US appeals court rules for ex-Marsh McLennan worker in cyber case

Marsh & McLennan must face a class-action lawsuit in which a former employee sought damages after her private information was accessed in a 2021 cyber breach, a US federal appeals court ruled last week, overturning a lower court. In Nancy Bohnak v. Marsh & McLennan Cos Inc, the 2nd US Circuit Court of Appeals in New York cited earlier rulings, including a US Supreme Court decision, in determining that the risk of future injury from the release of data was sufficient to constitute an injury for a damages claim. The cyber breach involved social security numbers (SSN) and other personal data related to Marsh McLennan staff, former staff, clients and others. The company discovered the breach on 26 April 2021, and sent out breach notifications to the people affected about two months later. After the notifications were sent, Bohnak, who previously worked at Marsh McLennan Agency, filed a class-action lawsuit on behalf of herself and others alleging that the broker failed to adequately protect personally identifiable information (PII), among other things. She alleged the injuries suffered included expenses associated with preventing, detecting and recovering from identity theft, lost opportunity costs associated with attempting to mitigate the consequences of the breach and the continued risk to her PII, which remains unencrypted. A district court previously ruled in favour of Marsh McLennan, which sought to dismiss the case because the damages sought were not “cognisable”, or recognisable and quantifiable. The district court concluded that Bohnak could only speculate about any future harm because the alleged loss of time and money responding to the increased risk of harm was not proximately caused by the harm of disclosure. In overturning the lower court, the three appeals court judges cited the US Supreme Court’s 2021 ruling in TransUnion LLC v. Ramirez, which found, among other things, that the plaintiffs in the case had to suffer a “concrete injury”, which can include intangible harm, to recover damages. “The core of the injury Bohnak alleges here is that she has been harmed by the exposure of her private information – including her SSN and other PII – to an unauthorised malevolent actor. This falls squarely within the scope of an intangible harm the Supreme Court has recognized as ‘concrete’,” the court ruled. In addition, in accordance with the 2nd Circuit’s own 2021 ruling in McMorris v. Carlos Lopez & Associates LLC, the former employee alleged “imminent risk of injury”. “The allegations of a targeted hack that exposed Bohnak’s name and SSN to an unauthorised actor are sufficient to suggest a substantial likelihood of future harm, satisfying the ‘actual or imminent harm’ component of an injury in fact,” the court ruled in remanding the case for further proceedings. A Marsh McLennan spokesman said the company does not comment on pending litigation. This article first appeared on our sister website Business Insurance. For further news from Business Insurance, please click here.

US appeals court rules for ex-Marsh McLennan worker in cyber case

Want to read this article?

Read Next

IASB meets in China to discuss climate reporting

‘Pressure rising’ on developing Asian aging risk: ADB

European business confidence in China plummets

Starr Insurance opens new operation in Korea

Strebel to replace Gonzalez as head of Swiss Re China

IASB meets in China to discuss climate reporting

‘Pressure rising’ on developing Asian aging risk: ADB

European business confidence in China plummets

Starr Insurance opens new operation in Korea

Strebel to replace Gonzalez as head of Swiss Re China

Want to read this article?

Read Next

IASB meets in China to discuss climate reporting

‘Pressure rising’ on developing Asian aging risk: ADB

European business confidence in China plummets

Starr Insurance opens new operation in Korea

Strebel to replace Gonzalez as head of Swiss Re China

Related Articles