Early Cybersecurity Derivative Actions Miss Target

As derivative actions against the principals of corporate targets of cyber attacks are in their infancy in Canada, there is relatively little to guide an understanding of the magnitude of threat they pose to Canadian directors and officers. Recent case law in the U.S. may well provide Canadian companies—and courts—with a glimpse of the future. For example, in early July 2016 a U.S. derivative action against Target Corporation was dismissed, joining a short list of failed U.S. actions against directors and officers for breaches of corporate cybersecurity.¹ In addition to highlighting the difficulty of advancing derivative actions for such breaches, the Target case offers some interesting insights into how companies, directors and officers should behave in anticipating and responding to probably-inevitable cyber breaches.