Last year, Pittsburgh-based plaintiffs attorney Gary Lynch successfully argued to the Pennsylvania Supreme Court in Dittman v. UPMC that companies have a common-law duty to protect their electronically stored employee data.

The high court’s decision reversed two controversial lower court rulings that had tossed out a putative class action against the University of Pittsburgh Medical Center over a data breach that exposed the personal information of tens of thousands of current and former employees.