A Failed Strategy: Another Derivative Action In A Data Breach Case Goes Down To Defeat

Dismissal Of Home Depot Derivative Action Extends Shareholder Losing Streak

An attempt to impose liability on corporate officers and directors for data breach-related losses has once again failed. On November 30, 2016, a federal judge in Atlanta issued a 30 page decision dismissing a shareholder derivative action arising out of the September 2014 theft of customer credit card data from point-of-sale terminals in Home Depot stores. The dismissal of the Home Depot derivative action follows earlier dismissals of derivative actions arising from data breaches perpetrated against Wyndham and Target.

As in the Wyndham and Target cases, fundamental principles of corporate governance doomed the claims against Home Depot's officers and directors. In the Home Depot case it was failure to make a demand before bringing the derivative action. Under Delaware law, the board of directors controls the right to bring claims against officers and directors for breaches of duties