A data breach last year at California-based customer support service [24]7.ai may have exposed the credit card information of customers of Sears, Kmart and Atlanta-based Delta. These organizations are now faced with the task of sorting through potential liability stemming from state data breach notification laws and the role of third-party vendors in data exposure.

In a press statement issued on April 4, Delta announced that it had been made aware of the breach on March 28 and had begun working with [24]7.ai to get a sense of the breach's scope and impact. Delta also reportedly contacted federal law enforcement and forensic teams to confirm the breach and has launched a website to answer consumer questions about the breach.

Georgia is one of 47 U.S. states with breach notification laws on the books requiring companies to notify consumers in a timely fashion if state residents have had their data exposed by a breach. Efraim Harari, general counsel at cybersecurity technology company SentinelOne, noted, however, that national companies such as Delta are likely subject to even more stringent state breach notification laws.

“Delta Airlines probably has more customers in California, where their breach notification law is far beyond that, with credit monitoring for one year and a few other requirements, as is the case for Massachusetts,” Harari noted.

Because of the kind of data Delta retains, Harari said the potential to draw consumer concern is likely higher than it could be in a similar breach of a technology or data company. “Companies like Delta have a different problem in the sense that the type of data they process is highly personal and has immediate personal implications when it's been breached, specifically credit card information, Social Security information, things that can lead to fraud pretty quickly,” he noted.

“The reputational risk is paramount,” Harari said of data breaches more generally. “It causes serious damage to companies vis-à-vis their shareholders, their boards, their executives,” he noted.

Harari guessed that Delta, given its longevity in the market and size, probably mandates fairly strict data obligations for its data processors, meaning that a smaller tech vendor such as [24]7.ai is more likely to be held liable for data exposure. Companies smaller than Delta, however, may not have the same negotiating weight in establishing liability with their vendors, which could leave them exposed to litigation.

U.S. data privacy law, Harari said, hasn't fully resolved the question of whether users need to expressly consent (or opt in) to having organizations share their data, or whether organizations can simply share data unless users express otherwise (or opt out). He expects, however, that this may not always be the case.

“I do predict some shifts at some point in the U.S. toward a more opt-in option with respect to sharing with third parties, especially third parties whose activities with respect to the data are not what the user has signed up for,” he said.

Third-party breaches seem to be an increasingly common staple of corporate cybersecurity risks. An exposure of Verizon Communications' data last year was traced back to a third-party data storage center, as was an earlier breach at retailer Target.

Paul Sieminski, general counsel at WordPress' parent company Automattic, previously told Corporate Counsel that even when vendor systems are breached, organizations should approach the situation as if they are liable for consumer data loss. “I always feel that we're ultimately responsible for [our data] and when we choose partners, we can't wash our hands of it,” he noted. “A user whose account was breached is not going to accept: 'Oh, that wasn't us.'”

“[Vendors] are responsible for their own security practices and if there is a breach, if they failed in those obligations, they should bear responsibility for it. But you as the customer are responsible for selecting good partners,” Sieminski added.

Delta noted in a statement that the company would “directly contact customers who may have been impacted by the [24]7.ai cyber incident.”

“In the event any of our customers' payment cards were used fraudulently as a result of the [24]7.ai cyber incident, we will ensure our customers are not responsible for that activity,” the company added.

According to Delta, customer payment information may have been exposed by the breach, but passports, government IDs, security and SkyMiles for Delta customers were not impacted. The company plans to directly contact customers who may have been impacted by the breach and “will ensure our customers are not responsible for that activity.”

A statement issued by [24]7.ai noted that the breach occurred from Sept. 26 to Oct. 12, 2017.

Georgia has played host to a number of high-profile data breaches over the last few years, many of them exposing personal information for millions of consumers. A 2014 breach of a third-party vendor for Atlanta-based home improvement chain Home Depot impacted more than 56 million customers, and resulted in around $85 million in settlement fees for the company. Atlanta-based credit reporting company Equifax, which exposed data for over one-third of all U.S. residents, is now facing a whole slew of litigation around the handling of its breach.