While the warning signs of cyber exposures for senior management have been lurking for a few years now, the proverbial proof in the pudding was provided recently when news broke that Yahoo settled shareholder class action litigation with an $80 million payment to the claimants. While this settlement sum alone will never go down as the largest, it is a sizeable departure from past resolutions of cyber securities suits — by a lot. In fact, the trajectory seen with cyber class action consumer claims may have similar (and ominous) parallels for shareholder cyber class actions.

Consumer class actions portend shareholder class actions

Shareholder derivative lawsuits against officers and directors in the wake of data breaches are not a new development. Several have been filed over the last few years against officers and boards accused of permitting lax cybersecurity to inflict financial harm to the corporation and their shareholders. Almost all of these early shareholder suits were dismissed with prejudice, thereby notching early wins for officers and directors against such claims.

But things took a bit of a turn last year when Home Depot settled its shareholder derivative litigation for more than $1 million paid in attorneys' fees to the class action plaintiffs' counsel and agreed to a variety of settlement terms for prospective cybersecurity and oversight measures.