The National Trial Lawyers
  • Home
    • Meet Our Team
    • Contact Us
    • Mission & Goals
    • FAQ
  • Webinars
  • News
  • Membership Directory
    • Top 100 Map – Civil Plaintiff
    • Top 100 Map – Criminal Defense
    • Top 40 Under 40 Map – Civil Plaintiff
    • Top 40 Under 40 Map – Criminal Defense
  • Top 100
    • Civil Plaintiff Officers / Executive Committee
    • Criminal Defense Officers / Executive Committee
    • Benefits
    • About
    • Top 100 Presidents Message
    • Diplomat
    • Membership Renewal
    • Member Profile Updates
    • Top 100 Badge
  • Top 40
    • Civil Plaintiff Officers / Executive Committee
    • Criminal Defense Officers / Executive Committee
    • Top 40 Under 40 Trial Academy Bootcamp
    • Benefits
    • About
    • Top 40 Presidents Message
    • Membership Renewal
    • Member Profile Updates
    • Top 40 Badge
  • Specialty Assoc
    • About
    • Shop
    • Officers
    • Membership Renewal
    • Member Profile Updates
  • Nominate
    • Top 100
    • Top 40
    • Specialty Association
    • Trial Lawyer Hall of Fame
    • Trial Lawyer of the Year
    • Trial Team of the Year
    • America’s Most Influential Trial Lawyer
    • America’s Most Influential Law Firm
    • Lifetime Achievement Award
  • Shop
  • Magazine
    • A-List
  • Education and Networking Agenda
    • Trial Lawyers Summit
    • Top 40 Under 40 Trial Academy Boot Camp
    • Mass Torts Made Perfect
    • The Lanier Trial Academy Master Class 6.0
    • The Business Of Law
    • Webinars
  • Hall of Fame
    • Trial Lawyer Hall of Fame

7th Circuit Grants Standing to Neiman Marcus Data Breach Plaintiffs

Posted on September 22, 2015 by Eleanor Smith

Neiman Marcus

The Seventh Circuit ruled that the risk of future harm in a data breach is sufficient to take major companies to court. Plaintiffs, such as the Neiman Marcus Group LLC customers, now have standing to hold companies liable for a data breach, regardless of whether the actual harm of identity theft ever occurs.

The U.S. Court of Appeals reinstated the 2013 cyber attack case that had been dismissed by the district court, holding the likelihood of personal data exposure following a system breach is “immediate and very real.” Neiman Marcus never even investigated the nearly 60,000 software alerts its software system received during the data breach.

Implications for All

As the first federal appellate decision on the issue of standing to assert data breach claims for years, the Neiman Marcus decision will be cited frequently in creating the legal framework for data breach class actions. As one of the first federal appellate decisions on the issue of standing to assert data breach claims, Neiman Marcus will likely cast implications upon other currently pending data breach cases, such as Lewert v. P.F. Chang’s China Bistro, Inc., No. 14-cv-4787 (N.D. Ill. Dec. 10, 2014), a case also before the Seventh Circuit.

The precedent-setting ruling means that companies will likely have to contend with more lawsuits after security breaches that have affected millions of consumers in recent years. The opinion noted that the Neiman Marcus plaintiffs’ allegations go far beyond those at issue in Spokeo v. Robins, a case expected to have wide-ranging federal consumer protections implications.

Plaintiffs’ counsel, Robert Ahdoot, told Law360 the decision means “data breach victims, who carry the burden of protecting themselves against the imminent risk of identify theft and fraud, can now have their day in court against companies who fail to secure consumers’ personal information against hackers.” The plaintiffs are seeking a minimum of $5 million in damages.

Standing to Sue

The court granted the standing to the plaintiffs, based on the uncontested fact that the data breach exposed 350,000 consumers’ personal data. Neiman Marcus admitted in 2014 that of the 350,000 people whose information was stolen, 9,200 individuals’ credit card data had since been used fraudulently, but the number of potential or actual thefts is now irrelevant. The Seventh Circuit determined the Neiman Marcus victims “should not have to wait until hackers commit identity theft or credit-card fraud in order to give the class standing, because there is an ‘objectively reasonable likelihood’ that such an injury will occur.”

According to Bloomberg, the company’s centralized computer system flagged the anomalous behavior of a malicious software program while the data breach occurred. However, the 59,746 alerts set off by the malware were never investigated. Using a different strategy and set of tools than the Target hackers, the Neiman Marcus hackers used custom hacking software and sent the data out through a virtual private network (VPN).

See Also: Supreme Court to Examine Inaccurate Spokeo Profiles that Prevent Getting a Job

The Neiman Marcus hack was made easy by the point-of-sales system arrangement among the stores’ payment registers. Store registries are connected to the central computer that processes transactions, so the hackers were able to upload their software on multiple registers quickly, after carefully deleting the software at the end of each day.

In finding the plaintiffs suffered a substantial risk of harm, the Court asked rhetorically, “Why else would hackers break into a store’s database and steal consumers’ private information?”

The case is Remijas et al. v. The Neiman Marcus Group LLC, case number 14-3122, in the U.S. Court of Appeals for the Seventh Circuit.

Posted in Blog, Business Law, Class Actions, Consumer Protection

Comments are closed.

News Categories

Read about other Top Jury Verdicts

Virginians Will Receive $489 Million in a Payday Loan Settlement

Virginians Will Receive $489 Million in a Payday Loan Settlement

Online payday loan companies that charged as much as 919% interest will spend $489 million to reimburse some 555,000 borrower[Read More...]
The State of Minnesota Will Pay $1.5 Million to a Man Who Alleged Excessive Force During an Arrest

The State of Minnesota Will Pay $1.5 Million to a Man Who Alleged Excessive Force During an Arrest

Minneapolis has agreed to pay $1.5 million to a man who said police used excessive force when he was arrested during the prot[Read More...]
A $230 Million Settlement Is Reached Over a 2015 Southern California Oil Spill

A $230 Million Settlement Is Reached Over a 2015 Southern California Oil Spill

The owner of an oil pipeline that spewed thousands of barrels of crude oil onto Southern California beaches in 2015 has agree[Read More...]
The LeClairRyan-UnitedLex Dispute Reaches a Pending $21 Million Settlement

The LeClairRyan-UnitedLex Dispute Reaches a Pending $21 Million Settlement

After a prolonged mediation process, the LeClairRyan bankruptcy estate looks to have reached a sizable settlement in one of t[Read More...]
The Families of Holyoke Soldiers Home Victims Reach a $56 Million Settlement

The Families of Holyoke Soldiers Home Victims Reach a $56 Million Settlement

Massachusetts has agreed to pay $56 million to settle a class-action lawsuit brought by the families of veterans who died or [Read More...]

#LegalNews

@@TheNTLtop100

Contact Us | Terms of Use | Privacy Policy

Attorney information and content provided on this website is provided for the benefit of members of The National Trial Lawyers and as a public service by Legal Associations Management, Inc. The website and all data are the property of Legal Associations Management, Inc. Data, including without limitation attorney information and content, on the site may not be mined, sold, or used commercially for any purpose without the explicit written consent of Legal Associations Management, Inc. This site may not be accessed by any automated program for extracting data for any use. By accessing and using the site you agree that you will not develop, support or use software, devices, scripts, robots, or any other means or processes (including crawlers, browser plug-ins and add-ons, or any other technology) to scrape data or otherwise copy profiles and other data. Unauthorized use or attempted unauthorized use of this system may subject you to both civil and criminal penalties.