8 ms·
Zappos 2012 data breach settlement
- bradhe 7y agoPretty standard.
- CryoLogic 7y agoWould this have played out differently in a country known for its government-backed consumer protection laws, maybe Norway or Sweden? In other words - is this an "American corporate greed" sort of tragedy, or is this standard result of such a lawsuit in all major countries? By tragedy, I mean over 90% of the proceeds of the lawsuit going to lawyers rather than individuals affected in the data breach.
- deleted 7y ago[deleted]
- Aeolun 7y agoIn a different country it probably wouldn’t have taken years for a violation to be found and a penalty imposed. And therefore any lawyers would be paid much less.
- nerfhammer 7y agoyes the legal theory is that 1) punishing the bad actor is more important than restitution. it's more important that Zappos is punished to discourage bad behavior from Zappos or anyone else, less important how exactly the punishment money is split up 2) since lawyers can get paid out of the settlement, it incentivizes independent lawyers to go after bad companies wherever they may be rather than needing regulators. so you don't need to maintain and hire a bunch of regulators and their legal teams, which will often be too many or too few. other countries may prefer things the other way around and often do. it's easy to think of pros and cons either way.
- paulddraper 7y agoI don't know, but it will depend on the ability for the case to be resolved quickly. When a suit starts in 2012 and ends in 2019, the human capital invested is simply enormous.
- PeterisP 7y agoIn countries like that I would expect the result to: 1) not involve a civil suit whatsoever - instead of filing a class action claim resulting in a settlement or penalty assigned by a court, the people would complain to the relevant regulator, who'd investigate, impose fines and mandate changes in company processes. 2) in a scenario like this - where none of the complaintants assert any specific direct loss but simply generic increased future risk - there would be no payments to the affected individuals at all, any fines would go to the government; the main goal will be to enforce future compliance with the rules, and punish past incompliance with fines to deter other violators. Individuals can demand and get compensation that will cover specific actual damages that can be demonstrated, but no more, and nothing unless/until any consequences materialize. The "You wronged me, I'll sue you for $$$$ despite not being actually $$$$ out of pocket right now" style of civil claims (that seems to be common in USA, at least in mass media) is rare, and when it happens, it's usually unsuccessful.
- jdoliner 7y agoI just got an email about this settlement telling me that I've been awarded a 10% off coupon for Zappos due to this ruling. So I actually have to give them more business to recoup anything... it's almost as if this settlement is going to be good for business.
- ocdtrekkie 7y ago...Wow. That's incredible. 10% isn't even like... a good discount or anything. What kind of hack judge will sign off on this?
- pg_is_a_butt 7y agoProbably the kind that spent their time on the other side of the bench executing similar settlements. Lawyers and Bankers have destroyed America.
- woadwarrior01 7y agoThis is from the page: “Both sides agreed to a settlement to avoid the uncertainty and cost of litigation, and to provide benefits to Class Members more promptly. The Court did not decide in favor of the Class Representatives or Zappos. Zappos denies any liability or wrongdoing of any kind associated with the claims in this class action.” It was a mutually agreed upon arbitration, no judges were involved in the decision.
- otterley 7y agoThere's no "decision," just an agreement. However, judges often must approve settlement agreements to ensure that it doesn't benefit only the attorneys. (Yes, this one looks bad, but looking at the numbers involved here, the attorney's fees look pretty reasonable in terms of the amount of time spent on the case.)
- jammygit 7y agoThe attorney fees shouldn’t depend on the time they spent on the case, they should get paid for creating value for their clients
- saagarjha 7y agoThere’s so much wrong with settlement payouts, but one of the less talked about problems is how all of them get .com domains that look straight out of “How to Spot Phishing 101”. Can someone please tell lawyers to figure out how to make these not look super sketchy?
- therealx 7y agoThey have a formula for it and don't care one bit about it. Often times theres no SSL and many other security options are ignored. I was shocked how much of law was simple find/replace on templates.
