In Maine, the customers of a grocery store whose electronic payment data was allegedly stolen by third parties won a victory against the grocery store for failure to notify them of the breach. The First Circuit ruled that the grocery store was liable for mitigation damages, i.e. the costs associated with consumers protecting themselves from the breach. Anderson v. Hannaford Brothers Co.
Comment: Almost all states require a business to notify consumers if the business’ data is obtained by an unauthorized third party. These laws often have substantial penalties for noncompliance, and you should review your data storage procedures to ensure compliance with these laws. I would be happy to help on this issue if you contact me.