Data Breach Litigation
Individuals and businesses harmed by data breaches may pursue claims for negligence, statutory violations, and unfair or deceptive practices under Massachusetts and federal law.
Healthcare data breaches averaged $10.93 million per incident in 2023.
1
IBM Security, Cost of a Data Breach Report (2023).
Massachusetts Data Breach Law
Massachusetts imposes strict obligations on companies that handle personal information. M.G.L. c. 93H requires entities that experience a breach of personal information to notify affected residents and the Attorney General. M.G.L. c. 93I requires proper destruction of personal information. Violations of these statutes may support claims under Chapter 93A, which provides for treble damages and mandatory attorney fee-shifting. The combination of breach notification failures and inadequate data security creates a strong foundation for civil recovery.
Overview
U.S. Catholic dioceses and religious orders alone have paid more than $5 billion to resolve sexual abuse claims over the past two decades.
Massachusetts requires companies to notify the Attorney General and affected residents after a data breach.
2
M.G.L. c. 93H, Section 3.
Types of Data Breach Claims
Claims arise from a range of breach events: corporate data breaches exposing customer or patient records, ransomware attacks disrupting operations and compromising data, employee data breaches where employers fail to safeguard personnel records, healthcare data breaches involving protected health information under HIPAA and state law, and financial data theft targeting banking credentials, credit card numbers, or Social Security numbers. Each category involves distinct notification obligations, regulatory frameworks, and damages theories.
Causes of Action
Plaintiffs in Massachusetts data breach cases may assert claims for negligence, where the company failed to implement reasonable security measures, breach of contract, where terms of service or privacy policies created enforceable obligations, violations of M.G.L. c. 93A, where the breach resulted from unfair or deceptive practices, and violations of federal statutes including HIPAA, CCPA, or GDPR where applicable. Available remedies include actual damages, statutory damages, treble damages under 93A, injunctive relief, and attorney fees.
Prompt action after a data breach is critical to preserving claims and evidence.
Statute of Limitations
Massachusetts applies a three-year statute of limitations to most data breach claims, running from the date the plaintiff knew or should have known of the breach. The discovery rule may extend the filing window when a breach is concealed or its scope is not immediately apparent. Institutional defendants often contest timeliness, making prompt consultation critical.
What to Bring to a Consultation
Relevant materials may include breach notification letters, account statements showing unauthorized activity, correspondence with the breached company, records of credit monitoring or identity theft remediation, insurance claim denials, and documentation of out-of-pocket expenses or lost time. Not all individuals will have documentation. The absence of records does not preclude a viable claim. Many cases rely on breach disclosures filed with the Massachusetts Attorney General and records obtained through discovery. Data breach claims in Massachusetts frequently involve parallel Chapter 93A consumer protection claims, class action litigation, and, where employee data is compromised, employment law protections.
