In August 2015, a group known as the “Impact Team” leaked the customer records of some 32 million users of AshleyMadison.com, the “most famous website for discrete encounters between married individuals.”1 The fallout from the data breach has been catastrophic not only for the customers of AshleyMadison.com but also for Avid Life Media Inc., the owner of AshleyMadison.com. Avid Life Media already shelved a planned IPO on the London Stock Exchange potentially worth $200 million,2 and the data breach has eviscerated its customers’ trust in one of its core business drivers—privacy. Avid Life Media can now look forward to years of defending class action lawsuits, potential regulatory investigations, and fines.3
Though the AshleyMadison.com data breach is perhaps the most notable of recent data breaches, the data breach itself, and its associated consequences for Avid Life Media, is neither unique nor unusual in today’s business environment. According to one report, there have been over 500 data breaches in 2015 involving over 140 million client records.4 As a result of the increasing frequency and scope of data breaches, courts and administrative agencies have started to evaluate and, in some cases, set forth, progressively expansive theories of liability for those companies that suffer data breaches.
