Sixth Circuit's Decision on Privacy Claims over Data Breaches

But small to midsize businesses often fail to appreciate the risk of a data breach to their own business. They may believe that they are not targets because of their size or because they do not hold valuable information. Their “not in my business” assumption is wrong. Indeed, because security measures adopted by small and medium size businesses may not be as up-to-date as those used by national and multinational corporations, and because of the value of data held by every business, regardless of its size, these smaller entities may be just as likely to have their systems targeted as the big corporations. Businesses — regardless of their size — could incur high costs in responding to a breach with a forensic investigation, remediation, notification, and reputation damage control, as well as potential fines under breach notification statutes.