Every data breach case is different; it’s impossible to quantify what a particular case is worth. I would say that the type of information involved in the breach will dictate the value of the case. The more sensitive the information—medical information or Social Security numbers—will typically mean that the case is worth more money than if it’s just a name or address, and you can understand why. Financial account information is sometimes valuable when it comes to settling a class action.
The value of the case is also largely driven by the number of people that were impacted and where those people reside at the time of the breach. The reason that matters is because certain states have certain laws that make it more egregious, and there’s more of a penalty, a statutory penalty per state, that those residing there can get if there’s a disclosure of their data when they live in that state. For instance, in California, you could get a few thousand dollars if your information is breached, while other states don’t have a similar statute.
