Two well-known Atlanta companies are facing lawsuits in federal district court over data breaches that allegedly exposed sensitive personal information.
Coca-Cola and its dairy brand, Fairlife, were named as defendants in a proposed class action filed Wednesday in the U.S. District Court in Atlanta.
The suit, filed by a former Fairlife employee based in Michigan, comes shortly after the beverage giant disclosed a ransomware attack that temporarily shut down the dairy brand’s U.S. production. A hacker group claimed credit for the attack and posted online a sample of employee records and other documents it alleged belonged to Fairlife.
The plaintiff alleges Coca-Cola and Fairlife failed to “properly secure and safeguard” sensitive data, such as names and Social Security numbers, from hackers, opening up a “significant risk” of identity theft and other crimes. The former employee seeks to represent a class that includes anyone whose data was exposed in the breach.
Coca-Cola declined to comment on the lawsuit.
Popular chicken chain Chick-fil-A is named as a defendant in a separate proposed federal class action filed July 23.
The suit, filed by a Chick-fil-A customer based in Texas, stems from a data security incident Chick-fil-A recently disclosed that the company said affected “a limited number” of its loyalty accounts. In the attack, hackers obtained login credentials from a third-party source, the company has said.
The plaintiff alleges Chick-fil-A failed “to implement adequate and reasonable measures” to safeguard private information, such as names, home addresses and phone numbers, claiming that opens up the risk for crimes such as fraud or identity theft.
Chick-fil-A declined to comment on the lawsuit.
Attorneys for both plaintiffs could not be reached for comment. Neither Coca-Cola nor Chick-fil-A has filed official responses yet. Atlanta Business Chronicle first reported on both cases.
Credit: Tyler Sun
Credit: Tyler Sun
It’s possible other lawsuits could be filed.
Jack F. Williams, a law professor at Georgia State University, said it’s fairly common to see proposed class actions bubble up after a data breach.
Companies across the globe face similar risks as cyberspace becomes more complex. The rapid adoption of artificial intelligence, escalating geopolitical tensions and increasingly integrated supply chains are among the factors heightening cybersecurity risks, according to the World Economic Forum.
Data breaches can be quite costly. A recent report from IBM said the average cost of a data breach in the U.S. has hit a record $11.5 million. That’s more than twice the global average and up 13% from the prior year, the report said.
“The companies will be taking it seriously,” Williams said of the recent lawsuits. “They may conclude at the end of the day there’s no merit here, but they will take this seriously because they take data protection seriously … and they understand the reputational risk associated with these type of issues.”
The Coca-Cola and Chick-fil-A lawsuits both involve individual plaintiffs seeking to represent a large group of people with similar claims.
But to become certified as a class in federal court, a plaintiff must satisfy several prerequisites, meaning the cases have a long journey ahead, legal experts told The Atlanta Journal-Constitution.
“It’s very early, and these cases typically take many years, even to determine whether they get certified as a class,” said Atlanta attorney John Hadden, who is not involved in either case.
Williams with Georgia State said a major legal hurdle will center on whether affected individuals can prove concrete injury to satisfy federal standing requirements. At this stage, a plaintiff may only be able to show the data breach involved their personal information but not that it has been used to their detriment or harm, he said.
“The courts are all over the map on at what point does a data breach constitute sufficient injury for the plaintiff to show standing,” he said. “That is, show there’s harm or potential harm, and they can go forward with the litigation.”
Hadden said he anticipates there may also be an attempt to compel arbitration in these cases.
For example, the terms and conditions for Chick-fil-A One, the company’s loyalty program, includes an arbitration agreement. The court would decide whether the agreement is valid concerning such a data breach.
It’s possible Coca-Cola could have a similar clause in its employment contracts, he said.
“That’s a determination the court would have to make at the early stage,” Hadden said. “There typically would be an argument over whether that clause is enforceable, and that’s going to be a very fact-specific question as to whether the customers or the participants in the program freely agreed to it and whether it covered this type of claim, among other considerations.”
About the Author
Keep Reading
The Latest
Featured