- simcop2387 7y agoIt almost seems like it'd be in their best interest for them to be sketchy. It'd keep people from trying to get their settlement so that the time eventually runs out.
- hanniabu 7y agoWould be great if a settlement.gov site was used for all claims or something of the sorts
- m4tthumphrey 7y agoThat's $22,500 TOTAL, not per plaintiff, i.e. $2,500 per plaintiff.
- ghaff 7y agoWhich may not be awful depending upon how much time they spent on it--though I'm guessing it isn't great on a per-hour basis. The bigger point is that everyone else other than the plaintiffs got a coupon that's probably a lower discount than Zappos routinely emails out for Arbor Day.
- koolba 7y agoPer primary plaintiff. The rest of us schmucks get a 10% off coupon.
- rolltiide 7y agodecent business model fwiw get a little price discovery on how much data is worth while re-targeting a bunch of customers that stopped using your service sometime over the last decade
- throwawaylawco 7y agoIf you ever been around the legal system you get used to it. Get raped again and again.
- timavr 7y agoUS legal system is broken af. The point of legal system should be to compensate the wronged party, not to enrich lawyers.
- steve19 7y agoThe lawyers would argue that by enriching them companies are less likely to engage in bad behavior. But I agree. I am tired of getting practically nothing from class action lawsuits, while lawyers who did not get harmed walk away with millions.
- landryraccoon 7y agoI agree, but I think most people wouldn't agree with the conclusions. For example - if someone is criminally wronged in a property crime, wouldn't it make more sense to leave them free but garnish their wages to make the wronged individual whole instead of putting them in prison for decades? Yet if you bring up the idea of compensating the victim instead of punitive justice, a majority of people are extremely offended by the idea. From that point of view, it isn't surprising at all that class action lawsuits are much more about retribution than restoration in the adversarial system.
- thomascgalvin 7y agoThe argument is that the total amount of the settlement is important as a disincentive to corporations to engage in negligent behavior, and that the disproportionate amount of money that goes towards the attorneys is necessary to convince said attorneys to take up such cases. Of course, one could also argue that this has just created a new form of venture lawyering, with attorneys who give zero shits about their clients chasing compliance violations rather than ambulances, and businesses baking these lawsuits into their profitability calculations.
- paulddraper 7y agoI agree with this. Suits do not always make the suing party whole, for a number of reasons, yet still have value in enforcing law. Additionally, many arrangements (particularly class action) have attorneys assuming the entire financial risk of the a loss, and it's reasonable for them to be paid for this service. --- That said...we're not taking about 30% to the plaintiff, or even 5%. It's 1.4%!!! It's like saying Facebook founders get a combined 1.4% of the company.
- fjp 7y agoThe justice system is really in all ways more biased towards dealing out punishment than making aggrieved parties whole.
- asdfasgasdgasdg 7y agoAlthough, to be fair, no harm or negligence has actually been demonstrated in the case of this suit. Which is probably why the settlement amount is so low. I can hardly imagine these lawyers actually made their typical rates getting paid only $1.5M for a matter that took seven years to resolve. From the outside this looks more like a situation where Zappos said, "fine, we'll give you a token amount to go away."
- whyaduck 7y agoIt's worse than that. The actual award to the class is a 10% off coupon. So, to get compensation, a class member would need to send Zappos money.
- hanniabu 7y agoIs that even supposed to be considered a win for anybody other than the lawyers?
- Waterluvian 7y agoThe problem I see is that lawyers then only care to recoup enough to make their ledger work out. If you said my settlenent is $80 I'd say go for broke. Take it all the way or go home. No but the lawyer sees a perfectly cromulent payday for themselves so they'll encourage the class to accept the deal.
- teslaberry 7y agoOur system is totally broken as institution and cartels of lawyers on both plaintiff and defendant side have captured article 2 and administrative courts as well as a general cultute of litigation for the benefit of the bar. Nothing can fix this. It must break the same way all highly complex protecetd systems.....slowly, painfully from within. Unlesss china conquers us from without ;)
- jedberg 7y agoAs my lawyer friend says, a class action lawsuit is the startup of the lawyering world. Get one good one and you're set for life.
