Forget Legal Fees, Other Data Breach Costs Can Be Company Ending
Legal fees are to be expected when a company's data is breached. But are companies prepared for the storm of bad press, ballooning IT expenses and steep notification costs? One company says it wasn't.
June 28, 2019 at 10:00 AM
4 minute read
When it comes to data breaches, the sticker shock isn't just from an outside counsel's invoice.
The bankruptcy filing of Retrieval-Masters Creditors Bureau Inc., which collects medical bills under the name American Medical Collection Agency (AMCA), offers a cautionary example of the costs associated with a data breach. From reputational harms to notification spending and IT expenses, the non-litigation costs can be considerable.
In a June 17 filing in the U.S. Bankruptcy Court for the Southern District of New York, the company wrote it was left in financial distress after it announced its servers were hacked. Because of the security incident, AMCA exposed nearly 20 million Quest Diagnostic and LabCorp customers' data, including their birth dates, addresses, phone numbers and medical bill balances.
According to the bankruptcy filing, almost immediately after AMCA announced the breach, it was fired by LabCorp, and its financial losses continued to mount. Along with hiring IT personnel and consultants for $400,000, AMCA spent $3.8 million to mail over seven million individual notices in accordance to various states' data breach notification requirements. As a result of ballooning spending and losing its largest client, the company reduced its workforce and said it “no longer is optimistic that it will be able to rehabilitate its business.”
The news of AMCA's hefty costs stemming from a data breach highlights the consequences breaches can pose, said Connell Foley cybersecurity and data privacy chair Karen Painter Randall.
“The costs are outrageous [even] if you can afford it, but it appears in this case [AMCA] couldn't,” Randall said, adding, “It could be very complex and costly once you engage in the notification process.”
She noted that every state has its own data breach notification law, placing a company that collects personal data from residents of various states under the scope of multiple requirements.
Some data breach notifications require mailed notice of the breach, making companies responsible for printing and paying to ship letters. “It adds up if you have millions of people,” said Davis Polk & Wardwell partner Avi Gesser.
Outside of the financial penalties doled out by law enforcement and regulators, a data breach can also sour public perception of a company and negatively impact its profits.
“'If you have the type of business—a cyber or law firm where people rely on you to keep their secrets—if you have experienced a data breach you may have a loss of confidence,” Gesser said. The bad press may also hurt in recruiting talent or keeping clients, he added.
Likewise, ransomware attacks that lock a company out of its own computer system can disrupt a business's operations and revenue. “One of the reasons why people are getting cyberinsurance is to cover these types of costs,” Gesser said.
Randall agreed and said a cyber liability policy could have covered a data breach like AMCA's.
“It would be interesting to know if the entity had a cyber liability insurance,” she said. “That would have covered a lot. My thought is they may not have had a cyber liability policy in place.”
According to the bankruptcy declaration, Retrieval-Masters Creditors Bureau's CEO Russell Fuchs personally loaned his company $2.5 million to cover mailing seven million breach notifications, a cost that could have been covered by a cyberinsurance plan, Randall noted.
“That gives you an example of what an incident response could cost. That's just the first-party loss, that doesn't include litigation costs and reputational costs,” she said.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllTrending Stories
- 1Chief Judge Joins Panel Exploring Causes for Public's Eroding Faith in NY Legal System
- 2Pogo Stick Maker Wants Financing Company to Pay $20M After Bailing Out Client
- 3Goldman Sachs Secures Dismissal of Celebrity Manager's Lawsuit Over Failed Deal
- 4Trump Moves to Withdraw Applications to Halt Now-Completed Sentencing
- 5Trump's RTO Mandate May Have Some Gov't Lawyers Polishing Their Resumes
Who Got The Work
J. Brugh Lower of Gibbons has entered an appearance for industrial equipment supplier Devco Corporation in a pending trademark infringement lawsuit. The suit, accusing the defendant of selling knock-off Graco products, was filed Dec. 18 in New Jersey District Court by Rivkin Radler on behalf of Graco Inc. and Graco Minnesota. The case, assigned to U.S. District Judge Zahid N. Quraishi, is 3:24-cv-11294, Graco Inc. et al v. Devco Corporation.
Who Got The Work
Rebecca Maller-Stein and Kent A. Yalowitz of Arnold & Porter Kaye Scholer have entered their appearances for Hanaco Venture Capital and its executives, Lior Prosor and David Frankel, in a pending securities lawsuit. The action, filed on Dec. 24 in New York Southern District Court by Zell, Aron & Co. on behalf of Goldeneye Advisors, accuses the defendants of negligently and fraudulently managing the plaintiff's $1 million investment. The case, assigned to U.S. District Judge Vernon S. Broderick, is 1:24-cv-09918, Goldeneye Advisors, LLC v. Hanaco Venture Capital, Ltd. et al.
Who Got The Work
Attorneys from A&O Shearman has stepped in as defense counsel for Toronto-Dominion Bank and other defendants in a pending securities class action. The suit, filed Dec. 11 in New York Southern District Court by Bleichmar Fonti & Auld, accuses the defendants of concealing the bank's 'pervasive' deficiencies in regards to its compliance with the Bank Secrecy Act and the quality of its anti-money laundering controls. The case, assigned to U.S. District Judge Arun Subramanian, is 1:24-cv-09445, Gonzalez v. The Toronto-Dominion Bank et al.
Who Got The Work
Crown Castle International, a Pennsylvania company providing shared communications infrastructure, has turned to Luke D. Wolf of Gordon Rees Scully Mansukhani to fend off a pending breach-of-contract lawsuit. The court action, filed Nov. 25 in Michigan Eastern District Court by Hooper Hathaway PC on behalf of The Town Residences LLC, accuses Crown Castle of failing to transfer approximately $30,000 in utility payments from T-Mobile in breach of a roof-top lease and assignment agreement. The case, assigned to U.S. District Judge Susan K. Declercq, is 2:24-cv-13131, The Town Residences LLC v. T-Mobile US, Inc. et al.
Who Got The Work
Wilfred P. Coronato and Daniel M. Schwartz of McCarter & English have stepped in as defense counsel to Electrolux Home Products Inc. in a pending product liability lawsuit. The court action, filed Nov. 26 in New York Eastern District Court by Poulos Lopiccolo PC and Nagel Rice LLP on behalf of David Stern, alleges that the defendant's refrigerators’ drawers and shelving repeatedly break and fall apart within months after purchase. The case, assigned to U.S. District Judge Joan M. Azrack, is 2:24-cv-08204, Stern v. Electrolux Home Products, Inc.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250