US Supreme Court rejects shoe retailer Zappos' appeal in data breach case
WASHINGTON, March 25 (Reuters) - The U.S. Supreme Court on Monday rejected a bid by online shoe retailer Zappos to throw out a class-action lawsuit by customers who said their personal information was stolen by hackers in 2012.
The justices denied an appeal by Zappos, a subsidiary of Amazon.com Inc, of a ruling by a California-based federal appeals court that revived the lawsuit, dealing a setback to the company and business groups seeking to limit their liability in data breaches, an increasingly common problem in the internet age.
The case hinges on whether customers whose data has been stolen can sue the company that was hacked even if that information was not used for nefarious purposes such as identity theft or fraudulent charges.
Zappos said customers whose data is not used in those ways are not harmed to such a degree that can sustain a federal lawsuit. But the customers said that after a breach their information can be misused at any time, even years later, and long before the fraud is discovered.
Hackers broke into Zappos' computer systems in January 2012, gaining access to servers containing identifying information for 24 million customers, including names, contact details and partial credit card numbers.
People who purchased shoes and other items from Zappos filed several proposed class-action lawsuits, saying Zappos used unprotected servers and did not properly encrypt the data. Zappos says it acted swiftly so that passwords could be reset, preventing serious harm.
A federal judge in Nevada said some victims who claimed financial loss had legal standing to sue but the rest who could not claim such concrete injuries did not.
The 9th U.S. Circuit Court of Appeals overturned the ruling last year, reviving the other claims, saying the "hackers accessed information that could be used to help commit identity fraud or identity theft."
CLICK HERE TO GET THE FOX BUSINESS APP
In addition to an actual injury, the court said customers can sue if they can show there is a substantial risk of harm and that it is impending.
Zappos called that standard "manifestly insufficient" and urged the Supreme Court to reverse the 9th Circuit.
Backed by business groups such as the U.S. Chamber of Commerce, Zappos said in a court filing that data breaches are a fact of life in an increasingly digital world and the court should shield retailers, employers and service providers from "sprawling and costly litigation."
(Reporting by Andrew Chung Editing by Bill Trott)