Companies May be Partially Shielded from Data Breach Class Action Suits

            The Seventh Circuit dismissed a class action lawsuit against Old National Bancorp, ruling consumers had no right to recover for a 2005 data breach.  The plaintiffs accused Old National Bancorp of failing to properly secure personal data collected through its web site after a hacker obtained access to a 2005 online customer application.  The breach exposed financial data and personal information, including social security numbers, of thousands of customers.

            The plaintiffs believed they should be compensated for the credit monitoring services they needed after the breach.  The Court ruled that Indiana law did not provide recovery for plaintiffs’ mere “allegations of increased risk of future identity theft.”  The Court stated the consumers “have not suffered a harm that the law is prepared to remedy.” 

            In sum, victims of data breaches cannot recover until they can show the breach actually led to identity theft.  At least according to this Court's determination, no remedy exists for an increased likelihood of identity theft, or for the expenses of credit monitoring.

For other articles on this see Wired, and Computerworld.