Paytime breach could bring flurry of lawsuits

(Harrisburg) — The data breach at Cumberland County-based Paytime, a payroll processor for many midstate companies, could lead to a flurry of lawsuits and possible actions from the federal government.

According to two lawyers with experience in identity theft cases, lawsuits are likely coming over the breach affecting as many as 233,000 people across the nation.

But, companies who contracted with Paytime could also be sued for failing to ensure their employees data is protected.

“If there is somebody that is disgruntled from an employer-employee perspective, that could result in lawsuits to the employer that has used Paytime and potentially has not actively monitored whether or not they were up to snuff in terms of data privacy and security,” says Attorney Sharon Klein with Pepper Hamilton LLP.

However, Attorney Devin Chwastyk with McNees Wallace & Nurick LLC says courts have been raising the bar recently.

“It’s not going to be sufficient to just show that you had to, for example, incur some transaction fees to change your account information around.”

Chwastyk says judges now want proof of actual harm; the breach itself is no longer enough.

“That’s speculative or hypothetical harm. What you need to prove is actual harm, and that means at a minimum, that someone with bad intentions has accessed your account and taking money or tried to obtain credit using your personal information.”

On top of the lawsuits, the Federal Trade Commission could get involved, says Attorney Klein.

“That’s pretty likely, both from a regulatory perspective, in the sense that in 2014, we’ve seen a series of enforcement actions about third parties.”

The U.S. Secret Service is investigating the breach. The FTC does not comment on possible investigations.

Klein and Chwastyk both say if lawsuits are brought, it could be three to five years before a resolution.

Paytime has not commented on the possibility of lawsuits.