opinion

Preventing Data Breaches Staves Off Big Legal Claims

Preventing Data Breaches Staves Off Big Legal Claims

Did you hear about the Kimpton Hotel hacking last year? If you are like most of us, probably not. Kimpton was one of thousands of data breach victims in 2016 and their story was lost in the flood of attacks.

In New York state alone, another record breaking year of data breaches saw a total of 1282 breaches reported to the state attorney general comprising 1,596,207 records exposed in 2016.

The costs of keeping data secure pales in comparison to the costs of cleaning up after a hit.

Data security breaches are becoming so commonplace they don’t make news unless millions of records are exposed all at once.

Just last month, a federal judge approved an $11.2 settlement in a class-action lawsuit against Ashley Madison related to a data breach that exposed information stolen from the adult dating website for those seeking extra-marital affairs.

The small breaches just aren’t newsworthy, but Kimpton’s experience should be an important lesson to any business that uses computers.

In a fairly routine data breach, hackers were able to insert malware into Kimpton computer systems that found credit card numbers, expiration dates, verification codes and cardholder names.

Anyone that used a credit card at the front desk of a Kimpton Hotel between Feb. 16, 2016 and July 7 of that year was at risk of compromised credit card information, and the first report of unauthorized charges on a customer’s credit card was made July 15.

Kimpton publicly acknowledged the breach Aug. 31 with few details and without an explanation for why it took so long to disclose the intrusion.

It is likely the delay in notification and other alleged mishandling of the incident only increased customers’ anger, leading Lee Walters, a Kimpton Hotel customer who checked in once during the vulnerable time period, to file a class-action suit against the boutique hotel chain.

It is significant that Mr. Walters does not make a claim that his credit card was used to make unauthorized charges as a result of the breach. Walters claims that his card information is likely among the information copied and now in the hands of ill-intentioned criminals, and that he has had to expend time and effort to monitor his credit card activity for unauthorized use or identity theft. Surviving a motion to dismiss earlier this year, this case moves on to the next stage.

“The theft of Walters’s payment card data and the time and effort he has expended to monitor his credit are sufficient to demonstrate injury for standing purposes,” according to a ruling in Walters v. Kimpton Hotel & Restaurant Group.

This case is important to every business that accepts credit cards for two reasons. First, it shows that a customer who may have had his data copied but hasn’t had any fraudulent charges has the right to sue for damages. Second, it is important because it is another example of a data breach that could have been avoided.

Normally a person needs to incur some sort of damage before he can bring a lawsuit, commonly referred to as “standing.” If you don’t have any damages, you don’t have standing to bring a lawsuit.

Here, the credit card Lee Walters used to check in to the Kimpton Hotel had not been used for any fraudulent charges, but having to monitor his credit report is enough to give “standing” to file a lawsuit for damages.

This is important because every customer can make this claim after a data breach, so the business that gets hacked can be sued by any customer whose data was stolen.

This dramatically increases the potential cost of a data breach and increases the value of maintaining data securely. Remember the old saying, “An ounce of prevention is worth a pound of cure”?

According to the Poneman Institute Cost of a Data Breach Study, sponsored by IBM, in 2016 the average total cost of a data breach exceeded $4 million. This is an average, so half of breaches cost more and half cost less, but data breaches can be extraordinarily costly events, threatening the ability of some business to continue as a going concern.

The costs of keeping data secure pales in comparison to the costs of cleaning up after a hit. A good business will take the necessary steps, and apportion the necessary budget, to keep all assets safe, including electronic data assets.

The second reason why this case is important is that the breach could have been avoided if Kimpton had taken some reasonable steps to protect customer data against known threats.

The malware allegedly used in the breach was a variant of “BlackPOS,” a malware strain that had been used to breach security at several of Kimpton’s competitors, including Hilton, Starwood, Mandarin Oriental, White Lodging, and the Trump Collection.

