A California Federal court ruled Monday that a group of former Sony Pictures Entertainment employees can move forward with a lawsuit claiming negligence in the devastating November 2014 studio hack.
Judge R. Gary Klausner found that the posting of private identification information of current and former SPE employees to file sharing sites “are sufficient to establish a credible threat of real and immediate harm, or certainly impending injury.”
The original complaint, filed in mid-December by Michael Corona and Christina Mathis “on behalf of all others similarly situated,” proposed the hacking resulted from two “inexcusable problems”:
“1) Sony failed to secure its computer systems, servers, and databases (‘Network’), despite weaknesses that it has known about for years because Sony made ‘a business decision to accept the risk’ of losses associated with being hacked; and (2) Sony subsequently failed to timely protect confidential information of its current or former employees from law-breaking hackers,” documents said.
Sony moved to dismiss the claims in February.
“There are no allegations of identity theft, no allegations of fraudulent charges, and no allegations of misappropriation of medical information,” the studio said in filed response.
“Instead, the plaintiffs assert a broad range of common-law and statutory causes of action based on their alleged fear of an increased risk of future harm, as well as expenses they claim to have incurred to prevent that future harm.”
While the court agreed with Sony that plaintiff’s fears about future harm doesn’t prove negligence, it conceded the former staffers have incurred costs for credit monitoring and password security, among similar services, for which Sony could be accountable.
“Upon review of the allegations, the Court finds that the Complaint sufficiently alleges facts to support the reasonableness and necessity of Plaintiffs’ credit monitoring,” a response from the judge said.
Pamela Chelin contributed to this report.