Reports of cyber-attacks frequently make headlines and are on the rise.  Cyber hackers have a variety of motives for procuring data, from competitive advantage and reputation impairment to retaliation and monetary gain.  Information is a significant company asset and as producers and curators of such valuable and sensitive data, virtually all companies, large and small, are at risk of high-tech attempts to steal data and compromise systems. More than ever, businesses face extreme challenges in protecting intellectual property and personal information of customers, personnel, and third-party associates. In many instances, even the best protective efforts fail.

Our Services

Plaintiff’s cybersecurity, privacy and data breach litigation theories often include claims of breach of express and implied warranty, violations of federal and state statutes, negligence (failure to adequately protect personal information), notification delay, unfair business practices, and unjust enrichment.  Our attorneys are capable of defending companies against these theories in a wide range of industries, including:

Consumer Products

• Product liability claims related to internet connected devices, such as baby monitors, cars, home security systems, home thermostats, medical devices, refrigerators, smart phones and televisions, and IoT devices.

 Financial Services/Banking

• ATM Cash Out fraud breach
• Corporate Account Take Over (CATO) attacks resulting in unauthorized wire and ACH transactions to accounts
• Distributed Denial of Service (DDoS) attacks interrupting normal services
• Personnel, service provider, and supplier information data breach
• Customer credit and debit card and bank account information data breaches
• Cyber wire transfer fraud

Food & Beverage

• Intellectual property breach
• Point of sale and other customer credit and debit card information data breach
• Personnel, service provider, and supplier information data breach
• Programmable logic controller (PLC) hacking, compromising facility and food safety

Healthcare

• Patient personal identification information data breach
• Electronic health records data breach (HIPAA violations)
• Software breach disabling needed health care systems
• Personnel, service provider, and supplier information data breach

Insurance

• Coverage disputes
• Directors and officers (D&O) claims
• Errors and omissions (E&O) claims
• Commercial general liability (CGL) claims
• Cyber insurance claims

Labor & Employment

• Workplace privacy issues/ Employee surveillance
• Personnel, service provider, and supplier information data breach
• Employees working from home on unsecured equipment
• Bring your own device (BYOD) issues

Pharmaceutical and Medical Device

• Medical device software vulnerabilities that could compromise device performance and patient safety
• Research and development data breach

Real Estate Brokers and Title Companies

• Cyber wire transfer fraud

Retail, Restaurant, and Hospitality

• Personnel, service provider, and supplier information data breach
• Customer preferences data information breach
• Point of sale and other customer credit and debit card information data breach

Transportation (Aerospace, Automotive, Trucking)

• Hijacking of software to manipulate or disable features that may endanger the lives of drivers and passengers

In addition to providing litigation defense services, we monitor and advise clients on the ever changing landscape in state and federal data privacy laws as well as statutory and regulatory requirements applicable to the client’s business and industry.
 

Our Experience

Our technology-savvy attorneys have extensive experience with regulated industries and are familiar with the federal and state laws and regulations governing and the agencies  investigating and enforcing cybersecurity, data and privacy policies and procedures, including:

Government Agencies and Industry Regulatory Bodies

• Federal Aviation Administration (FAA)
• Federal Trade Commission (FTC)
• Financial Industry Regulatory Authority (FINRA)
• Food and Drug Administration (FDA)
• National Technical Information Service (NITS)
• U.S. Department of Defense (DOD)
• U.S. Department of Justice (DOJ)
• U.S. Security and Exchange Commission (SEC)

Acts/Regulations

• CAN-SPAM Act
• Electronic Communications Privacy Act (ECPA)
• Fair and Accurate Credit Transactions Act (FACTA)
• Fair Credit Reporting Act (FCRA)
• Federal Information Security Management Act (FISMA)
• Federal Trade Commission Act (FTCA)
• Gramm-Leach-Bliley Act (GLBA)
• Health Insurance Portability and Accountability Act (HIPPA)
• Sarbanes-Oxley Act (SOX)
• Telephone Consumer Protection Act (TCPA)
• The Children’s Online Privacy Protection Act (COPPA)
• State breach notification laws
• Other federal and state laws