If Kimpton had simply acted quickly to protect itself from the very same attacks that had been carried out against other hotels, it could have avoided the data breach altogether.

A simple hack that could have been avoided by upgrading systems to fend off known threats became a federal class-action suit, with damage to reputation tagging along for the ride.

Conclusion

Maintaining security is a cost of doing business in any field. We know the importance of things like locks, cameras, and security guards to protect the physical assets of a business but when it comes to protecting electronic data, many businesses still do not realize the risks of underestimating the need for ongoing cybersecurity efforts and take chances.

Kimpton was not the first, and certainly not the last, company to roll the dice and lose big. What does your company do to protect valuable data, and is that enough?

Chad Anderson is an Arizona attorney working in the area of cybersecurity and data privacy. He can be reached at chad@chadknowslaw.com.

Related:  

Copyright © 2025 Adnet Media. All Rights Reserved. XBIZ is a trademark of Adnet Media.
Reproduction in whole or in part in any form or medium without express written permission is prohibited.

More Articles

opinion

The SCREEN Test: How to Prepare for Federal Age Verification

For those who are counting, there are now 20 enacted state laws in the United States requiring age verification for viewing online adult content, plus numerous proposed laws in the works. This ongoing barrage has been exhausting for many in the adult industry — and it may be about to escalate in the form of a potential new AV law, this time at the federal level.

Corey D. Silverstein ·
opinion

How to Master Team Dynamics for Business Success

Having the right team in place is everything. Whether getting a startup off the ground and thriving, or safeguarding an established company, the right — or wrong — people can mean the difference between a successful venture and a failed dream.

Juicy Jay ·
opinion

Eight Steps to Fast-Track AI Site Approval for Processing

Artificial intelligence is a hot topic these days. AI technology is speeding up the way we do business across all industries and offers numerous benefits, from automating processes to increasing efficiency and scalability.

Cathy Beardsley ·
opinion

How to Secure High-Risk Transactions With Network Tokenization

Ensuring the security of data as it moves through digital channels is the foundation of safe transactions, and crucial for your success. If your business can’t secure transactions, you’re exposed to myriad processing traumas.

Jonathan Corona ·
profile

WIA Profile: Reba Rocket

As chief operating officer and chief marketing officer of Takedown Piracy, long at the forefront of intellectual property protection in adult entertainment, Rocket is dedicated to safeguarding the livelihoods of content creators and producers while fostering a more ethical and sustainable industry.

Women In Adult ·
opinion

Protecting Content Ownership Rights When Using AI

In today’s digital age, content producers have more tools at their disposal than ever before. Among these tools, artificial intelligence (AI) content generation has emerged as a game changer, enabling creators to produce high-quality content quickly and efficiently.

Corey D. Silverstein ·
opinion

How Payment Orchestration Can Help Your Business

An emerging payment solution is making waves in the merchant world: the payment orchestration platform (POP). It’s quickly gaining traction as a powerful tool for managing online payments — but questions abound.

Cathy Beardsley ·
opinion

Fine-Tuning Refund and Cancellation Policies

For adult websites, managing refunds and cancellations isn’t just about customer service. It’s a crucial factor in maintaining compliance with the regulations of payment processors and payment networks such as Visa and Mastercard.

Jonathan Corona ·
profile

WIA Profile: Laurel Bencomo

Born in Cambridge, England but raised in Spain, Laurel Bencomo initially chose to study business at the University of Barcelona simply because it felt familiar — both of her parents are entrepreneurs. She went on to earn a master’s degree in sales and marketing management at the EADA Business School, while working in events for a group of restaurants in Barcelona.

Women In Adult ·
profile

Gregory Dorcel on Building Upon His Brand's Signature Legacy

“Whether reflected in the storyline or the cast or even the locations, the entertainment we deliver is based on fantasy,” he elaborates. “Our business is not, and never has been, reality. People who are buying our content aren’t expecting reality, or direct contact with stars like you can have with OnlyFans,” he says.

Jeff Dana ·
Show More