Race To The Courthouse: Why Data Breach Class Actions Now Arrive Before Notice Letters

Data breach class actions are a predictable sequel to almost any significant cybersecurity incident. These suits are typically brought on behalf of everyone whose personal information was affected by an incident, and they tend to assert a familiar mix of claims: negligence and negligence per se for failing to implement reasonable safeguards, breach of express or implied contract, unjust enrichment, breach of fiduciary duty, and statutory claims under state consumer protection statutes, state data breach and privacy laws. The proposed classes are defined by reference to the affected population, which means the universe of potential class members is, in theory, fixed by the facts of the incident itself.