Equifax recently announced they suffered a very large data breach, allegedly affecting almost half of all people in the United States. It's expected that lawsuits against Equifax will be popping up in the next weeks and months.

For someone whose data was leaked, but the leaked information was not subsequently used with criminal intent (identity theft, in this example), what damages would a plaintiff typically claim? Or could they seek damages at all?

Obviously if the leak resulted in someone's identity being stolen, or used in some other fraudulent way, there are tangible damages. But what if the data was never used that way?

This isn't the first data breech to be met with litigation, so in previous scenarios, what do plaintiffs typically claim as damages?

  • 1
    How long must you wait to know that your leaked data will never be used for identity theft?
    – DJohnM
    Sep 14, 2017 at 1:45
  • How do you know the leaked data wasn't used? Maybe there was a payment that you should have received but you never did, because someone grabbed it using your data. Maybe a 15 year old pension account has been raided and you didn't notice.
    – gnasher729
    Mar 31, 2021 at 10:00

1 Answer 1

  1. A plaintiff whose Name, Social Security numbers, birth date, addresses, driver’s license numbers and credit card numbers(information/data) have been released to unknown persons without due authorisation faces several risks. The data was not accidentally released, it was a malicious intent. Someone exploited a web application software vulnerability and gained unauthorised access to data.

  2. There is or should be no question that the ill-gotten data is being exploited or will be exploited,sooner or later. While information such as credit card numbers can be changed, ones names,SSN,DL,DOB can never and therefore the risk is perpetual.If risk is perpetual, the pain and suffering that such an event may cause to a human is real, irrespective of the fact whether the data was misused and caused any direct harm. An “increased risk of identity theft” constitutes injury as Courts have ruled.

  3. When a car collides with another as a result of one of the driver failing to exercise care, there could be a person injured and or damage to the property. In a persons data loss as in the case of Equifax failing to exercise standards of care for data protection,there is no obvious property damage or any tangible damage.

4.Injury to a Person

(a) Is a person whose credit card information lost in a data breach get injured ?. One could suffer emotionally, could experience pain and suffering as a result of emotional suffering, and or suffer loss of consortium. How does one prove emotional distress, pain, suffering, loss of consortium without actually producing licensed MD visits, actual prescription orders, visits to the Psychiatrist or Counselor? Lacking evidence of actual treatment, an actual diagnosis, there is little room to claim injury to a person as a result of data loss.

(b) It may not be totally impossible to conduct blood tests or other biomedical tests to measure and quantify pain bio markers during the days following the breach to support a claim for pain.MRI or other imaging may also support changes caused by the loss.

5.Economic loss. When a persons property is lost,damaged or destroyed by others acts, there is a cost to repair or replace the property. In the case of a persons data loss, there may be costs associated to repair,replace, protect future misuse of the data. There are costs associated with these actions that may be deemed as damages.Some of these costs may be one time and some may be needed on an ongoing basis for ever. A well documented journal itemising costs, time, labor post breach may well support ones case for damages/losses/costs.

(a) Courts have dismissed many post-breach consumer negligence claims for failing to allege cognizable damages, frequently on the grounds that plaintiffs could not show they had actually lost money or suffered identity theft because of the data breach. In the RockYou data breach case, In particular, the Court focussed on this very issue issue of damages arising out of the data breach and ruled that damages were properly alleged.

(b) Valuation of ones data. The RockYou case favors plaintiffs arguement of damages with a reasoning "..breach of data ... caused Plaintiff to lose some ascertainable but unidentified “value” and/or property right inherent in the data...". 6. In yet another case favoring Plaintiffs claim for damages, the complaint asserted:-

"plaintiffs suffered financial losses by being forced to spend money to place alerts with credit reporting agencies and to contest fraudulent charges (e.g., cellular telephone minutes, postage, travel-related costs); by being forced to spend money an ongoing basis for a subscription to an identity theft protection service; and by missing work, incurring lost wages, and suffering a loss of goodwill at work to spend time meeting with the police to report and attempt to remedy the effects of the identity theft".


  1. Lacking actual misuse of lost personal information, the increased risk of identity theft constitutes injury.

  2. Plaintiffs in similar data breach lawsuits have argued a wide variety of damages but the courts are not moved easily on actual damages leading to case dismissals. • Increased risk of identity theft. • Untimely and inadequate notification. • Improper disclosure of PII. • Invasion of privacy. • Decreased value of PII. • Anxiety and emotional distress. • Overpayment for products.

  • 7
    This would be more credible if you included citations for the underlying case law.
    – user6726
    Sep 16, 2017 at 19:57

You must log in to answer this question.