While the warning signs of cyber exposures for senior management have been lurking for a few years now, the proverbial proof in the pudding was provided recently when news broke that Yahoo settled shareholder class action litigation with an $80 million payment to the claimants. While this settlement sum alone will never go down as the largest, it is a sizeable departure from past resolutions of cyber securities suits — by a lot. In fact, the trajectory seen with cyber class action consumer claims may have similar (and ominous) parallels for shareholder cyber class actions.

Consumer class actions portend shareholder class actions

Shareholder derivative lawsuits against officers and directors in the wake of data breaches are not a new development. Several have been filed over the last few years against officers and boards accused of permitting lax cybersecurity to inflict financial harm to the corporation and their shareholders. Almost all of these early shareholder suits were dismissed with prejudice, thereby notching early wins for officers and directors against such claims.

But things took a bit of a turn last year when Home Depot settled its shareholder derivative litigation for more than $1 million paid in attorneys' fees to the class action plaintiffs' counsel and agreed to a variety of settlement terms for prospective cybersecurity and oversight measures.

What was particularly interesting about Home Depot's settlement with the class action attorneys is that it came on the heels of multiple (and early) litigation wins by policyholders facing cyber-related shareholder derivative lawsuits. Perhaps even more curious is that Home Depot settled with the underlying class action claimants when the company had already won dismissal of the shareholder class action lawsuit at the trial court level. That decision was on appeal when Home Depot made the decision to resolve the litigation through its settlement.