Establishing Causation and Measuring Economic Harm in Data Breach Litigation
ABA Antitrust Law Section, 2026
Data breaches and other forms of cyber theft have become commonplace. Although lawsuits following cyberattacks often allege that the exposure of personal data caused consumer harm, establishing causation and measuring damages in such disputes generally requires careful empirical analysis. First, the ubiquity of cyber incidents can complicate the assessment of causation in such disputes: How does one isolate the effect of the at-issue data breach from unrelated cyber incidents involving the same or similar types of data? Further, damages claims in such matters often involve alleged harms, such as increased future risk of data exposure following a breach, that may be speculative and difficult to substantiate with empirical evidence.
In an article published by the American Bar Association (ABA) Antitrust Law Section, Principal Hristina Bojadzieva Bartlett examines economic considerations relevant to evaluating causation and measuring economic harm and damages in data breach litigation. She emphasizes the importance of establishing a causal nexus between the alleged harms and the particular information exposed in the breach and assessing the incremental effect of the breach, if any, given that the same or similar data for the same individuals may have been obtained by bad actors through other pathways, including prior incidents, phishing, and digital skimming. Ms. Bartlett also examines claims about increased risk of future harm and emphasizes the importance of evaluating whether such claims are supported by empirical evidence and whether resulting economic harm can be reliably measured.