and financial information, the information may be immediately readable and usable.
Encryption is not a substitute for an effective cybersecurity program. Access controls, multifactor authentication, system monitoring, software updates, vulnerability management, employee training, and other safeguards may also be necessary. In litigation, however, the absence of encryption can raise serious questions about why sensitive information was left readable and whether reasonable precautions could have reduced the consequences of the intrusion.
When Failure To Encrypt May Support A Data Breach Lawsuit
A successful data breach lawsuit generally requires more than showing that hackers defeated a company’s systems. The applicable legal standards vary by jurisdiction, industry, type of information involved, and the particular claims asserted.
We may investigate whether a company knew the sensitivity of the information it possessed, recognized foreseeable cybersecurity threats, had the technical ability to encrypt the information, represented that it protected the information, and nevertheless stored or transmitted sensitive records without appropriate protection. We may also examine whether earlier security assessments, audits, incidents, or warnings identified encryption deficiencies that were never corrected.
For negligence and similar state-law claims, issues may include duty, breach, causation, and legally recognized damages. Other cases may involve state privacy statutes, consumer-protection laws, contracts, industry-specific requirements, or statutory causes of action. The legal theory must therefore be evaluated under the laws that apply to each particular breach and plaintiff.
Federal Data Security Requirements May Affect Encryption Practices
There is no single federal statute that creates one encryption requirement covering every private company and every category of personal information. Instead, federal cybersecurity requirements frequently depend on the industry and information involved.
Financial institutions subject to the Gramm-Leach-Bliley Act are governed by data-security requirements designed to protect nonpublic personal information. Section 501 of the GLBA, codified at 15 U.S.C. § 6801, establishes an obligation to protect the security and confidentiality of customer information and guard against anticipated threats and unauthorized access. The Federal Trade Commission’s Safeguards Rule, 16 C.F.R. Part 314, applies to financial institutions within FTC jurisdiction and requires covered institutions to maintain an information-security program. The Rule requires covered institutions, subject to its provisions, to encrypt customer information both in transit over external networks and at rest, or use effective alternative controls when encryption is infeasible and the required approval and review conditions are satisfied.
Health information presents another important example. The HIPAA Security Rule, including 45 C.F.R. § 164.312, establishes technical safeguards for electronic protected health information. Encryption is identified as an “addressable” implementation specification for access control and transmission security. “Addressable” does not simply mean that a regulated entity may disregard the safeguard. The entity must evaluate what is reasonable and appropriate under the HIPAA Security Rule framework and implement the specification when appropriate or follow the regulatory requirements applicable to an alternative measure.
These federal requirements illustrate why the facts surrounding encryption can become significant in litigation involving sensitive financial or healthcare information.
State Data Security Laws Can Also Be Important
State laws can impose additional cybersecurity obligations. Because we represent plaintiffs nationwide, we evaluate the laws connected to the affected individuals, the defendant, the information involved, and the circumstances surrounding each incident.
California Civil Code § 1798.81.5 requires businesses that own, license, or maintain personal information about California residents to implement and maintain reasonable security procedures and practices appropriate to the nature of the information. The statute is designed to protect personal information against unauthorized access, destruction, use, modification, or disclosure.
Massachusetts provides an even more specific example. Under 201 CMR 17.04, covered persons electronically storing or transmitting personal information about Massachusetts residents must maintain specified computer-system safeguards. To the extent technically feasible, those requirements include encryption of personal information transmitted across public networks, information transmitted wirelessly, and personal information stored on laptops or other portable devices.
New York’s SHIELD Act, through General Business Law § 899-bb, requires businesses that own or license computerized private information of New York residents to develop, implement, and maintain reasonable safeguards. The law addresses administrative, technical, and physical safeguards, including assessing risks associated with information processing, transmission, and storage. Section 899-bb itself does not create a private right of action, which makes it important to distinguish regulatory obligations from claims an individual plaintiff can personally bring.
What Types Of Unencrypted Information Can Create Serious Risks?
The potential harm depends heavily on what attackers obtained. A breach involving an email address alone is materially different from a database containing enough information to impersonate someone financially.
We frequently evaluate breaches involving Social Security numbers, driver’s license and passport information, bank account and routing numbers, credit and debit card information, tax records, payroll information, medical records, health insurance information, usernames and passwords, authentication credentials, employee records, dates of birth, and other sensitive identifiers.
The combination of several data elements can be particularly concerning. A file containing a person’s name, date of birth, Social Security number, address, and financial information can provide criminals with many of the details needed to attempt identity-based fraud.
Proving Harm After An Unencrypted Data Breach
One of the central issues in data breach litigation is injury. The fact that information was exposed does not necessarily mean every affected person automatically has the same viable damages claim.
We examine whether victims experienced fraudulent charges, unauthorized bank transactions, identity theft, account takeovers, fraudulent credit applications, tax fraud, credit-report problems, loss of access to accounts, costs incurred responding to the incident, or other legally cognizable injuries. The applicable jurisdiction and cause of action can significantly affect what injuries support standing and what damages may be recovered.
We may also examine whether the compromised information appeared for sale or distribution, whether attackers actually exfiltrated files, whether credentials were subsequently used, and whether fraudulent activity corresponds with the timing and content of the breach.
How We Investigate A Failure To Encrypt Claim
When we evaluate a case, we do not look only at the fact that a breach occurred. We examine the cybersecurity practices that existed before the attack and the decisions that may have allowed sensitive information to remain vulnerable.
That investigation may include breach notifications, regulatory disclosures, forensic findings, corporate privacy and security representations, the categories of information compromised, prior cybersecurity incidents, applicable statutory requirements, and the organization’s data-security practices.
We also consider whether encryption was actually effective. Calling information “encrypted” does not necessarily end the inquiry. If attackers obtained the cryptographic keys along with the protected information, the security benefit may be compromised. The FTC’s Safeguards Rule, for example, treats encrypted customer information as unencrypted for its notification-event definition when an unauthorized person also accessed the encryption key.
National Data Breach Lawyers Representing Plaintiffs
Companies entrusted with sensitive information should take their security seriously. When a business stores valuable personal data without appropriate encryption or other reasonable safeguards and that information is compromised, the resulting investigation should examine more than the criminal who conducted the attack. It should also address whether the organization responsible for the data took reasonable and legally required measures before the breach occurred.
At Net Law Advocates, our cybersecurity lawyers represent plaintiffs in data breach, cyber law, biometric privacy, and identity theft matters throughout the United States. We investigate the security failures surrounding an incident, determine which laws may apply, evaluate the injuries suffered by affected individuals, and pursue appropriate claims against responsible parties.
If you received notice that your personal information was exposed in a data breach, or you have learned that sensitive information may have been stored or transmitted without adequate encryption, we can review what happened and discuss your legal options. A breach involving Social Security numbers, financial records, medical information, employee data, or other sensitive information deserves careful evaluation, particularly when victims have already experienced fraud or identity theft.
We represent plaintiffs throughout the United States and can evaluate whether inadequate encryption, deficient cybersecurity measures, or other data-security failures may support a claim for compensation. Please fill out our secure web form or call our firm at 888-913-2318 for your free consultation.
