Got $26.5 billion lying around?
We're guessing the answer is no, even if you work for the U.S. Government. But that's the potential price tag for class-action lawsuits now brewing in the wake of the theft of a VA administration laptop loaded with Social Security numbers and other sensitive data.
Of course, that $26.5 billion is an unrealistic number for most businesses, which aren't likely to even have 26.5 million customer records to worry about. But the $1,000 per affected person award is not out of line for class actions, which can be brought by eager attorneys representing only a handful of possibly injured parties. In the VA case, one class action attorney has actually tried to block the government's plan to monitor credit and protect identities of the vets at risk following the much-publicized theft of the VA laptop. Legal-eze arguments aside, some observers point to the lawyer's action as an effort to cultivate at least a few actual damages, just to shore up that class-action complaint.
Although the recovery of the laptop yesterday -- apparently sans any major data compromise -- means the VA may have lucked out and avoided the worst-case scenario, the government is still on the hook (at least for now) for credit monitoring to the tune of $50 to $150 a year per account. The VA has also spent $14 million to notifiy vets of the possible theft of their data.
And don't forget legal fees for fighting off those class-action suits; there's certainly no guarantee that finding the laptop will abate claims for damages, particularly in the grab-bag world of class action.
Gartner recently reported that clean-up after a data breach can run as much as $90 an account. And that doesn't factor in the extremes of civil liability, which is as real for your company as it is for the VA.