## Facts

- Equifax, Inc. collected and stored consumers’ personally identifiable information (PII) and reported consumer information to financial institutions for creditworthiness determinations.
- Plaintiffs alleged Equifax had received repeated warnings that its cybersecurity practices were inadequate to protect the PII in its custody.
- In March 2017, a third-party software component used by Equifax announced a major security vulnerability and issued a patch, but Equifax allegedly did not timely install it.
- Hackers exploited the vulnerability and accessed Equifax’s systems from May 13, 2017, to July 20, 2017.
- The attackers obtained the PII of nearly 150 million people, including names, Social Security numbers, birth dates, addresses, driver’s license numbers, and some payment information.
- Equifax publicly announced the breach in September 2017.
- Numerous consumer class actions were filed and consolidated in an MDL in the Northern District of Georgia; consumer plaintiffs filed a consolidated complaint asserting negligence, negligence per se (including a theory based on the Gramm-Leach-Bliley Act (GLBA) and implementing regulations), unjust enrichment, breach of contract and related theories, Fair Credit Reporting Act (FCRA) claims, declaratory relief, and various state consumer-protection and data-breach notice claims.
- Equifax moved to dismiss, arguing (among other points) that it owed no duty under Georgia law to safeguard personal information, that plaintiffs had not alleged legally cognizable injury and causation, and that GLBA could not support negligence per se because it lacks a private right of action.

## Issues

1. Whether consumer plaintiffs plausibly alleged injury and traceability sufficient to proceed past a Rule 12(b)(6) motion in a data-breach case.
2. Whether, under Georgia law, Equifax owed consumers a common-law duty to use reasonable care in safeguarding the PII it collected and stored.
3. Whether plaintiffs could plead negligence per se by using GLBA and its implementing regulations as a standard of conduct, despite GLBA lacking a private right of action.
4. Whether the criminal acts of third-party hackers defeated causation as a matter of law at the pleading stage.
5. Whether the consolidated complaint adequately stated other pleaded claims (including FCRA, contract-related, unjust enrichment, and state statutory consumer and notice claims).

## Decision

- The court granted in part and denied in part Equifax’s motion to dismiss.
- The court held the consumer plaintiffs plausibly alleged injuries tied to the breach (including expenditures and burdens associated with identity-theft prevention and response, and other alleged harms) sufficient to proceed at the pleading stage.
- The court denied dismissal of the negligence claim, concluding that Georgia negligence law can recognize a duty to use reasonable care to protect highly sensitive personal information collected and stored by a credit reporting company.
- The court allowed plaintiffs’ negligence-per-se theory to proceed to the extent plaintiffs relied on federal statutes and regulations (including GLBA and related regulations) as standards of care within a state-law negligence framework, rather than as independent federal causes of action.
- The court declined to treat the hackers’ conduct as automatically severing causation at the motion-to-dismiss stage where plaintiffs alleged Equifax’s failure to address known security risks made the attack and resulting harms foreseeable.
- The court evaluated a large set of statutory and common-law claims, allowing a number to proceed while dismissing or narrowing others based on the elements of particular statutes, lack of a private enforcement mechanism for certain theories, and pleading deficiencies under specific states’ laws.

## Legal Principles

- At the pleading stage in data-breach litigation, allegations of concrete losses and burdens undertaken to prevent or respond to likely misuse of compromised PII can be sufficient to state an actionable injury and traceability.
- Under Georgia negligence principles, an entity that collects and stores sensitive PII may owe a duty of reasonable care to protect that information where the risk of harm from unauthorized access is foreseeable and the defendant is alleged to have superior control over the relevant security measures.
- A statute or regulation that does not create a private right of action may still supply a standard of conduct for a state-law negligence-per-se theory when state law permits the statute’s use in that manner and the plaintiffs are among the persons the enactment aims to protect.
- Intervening criminal acts do not necessarily defeat proximate causation as a matter of law when the alleged negligence consists of failing to take reasonable steps to guard against a foreseeable cyberattack; causation disputes are often not resolved on a Rule 12(b)(6) record.
- In an MDL data-breach complaint asserting multi-state claims, claim viability commonly turns on statute-specific requirements (such as reliance, causation, and available remedies) and state-by-state variations in common-law doctrines governing contract and unjust enrichment.

## Conclusion

In the consumer-track Equifax MDL decision at 371 F. Supp. 3d 1150, the Northern District of Georgia largely denied Equifax’s motion to dismiss, holding that consumers plausibly alleged injuries, a Georgia-law duty to safeguard sensitive PII, and causation, and that negligence-per-se theories could rely on GLBA-related standards of conduct even without a private federal cause of action, while the court dismissed or narrowed certain other claims depending on the governing law and the sufficiency of the pleadings.


In re Equifax, Inc., Customer Data Security Breach Litigation, 371 F. Supp. 3d 1150 (2019)