Hunton is at the forefront of cybersecurity and data breach litigation, representing clients in the assessment, investigation, and litigation of matters arising from cybersecurity and data breach incidents. The firm has assisted clients with more than 5,000 data breaches and cybersecurity events worldwide and has defended our clients in some of the largest, most high-profile litigations. We assist our clients with every aspect of an information security event, including (i) directing incident investigations; (ii) retaining and overseeing cybersecurity consultants; (iii) mitigating financial loss and loss of confidential information; (iv) coordinating notification to affected individuals; (v) setting up call centers and training call center personnel; (vi) preparing for litigation, including advising on retention obligations; (vii) engaging with law enforcement officials and other government (federal, state and overseas) regulators; and (viii) defending resulting enforcement actions and litigation.

We regularly serve as liaisons to the FBI, US Secret Service, US Department of Justice, Federal Trade Commission and state attorneys general on behalf of our clients in these matters. We also routinely engage on our clients’ behalf with foreign data protection authorities in their investigations and enforcement actions. Our lawyers have represented clients throughout the US in federal and state courts, and globally before regulatory agencies and in alternative dispute resolution proceedings. These matters arise out of data security events asserted by regulators, consumers, our clients’ business partners and other parties.

Our experience assisting clients with highly complex, large-scale cybersecurity events is internationally acclaimed. For example, our data breach litigation team is ranked Nationwide Privacy & Data Security: Litigation by Chambers USA and has earned the recognition of “Top Defense Verdict” in California by the Daily Journal for a precedent-setting win with regard to the California Consumer Privacy Act. And our team members have been repeatedly recognized by Law360, the National Law Journal and the Daily Journal in the area of cybersecurity and privacy litigation.

Our lawyers work as part of a multidisciplinary team that is frequently involved immediately after a cybersecurity incident to help clients evaluate and manage all aspects of the event, often with our lawyers leading the investigation, coordinating the global legal analysis and notification to affected individuals and regulators, and generally coordinating the panoply of incident response activities. Information security matters implicate multiple risks and response issues. Because of that complexity, we represent our clients with an interdisciplinary and coordinated team that includes our internationally recognized Privacy and Cybersecurity practice, ranked in all Computerworld magazine surveys as the top law firm practice globally for privacy.

Representative experience includes the following:

• Represented Yahoo! (now Verizon) in all aspects of its nation-state and criminal cybersecurity attacks that compromised approximately 3 billion user accounts worldwide, reported at the time to be the largest data breach in history. Serving as lead counsel, we defended the company in over 40 consumer class actions across several districts. The firm directed the forensic investigation and provided regulatory and litigation counsel and prepared litigation coordination strategies for Yahoo!
• Secured motion to dismiss for a multinational electronics corporation faced with 17 lawsuits around the country that included more than 60 causes of action relating to a data security incident in connection to an unauthorized third party obtaining certain customers' Personally Identifiable Information (PII) from some of its US systems. The Judicial Panel on Multidistrict Litigation consolidated and transferred the cases to the District of New Jersey. The court also disposed of several individual "harms" plaintiffs alleged, such as increased spam and phishing attempts and emotional distress, and rejected plaintiffs' conclusory allegations of lost value of their PII.
• Won a pivotal victory for a giant big box retailer when the court dismissed a data breach class action lawsuit in its entirety and with prejudice, earning recognition by the Daily Journal as a "Top Defense Verdict" in California. This significant victory represents one of the earliest decisions rendered on the merits with respect to the plaintiff-friendly California Consumer Privacy Act (CCPA) and established an important precedent for future CCPA litigation.
• Secured motion to dismiss for a major retailer in a high-stakes class action involving multiple prominent retailers. Alleging violations of the CCPA, plaintiffs claimed retailers shared consumer data without consent with a loss prevention vendor, which developed a "risk score" to combat fraudulent and abusive store returns.
• Obtained victories on behalf of the largest pipeline system for refined oil products in the US in three high-profile, class action data breach cases in the Northern District of Georgia. We secured the dismissal of all cases in their entirety.
• Representing an American multinational technology conglomerate, spearheading at least 20 statutory actions in a string of litigation filed against worldwide app developers, web developers, online advertising companies, deceptive cloaking services, and a data analytics firm - that are multi-jurisdictional in scope, and in several cases unprecedented-for deceptive practices that target our client and its users.
• Prevailed on motion to compel arbitration for a luxury retailer in a class action alleging violation of the CCPA and failure to properly secure and safeguard personally identifiable information from hackers, arising from a widely reported data security incident affecting approximately 4.6 million online customers.