Publications

Portrait of Xu Chen
Xu Chen

Associate

Publications

Publications

Events

Bloomberg Law Publishes Cahill on Memecoins
When: January 29, 2025
People: John P. Cahill
HHS-OCR’s Proposed Rule and HIPAA Security Risk Assessment
When: January 15, 2025
People: Mendel Epstein
Cybersecurity Compliance Handbook for Financial Institutions & Credit Unions
When: December 6, 2024
People: Anjali C. Das, Dominik Cvitanovic, Ian A. Stewart and Thomas W. Wilson, Jr.
PLUS Publishes Sheehan on Use of AI in Health Care
When: November 21, 2024
People: Noelle K. Sheehan
NY DFS Issues Guidance on AI Cyber Risk
When: October 21, 2024
People: Anjali C. Das
The Ever-Evolving World of Cyber Coverage
When: June 26, 2024
People: Richard W. Boone, Jr., Jonathan E. Meer, Richard J. Bortnick and Siobhán A. Mueller
Seventh Circuit Finds Access or Disclosure Exclusion Bars Coverage for BIPA Claims
When: June 5, 2024
People: Michael J. Duffy, Michael J. O'Malley and Joseph M. Dybisz
The Essential Guide to HIPAA Compliance
When: May 23, 2024
People: Anjali C. Das
Illinois Legislature Passes Amendment to BIPA to Respond to Plaintiff-Friendly Decisions by Illinois Supreme Court
When: May 22, 2024
People: Michael J. Duffy, Michael J. O'Malley, Lisa Handler Ackerman and Joseph M. Dybisz
SEC’s New Cybersecurity Disclosure Rules
When: January 23, 2024
People: Anjali C. Das
Cahill and Wilson Co-author Article on Defining Digital Assets for Westlaw Today
When: September 7, 2023
People: John P. Cahill and Thomas W. Wilson, Jr.

Publications

Mangano, Zibas and Rolland Prevail in Significant Privacy Litigation Matter

Shawn Mangano (Of Counsel-Las Vegas, NV), Jura Zibas (Partner-New York, NY and Sarasota, FL) and Sean Rolland (Of Counsel-Orlando, FL) successfully defended a hybrid managed services provider in litigation before the U.S. District Court for the District of Nevada.

Plaintiffs’ claims involved the unauthorized access and alleged dissemination of personally identifiable information (“PII”) related to potentially over 600,000 potential data breach claimants that received services for a health provider with which Wilson Elser’s client was providing data storage and security services. The data breach at issue involved sophisticated Russian cybercriminals who allegedly gained access to another party’s protected data through cyber-spoofing, resulting in access to the provider’s information containing Plaintiffs’ PII. Plaintiffs filed a complaint for damages seeking recovery for negligence/negligence per se, breach of third-party beneficiary contract, invasion of privacy or intrusion upon seclusion, and unjust enrichment.

On August 18, 2026, our client received a report and recommendation recommending its motion to dismiss be granted on several key damage recovery issues that have not otherwise been confirmed in data breach actions filed in the jurisdiction.

These recommendations include the requirement that, for a negligence per se claim, a plaintiff must allege that his or her PPI was subject to an increased risk of fraud, identity theft, or nefarious misuse. Likewise, for a plaintiff seeking to recover for “lost time” under a negligence/negligence per se claim, recovery must be tied to out-of-pocket expenses for said lost time. Finally, a plaintiff’s claims of increased anxiety and emotional distress must assert the existence of a physical injury or illness to warrant recovery of damages for the unauthorized disclosure of his or her PII.

Regarding breach of third-party beneficiary contract, the Court concluded that mere allegations that “Defendant entered into contracts to provide IT services” were insufficient to establish data protection obligations on our client.

Finally, the Court determined that to recover for invasion of privacy/inclusion upon seclusion for the data breach, a Plaintiff must be under “highly offensive” circumstances. In this case, those “highly offensive” circumstances were determined to be possession of PII by a notorious cybercriminal gang, of which at least one Plaintiff had failed to assert.

Overall, this result serves to delineate the allegations necessary for Plaintiffs to survive a motion to dismiss in cyber breach cases in the District of Nevada, despite multiple other decisions that essentially rubberstamped allegations. 