Many of our attorneys are experienced in defending complex MDL and class action litigation.  All of our attorneys are skilled at identifying and executing the best approach for each litigated matter.  Core members of the practice are active in cybersecurity, privacy and data protection committees of the American Bar Association (ABA), Claims and Litigation Management Alliance (CLM), and Defense Research Institute (DRI) and many contribute to panels and publications concerning cybersecurity, privacy and data protection issues. 

For more information about our Cyber Liability, Privacy & Data Breach practice contact Tom Rice or Paul Penticuff in Kansas City at 816.471.2121. In St. Louis, contact Lisa Larkin at 314.345.5000.

News & Events

Thomas Rice Serves as Moderator For Cyber Liability and Data Breach Panel

03.18.16 | Thomas Rice will moderate a panel on cyber liability and data breaches in the workforce and related legal and ethical considerations for in-house counsel, corporate risk management and law firms. Panel members feature representatives from three different insurance companies with cyber liability expertise plus an attorney from ALFA International’s Los Angeles, California member firm...

Blog Posts

FDA Announces Strengthened Focus On Cybersecurity

10.11.18 | In an October 2, 2018 statement issued from FDA Commissioner Scott Gottlieb, M.D., the FDA announced its efforts to strengthen its medical device cybersecurity program in order to protect patients from medical device vulnerabilities and emerging threats to those devices.

$224 million sought in lawsuit against AT&T over cryptocurrency theft

08.22.18 | Cryptocurrency investor Michael Terpin filed an action against AT&T seeking $24 million in actual damages and $200 million in punitive damages in what could be a landmark case for the standard of care required for data and phone service providers in the realm of cryptocurrency.

FDA - Postmarket Management of Cybersecurity in Medical Devices

06.05.17 | It seems almost impossible in today's world to escape our dependence on technology. From the minute we wake-up in the morning, we access news reports on our tablets, keep track of our health with fitness trackers, receive and respond to e-mails on our mobile phones, and many of us rely upon interconnected medical devices, such as insulin pumps, to safely navigate through a typical day. But such convenience is not without risk.

You've Got Mail - Service of Process by Mail is Satisfactory under the Hague Service Convention

05.30.17 | The United States Supreme Court ruled on May 22, 2017, that the Hague Convention, on the service of judicial documents abroad, permits service by mail if the receiving country has not objected to service by mail and service by mail is authorized under otherwise-applicable law.

The Daubert Standard - Coming Soon to a Missouri Court Near You

03.31.17 | Earlier this week, Governor Eric Greitens signed Missouri HB 153 into law. HB 153, which supplants Missouri's existing expert witness standard with that set forth in Federal Rules of Evidence 702, 703, 704 and 705, effectively submits expert testimony in most civil and criminal case to the analysis set forth in Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993).

Federal Judges Blow Their Stacks Over Boilerplate Objections

03.27.17 | Within a two-week period, two federal judges issued strongly worded orders denouncing the common practice of asserting boilerplate objections to written discovery.

Effectively Addressing Cybersecurity Breaches in Medical Devices (Part 3 of 3)

01.24.17 | Continuing from our two prior posts in this three-part series on effectively addressing cybersecurity breaches in medical devices, this third and final post will focus on best practices to prepare, mitigate and otherwise manage vulnerabilities and potential cyber-attacks.

Effectively Addressing Cybersecurity Breaches in Medical Devices (Part 2 of 3)

01.11.17 | Continuing from our prior post in a three-part series on effectively addressing cybersecurity breaches in medical devices, this second post will focus on specific examples of cybersecurity attacks on medical devices.

