Feeds

Lawsuit targeting RockYou data breach gets green light

Personally identifiable info has inherent value

The Power of One eBook: Top reasons to choose HP BladeSystem

A federal judge has declined to dismiss a lawsuit filed against social-media application developer RockYou for exposing the personally identifiable information of 32 million of its users, which the site stored unencrypted when it suffered a major security breach 16 months ago.

Judge Phyllis Hamilton of the US District Court in the Northern District of California dismissed five causes of action brought by user Alan Claridge, but allowed four others to survive. RockYou argued that the suit should be thrown out in its entirety because Claridge didn't suffer any injuries as a result of the data loss, which exposed the email address and password he supplied when establishing an account with the apps maker.

"The court concludes that at the present pleading state, plaintiff has sufficiently alleged a general basis for harm by alleging that the breach of his [personally Identifiable Information] has caused him to lose some ascertainable but unidentified 'value' and/or property right inherent in the PII," Hamilton wrote. "As such, the court declines to dismiss plaintiff's breach claims on grounds that plaintiff has failed to allege damages harm as a matter of law."

The case was filed after hackers mounted SQL injection attacks in December 2009 that exploited a gaping hole in RockYou's website. The breach exposed passwords and email addresses, which RockYou stored in plaintext, for more than 32 million users. Claridge sued RockYou asserting a variety of claims, including negligence, breach of contract, and violations of the federal Stored Communications Act and California's Unfair Competition Law.

The finding that the loss of PII is sufficient grounds for a lawsuit is in stark contrast to rulings in other cases that have held that the exposure of social security numbers and other sensitive data gives rise to valid legal claims only when it results in actual damage to its owner, such as identity theft.

The 16-page ruling is available here. ®

Designing a Defense for Mobile Applications

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.