A federal appeals court in San Francisco has ruled a lawsuit against Facebook for a data breach that compromised the accounts of almost 30 million users can proceed.
Facebook had sought to dismiss the class-action lawsuit on the basis that the company wasn’t liable as the victim of a cyberattack and the information obtained in the attack didn’t pose a risk of financial injury to those affected. The federal appeals court dismissed Facebook’s argument, ruling the lawsuit for negligence can move to discovery for trial.
The lawsuit claims the social media giant failed to protect users’ data by allowing hackers to access personal data such as names, phone numbers, birthdates, and religious views and take over accounts through a vulnerability in its code. The data breach was discovered last September and affected account users worldwide, including about 4 million in the United States.
While the lawsuit against Facebook can move forward with the negligence claim, the court did dismiss complaints that Facebook violated its contract with users and violated a California law protecting consumers. Those claims were dismissed without prejudice, which allows the plaintiffs to amend and refile those complaints.
The federal appeals court ruling against Facebook is the second in the last few months allowing a class-action lawsuit to move forward against a company for a data breach. The court ruled in March that a lawsuit against shoe and clothing retailer Zappos for a data breach in 2012 that exposed the personal information of 24 million customers could continue, citing the compromised information put the customers at risk for identity theft.