- paulddraper 7y agoGood analogy. Because on the other hand, it's risky and time intensive. You stand to lose quite a bit as well, since class actions don't usually pay the lawyers on loss.
- hughes 7y agoIf it took a team of lawyers 7 years to resolve this, $1.5M hardly sounds like "set for life" money. But maybe this is not a good one.
- asdfasgasdgasdg 7y agoThis must not be a good one, then, because $1.5M is barely enough to set one attorney up for life, let alone however many folks were presumably involved in this case.
- jedberg 7y agoJust like startups, class actions are a lot of risk and sometimes the rewards don't make up for it. This is basically a middling exit in the startup world.
- sokoloff 7y agoEven if the $1.5MM were totally untaxed, it would provide ~$50K/yr in income for life. That’s quite far from set for life.
- mypalmike 7y agoAnecdote: The only Beverly Hills mansion I have ever been in was owned by a class action lawyer.
- NelsonMinar 7y agoCan anyone put this in perspective for penalties for other data breaches? Honestly I'm used to data breaches having no penalties other than maybe "we'll sign you up for credit monitoring" (that I don't want or need).
- Townley 7y agoThis is an absurd sum, both in the fees:rewards ratio, and in the total amount ($22,500 might as well be nothing for all of the people involved). That said, I'm a bit surprised to see a "Rake them over the coals" attitude on HN. They leaked a DB with hashed passwords, user data, and last 4 digits of credit cards. That happens to even the most responsible websites all the time, even with seven years of best practices to build upon. I know it would have absolutely happened to the awful, framework-less PHP I was writing back in 2012. Without letting Zappos off the hook for not taking security more seriously, it seems to me that substantial, non-ridiculous monetary punishments should be reserved for instances of deliberate recklessness, or at least clear, preventable negligence.
- wavefunction 7y agoI worked for a much smaller place with far less resources than Amazon (which is what Zappos is) and our PCI compliance as a payments processor was rock solid. Our systems were under attack all the time from all corners of the globe and we never suffered a breach. If you can't manage PCI compliance then you shouldn't be involved with credit cards.
- colechristensen 7y agoTheir settlement ended up costing as much as a few good engineers for a year. Consequences like that will mean it makes financial sense to ignore security and just pay the settlements as they come. Consequences should motivate companies to be secure. i.e. it should be much cheaper to hire a large competent security team who has a chunk of engineer time than it is to pay tiny settlements to teams of lawyers. Data breaches aren't just necessary evils, they can be prevented, but not without a lot of extra work. Companies should consider a data breach to be an existential threat, not a cost of business.
- oconnor663 7y ago> Consequences like that will mean it makes financial sense to ignore security and just pay the settlements as they come. If judgments like this were the only reason to prioritize security, then sure. But hopefully there are at least some market/reputational forces at work too.
- noonespecial 7y agoThink of how much more the victims would have if they just put the $1.6M in a mutual fund in 2012.
- 0x262d 7y agoso I guess the previous title listing the fees and payment to plaintiffs was a little too edgy huh
- OrgNet 7y agoat least there was more then one attorney getting that fee /s
- mirimir 7y agoHuh? I thought that fees and expenses were generally 30%-40% of settlements.
- RcouF1uZ4gsC 7y agoDon’t lawyers have a fiduciary duty to their clients to act in their best interests? This is definitely not in their clients best interests. I wonder if people in the class action can bring a bar complaint against the lawyers in the case and have them disbarred?
- Sephr 7y agoI wasn't aware that there were any laws about data breach settlements from 2012. I detected a breach at Macmillan Publishers around that time[1] and have been wondering if they were still liable. 1. https://eligrey.com/blog/bedford-st-martins-data-breach/ https://eligrey.com/blog/bedford-st-martins-data-breach/
- nothinghere789 7y agoWould it do anything to boycott them
- nothinghere789 7y ago10% coupon, really? How much of this is Amazon's legal department. It's time to make an annual cancel Prime day