Adobe Data Breach Ruling Gives New Hope To Plaintiffs

Data breach class actions have multiplied rapidly in the wake of several sophisticated, large-scale attacks on corporate computer systems, and a recent decision in California federal court may have added some new fuel to the fire. In a sharp departure from a string of recent decisions across the country, Judge Lucy H. Koh of the Northern District of California concluded that plaintiffs suing Adobe Systems Inc. had standing to bring claims against Adobe arising from a massive breach in 2013 even though they could not allege actual misuse of their stolen personal information.

The decision in In re Adobe Systems Inc. Privacy Litigation, No. 13-CV-05226-LHK (N.D. Cal. Sept. 4, 2014), is significant, as most other courts since the U.S. Supreme Court's decision in Clapper v. Amnesty International USA, 133 S. Ct. 1138 (2013), have dismissed similar actions for lack of standing where data breach plaintiffs have not alleged actual misuse of their data.

In a series of recent decisions, defendants have successfully relied on Clapper to dismiss data breach class actions, seemingly without regard to the individual facts of each case. The Adobe decision is a reminder that the law remains unsettled in this active area of class action and data security litigation, and appears likely to spur additional lawsuits in California federal court.

In re Adobe Systems arose from a 2013 attack on Adobe's computer network, in which hackers gained unauthorized access to Adobe's servers, including their "Creative Cloud" platform, a subscription-based program where customers pay a monthly fee to access Adobe's products and services. Adobe collects a variety of personal information from its users, including names, email and mailing addresses, telephone numbers, passwords, and credit card numbers and expiration dates for millions of customers.

In July 2013, hackers attacked Adobe's servers and spent several weeks inside Adobe's network without detection. During this sophisticated, weeks-long intrusion, hackers removed gigabytes of customer data and Adobe source code, an intrusion that remained undiscovered until September 2013 when independent security researchers discovered stolen Adobe source code on the Internet. Adobe disclosed the data breach in October 2013, announcing that hackers had accessed personal information belonging to 38 million customers, including names, login IDs, passwords, credit and debit card numbers, expiration dates, and mailing and email...