“It certainly could become a big issue” for the company, said Paul Greene, who heads Harter Secrest & Emery’s data security and privacy practice and is not involved in the litigation. “It will likely dwarf the costs that they incurred in relation to the incident itself.”

See Full Page