Chapter 5Litigation and Fraud Risk
Until the derivative lawsuits were filed, Home Depot's settlements were aligned with the traditional exposure of a data breach (see Figure 5.1). Suing directors on a cybersecurity issue is new. Arguments suggested that the directors and officers had not met their obligation for oversight and safeguarding. Not only had the company ignored a known industry threat, they did not have the most basic of controls in place to protect their payment card data. The situation was exacerbated by the time lag before they knew that they had an issue.
Figure 5.1 The Case of Home Depot
Cases like Home Depot have now taken the cyber exposure well into the realm of potential securities fraud. Until recently, a lack of Board level understanding or knowledge was a defense. Current cases show that can no longer be presumed. As with the Home Depot example above, directors and officers of Yahoo! and Wendy's have been named in derivative lawsuits for board failures ranging from failure to act to inadequate or misleading disclosures.
The case of Yahoo! is a recent example of litigation against the directors and officers of the company for the adequacy of the company's public disclosures. According to the plaintiff, the announcement of the breach jeopardized the pending merger with Verizon, resulting in Verizon paying $350 million less for the company; in January 2018, ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access