An Ounce of Prevention is Worth a Pound of Cure: A Practical Guide to Reducing the Risk of a Data Breach

12.19.16 | Most organizations collect and store personal or sensitive information about their clients and employees. Protecting sensitive or private information should be a priority for all organizations, regardless of their size. Threats to information security arise from...

Effectively Addressing Cybersecurity Breaches in Medical Devices (Part 1 of 3)

12.14.16 | We will explore in a series of three blog posts: (1) the specific vulnerabilities and risks inherent with embedded and interconnected medical devices, (2) cybersecurity and attacks on medical devices, and (3) practical approaches companies may employ both before and after a device is marketed. This first post in the series serves as an introduction to navigating the medical device field...

FinCEN Issues New Advisory to Financial Institutions Regarding Reporting of Cyber-Events

12.01.16 | On October 25, 2016, FinCEN issued an Advisory outlining recommendations and requirements for financial institutions to report suspicious activity in compliance with the Bank Secrecy Act, clarifying these institutions' obligation to report cyber-events, even where no financial transaction was completed.

The Potentially Dangerous Intersection of Healthcare and Social Media

08.05.16 | Lately, there have been numerous reports in the media raising patient privacy concerns due to healthcare providers' use of social media in the workplace. Employers, regulators and even law makers and law enforcement are taking very seriously these new types of privacy concerns spawned by emerging and evolving social media platforms, and they are becoming more aggressive in pursuing such cases

A CGL Policy May Provide A Duty To Defend Data Breach Claims - 4th Circuit Court of Appeals Decision

04.14.16 | The 4th Circuit Court of Appeals has ruled that a commercial general liability policy (CGL) may cover a data breach, at least for the purposes of a duty to defend. In a case involving the publication of private medical records on the internet, the federal appellate court agreed with the lower federal district court in Virginia that coverage included in a CGL for personal and advertising injury applied.

Insuring Companies from Cyber Risk and Liability

04.01.16 | Recently, privacy, data breaches, and cyber security issues have taken center stage in the media. In the event of a data breach, a company faces a multitude of expenses both internally and externally including but not limited to investigation, business loss, and remediation. Companies are responding to the risk of data breach events, in part, by seeking insurance coverage.

FDA Issues Draft Guidance Document for Postmarket Management of Cybersecurity in Medical Devices (Part 4 of 4)

02.26.16 | The Proper Elements of an Effective Postmarketing Cybersecurity Program - The most practical portion of the FDA's proposed guidelines is found in the Appendix. In this Section, the agency attempts to bring together all of the concepts from their recommendations into a cohesive summary of the necessary components of a proper cybersecurity program. The section discusses five broad concepts drawn from the NIST Framework...

FDA Issues Draft Guidance Document for Postmarket Management of Cybersecurity in Medical Devices (Part 3 of 4)

02.22.16 | Remediating and Reporting Cybersecurity Vulnerabilities - Manufacturers are required to determine if the residual risk of a cybersecurity vulnerability is "controlled" (acceptable) or "uncontrolled" (unacceptable). Following this initial determination of the seriousness of the risk to "essential clinical performance", the FDA has recommended a variety of both remediation and reporting requirements...

FDA Issues Draft Guidance Document for Postmarket Management of Cybersecurity in Medical Devices (Part 2 of 4)

02.17.16 | Risk Assessment and Management in a Dangerous World - Manufacturers of medical devices are faced with ever-increasing cyberattacks that could impact patient safety and the efficacy of useful devices. One insurance group identified cyberthreats to medical devices as "open and growing", describing a difficult "real world" scenario involving implantable defibrillators.

FDA Issues Draft Guidance Document for Postmarket Management of Cybersecurity in Medical Devices (Part 1 of 4)

02.15.16 | Background and Overview of Essential Concepts - As part of the increase in cybersecurity issues in an increasingly networked society, the FDA has decided to provide medical device manufacturers with structure and specificity in its quest to counter threats to patient safety. Although most of the recommendations offer industry a chance to self-police relatively minor security issues, the agency has proposed that a small subset of vulnerabilities...