[Dataloss] follow-up: Sears Data Breach Draws Lawsuit

[security curmudgeon]

---------- Forwarded message ----------
From: InfoSec News <alerts at infosecnews.org>

http://www.informationweek.com/security/showArticle.jhtml?articleID=205600038

By Thomas Claburn
InformationWeek
January 7, 2008

Following revelations that Sears' ManageMyHome.com site exposed customer 
purchase data to any online visitor who asked about it, a New Jersey 
resident has filed a $5 million class action lawsuit against the retailer.

In a complaint filed on Friday in Cook County, Ill., where Sears has its 
headquarters, plaintiff Christine Desantis alleges that the company's 
exposure of customer data represents a breach of contract and a violation 
of the Consumer Fraud Act.

The $5 million sought is to cover payments to affected consumers and 
attorneys, and the cost of injunctive relief; no individual is seeking 
more than $75,000, according to the legal filing.

The crux of the case is that Sears "failed to take reasonable steps to 
ensure that [consumers'] private information was secure," according to the 
complaint.

[..]