Lawyers suing Atlanta-based credit bureau Equifax over a massive data breach have branded company efforts to dismiss the litigation a “perverse argument … akin to the 'too big to fail' rationale that lead to the Great Recession.”

Responding to the company's motion to dismiss hundreds of complaints against Equifax, counsel for consumers whose financial and personal data was exposed scoffed at Equifax lawyers' claims that no one was actually harmed and that it had no legal duty to safeguard the personal and financial data it routinely collects and monetizes.

“In fact, the need for a duty in such circumstances is even more critical to ensure that companies have an incentive to spend the money needed to prevent the harm in the first place, rather than allowing them to shift the expense of failing to do so to innocent third-parties,” consumer lawyers contended in their Aug. 13 response.

Ken Canfield of Atlanta's Doffermyre Shields Canfield & Knowles, Amy Keller of DiCello Levitt & Casey in Chicago and Norman Siegel of Stueve Siegel Hanson in Kansas City are co-lead counsel for hundreds of consumers who have filed lawsuits stemming from the exposure of their personal and financial data. Equifax has acknowledged that the personal and financial data of about 143 million consumers may have been exposed or stolen by hackers.

The cases have been consolidated in multidistrict litigation in federal district court in Atlanta. Chief Judge Thomas Thrash Jr., who has presided over multidistrict litigation over a data hack at Atlanta-based home supply chain The Home Depot, is presiding in the Equifax cases.

A team of King & Spalding lawyers led by partners David Balser and Phyllis Sumner, represents Equifax. In a July 16 motion, Balser argued that claims brought by consumers, credit unions, banks and associations for financial institutions were based on an “attenuated theory of liability” that is unprecedented and “far-fetched.” And, in a June 27 motion, Equifax argued that a 566-page consolidated complaint on behalf of consumers was “long on words” but “short on operative facts.”

In both motions, Equifax argued a common defense in data breach cases: The vast majority of plaintiffs lacked standing to sue in federal court because they had no injuries from the breach—just speculation about the increased risks of identity theft.

In response, consumer lawyers contended that everyone whose confidential data was exposed was harmed in multiple ways that other judges, including Thrash, have determined were valid.

Those alleged injuries include:

  • Spending time and incurring out-of-pocket loss addressing issues relating to identity theft and fraud;
  • Purchasing credit monitoring and credit freezes to mitigate possible harm;
  • Monitoring financial accounts;
  • Experiencing a decline in credit scores, which jeopardizes their borrowing ability and causes other problems;
  • Lost opportunity costs, unauthorized withdrawals from their accounts and the loss of value of personal information; and
  • Imminent risk of future harm.

“To the extent Equifax questions whether [the plaintiff consumers'] mitigation expenses were necessary or recoverable, those are jury issues,” consumer lawyers contended.

“The cost to Equifax of having adequate data security is a small fraction of the damage it has imposed on plaintiffs and the consumer credit system,” they said.

Consumer lawyers also took aim at Equifax arguments that consumers whose data was stockpiled could not claim they had been duped by alleged company misrepresentations about data security because the credit bureau does not generally obtain information directly from consumers, but, instead, collects the bulk of its data from third parties.

That argument ignores the “special role in the consumer economy in which [credit reporting agencies] are authorized to gather [consumers'] confidential information and, in highly regulated circumstances, disseminate that information,” consumer lawyers said.

“The reality is that all of the actors in the consumer economy―including [the plaintiff consumers], data furnishers, and regulators―relied to their detriment on Equifax's actions,” they contended. “By misrepresenting the truth regarding its commitment to data security and failing to disclose that its existing security measures were virtually non-existent, Equifax deprived the marketplace, including [the consumer] plaintiffs, of critical information needed to make informed decisions. Had the truth been known, [consumers] and the other actors could have taken protective action, such as refusing to do business with Equifax and those who furnished data to Equifax, or otherwise adjusting their behavior.”