Experience

From very early on as cybersecurity incidents began to make an impact on global commerce, Ropes & Gray’s attorneys have been developing their extensive experience in privacy and cybersecurity regulatory enforcement and civil litigation, including in some of the highest profile cybersecurity incidents with hundreds of millions of dollars as stake. These representations have been on behalf of clients throughout the United States; we have defended clients in the courts of Arizona, California, Delaware, Florida, Georgia, Illinois, Indiana, Massachusetts, Minnesota, Missouri, New Hampshire, New Jersey, New York, Ohio, Tennessee, and Texas, and before the First, Third, Fifth, Sixth, Eighth, and Eleventh Circuits; before the FTC, Office of Civil Rights, and virtually every Attorney General’s office and many state officials; and in regard to non-U.S. regulatory investigations in Australia, Brazil, Canada, Hong Kong, Ireland, Japan, and the United Kingdom. Our most substantial representations of this sort include:

LabMD in its petition to the U.S. Court of Appeals for review of the first FTC decision holding a company liable for allegedly having unreasonable data security practices that violate Section 5 of the FTC Act.
A multinational advertising and public relations company in class action litigation and regulatory investigations related to an alleged “workaround” by which third-party cookies could be set on browsers that had been configured to deny such cookies.
Supervalu Inc. in defending and responding to all litigation claims and regulatory inquiries stemming from cybersecurity incidents announced in 2014.
Multiple clients in diverse industries in defending against payment card brand claims seeking to impose fines and issuing bank reimbursement assessments arising from cybersecurity incidents involving payment card data. Such clients include TJX, Hannaford Brothers, Heartland, Wyndham Hotels, Target, Neiman Marcus, Aldo, Hilton, Landry’s, Destination Hotels, Sally Beauty, Supervalu, Home Depot, and Arby’s.
Arby’s Restaurant Group as lead counsel in defending against all third-party claims, including the pending issuer and consumer class actions, arising from a cyber incident announced in February 2017.

Hilton Worldwide in litigation against Hilton’s former payment card processor in connection with a commercial dispute relating to a cybersecurity incident
A large regional healthcare network in defending against class action litigation and regulatory inquiries arising out of alleged theft of physical records containing personal and health information
A Fortune 100 Insurance Company with respect to class action litigations and regulatory inquiries arising from a cybersecurity incident on a portion of its computer network
Massachusetts Eye and Ear Infirmary in connection with an enforcement action by the OCR relating to the loss of a laptop containing unencrypted protected health information
Massachusetts General Hospital in connection with an enforcement action by the OCR relating to the loss of certain documents containing protected health information by an employee
Sony in its widely reported computer network attacks in April 2011, including multidistrict class action litigation and regulatory inquiries across jurisdictions
Multiple clients in defense of regulatory inquiries into application and product security regarding privacy and cybersecurity practices around collection and use of customer information, even in the absence of a cybersecurity incident
A publicly traded healthcare technology company in class action litigation involving alleged violation of the Telephone Consumer Protection Act (TCPA)
Multiple clients in class action litigation under the Fair and Accurate Credit Transactions Act (FACTA) relating to information printed on payment card receipts
Target as lead outside counsel in defending card issuer litigation stemming from the cybersecurity incident that Target announced in December 2013
Wyndham Hotels and Resorts in connection with the FTC investigation and ensuing litigation stemming from a series of cybersecurity incidents during 2008-2010 of the computer networks of a substantial number of independently owned Wyndham-branded hotels
Heartland Payment Systems in various class action claims and regulatory investigations, stemming from one of the largest computer cybersecurity incidents ever
The TJX Companies, Inc. in regard to consumer class actions, issuer class actions, shareholder claims, and state, federal, and foreign regulatory investigations arising from cybersecurity incidents in 2005 and 2006 that affected store chains in the United States, Puerto Rico, Canada, and the United Kingdom
Hilton Worldwide in litigation against Hilton's former payment card processor and acquiring bank in connection with a commercial dispute relating to previously-announced cybersecurity incidents
A large regional hospital organization in defense against class action litigation and regulatory inquiries arising out of alleged theft of physical records containing personal and health information.
Supervalu Inc. as lead outside counsel in defending and responding to all litigation claims and regulatory inquiries stemming from the cybersecurity incidents that Supervalu announced in August 2014 and September 2014
Wyndham Hotels and Resorts in regulatory investigations stemming from cybersecurity incidents involving a number of the independently owned Wyndham-branded hotels, including the first ever litigation brought by the FTC over cybersecurity issues.
TJX in class-action litigation and regulatory investigations stemming from what was then the largest cybersecurity incident ever
Genesco in the first lawsuit against Visa to challenge the lawfulness of cybersecurity incident penalties imposed by Visa
Aldo in the first lawsuit against MasterCard to challenge the lawfulness of cybersecurity incident penalties imposed by MasterCard