Shawn A. Mangano, Jura Christine Zibas and Sean Rolland

Coffman, Das, Ross, Viergever and Williams Defeat Federal Data Breach Class Action

Daniel Coffman (Associate-Washington, DC), Anjali Das (Partner-Chicago, IL), David Ross (Partner-Washington, DC), Kim Viergever (Of Counsel-Denver, CO) and Ryan Williams (Partner-Denver, CO) obtained dismissal with prejudice of a federal data breach class action filed against a services vendor for mental health care providers in the District of Colorado. The case comprised eight consolidated class actions brought by 15 named plaintiffs that arose out of a ransomware incident that involved the personal information of almost 4.3 million individuals and included sensitive information such as health information and Social Security numbers. The court agreed that all of the named plaintiffs lack Article III standing, dissecting each of their alleged theories of harm and coming down on the side of the more reasoned courts that have found these types of theories fail to establish standing – public disclosure of private information, increased spam, diminution in value of PHI/PII, emotional distress and future harm. The court concluded that “Plaintiffs have failed to allege injuries in fact that are fairly traceable to the Defendants’ complained-of conduct,” and issued a judgment dismissing the plaintiffs’ claims with prejudice and closing the case. 

Daniel R. Coffman, Anjali C. Das, David M. Ross, Kimberly Viergever and Ryan A. Williams

Cybersecurity Class Action

Das, Myers and Spitaletto Obtain Dismissal of Texas Data Breach Class Action

Anjali Das (Partner-Chicago, IL), Brian Myers (Of Counsel-Washington, DC) and Tommy Spitaletto (Partner-Dallas, TX) obtained dismissal of a data breach class action filed against a mental health care provider in the Western District of Texas. The lawsuit arose out of a cyber-attack that involved personal information that included sensitive information such as health information and Social Security numbers. In support of our client’s motion to dismiss, Wilson Elser argued that the plaintiff lacked Article III standing to sue because she failed to allege any injury-in-fact in the form of identity theft fraud, or misappropriation as a result of the breach. Instead, the plaintiff alleged that her harm consisted of (1) lost time and out-of-pocket expenses spent dealing with the data breach; (2) diminished value of her personal, health and financial information; (3) anxiety; (4) violation of privacy rights; (5) loss of the benefit of the bargain made with our client and overpayment for services intended to include data security; and (6) increased risk of future fraud and identity theft. The District Court agreed with Wilson Elser’s position that the plaintiff lacked standing to bring suit and dismissed the case on the basis that the plaintiff failed to allege any actual injury in the form of identity theft, financial fraud or misuse of personal information that could be traced to the cyber incident.

Anjali C. Das, Brian H. Myers and Thomas M. Spitaletto

Mirabile, Murphy-Petros and Das Obtain Favorable Ruling in VPPA Class Action

Constantina Mirabile (Of Counsel-West Palm Beach, FL), Melissa Murphy-Petros (Of Counsel-Chicago, IL) and Anjali Das (Partner-Chicago, IL) represented an educational technology company that provides subscribers with access to online educational courses in a Video Privacy Protection Act (VPPA) class action filed in the U.S. District Court for the Southern District of Florida. The plaintiff, a subscriber, allegedly viewed online course content offered by our client, and filed a putative class action on behalf of herself and all other subscribers for violations of the VPPA. The plaintiff alleged that Meta Pixel (a snippet of JavaScript code that tracks visitor activity on a website) was installed on our client’s website, which resulted in the disclosure of her personal information to Facebook, including the content she viewed, without her consent. Wilson Elser filed a Motion to Compel Arbitration, noting that the plaintiff (like all subscribers) was required to accept defendant’s Terms of Use, which included a mandatory binding arbitration provision. Moreover, the Terms of Use explicitly stated that all parties waived the right to participate in a class action or representative proceeding with respect to any claim. The court promptly granted Wilson Elser’s motion pursuant to the Terms of Service agreement. The ruling underscores the importance of arbitration and class action waiver language in Terms of Use agreements.

NOTE: The Video Privacy Protection Act (VPPA), enacted in 1998, sought to preserve personal privacy with respect to the rental, purchase or delivery of video tapes or similar audio visual materials. Plaintiffs have sought to resuscitate the statute by bringing VPPA claims into the 21st century based on the premise that organizations that offer prerecorded, online audio visual content are “video tape service providers” within the meaning of the statute, the draw being VPPA class actions include statutory damages of up to $2,500 per violation.
 

Melissa A. Murphy-Petros and Anjali C. Das

Dismissal of Data Breach Class Action on Behalf of Radiology Facility and Archival Imaging System

Geoffrey A. Belzer (Partner-Chicago), Anjali C. Das (Partner-Chicago), Peter J. Larkin (Partner-White Plains) and Jennifer S. Stegmaier (Of Counsel-Chicago) obtained a data breach class action dismissal in the U.S. District Court for the Southern District of New York on behalf of a radiology facility and archival imaging system that contained protected health information. About a year and a half after receiving notice of a breach, two patients filed a complaint against the firm’s client and its IT service provider for failing to implement adequate cybersecurity measures, alleging multiple unauthorized individuals had accessed their information. Geoffrey, Anjali, Peter and Jennifer prevailed on their motion to dismiss when the court held that allegations of increased risk of future harm alone is not a cognizable injury. The court also rejected each of the plaintiffs' additional theories of injury based on time and money spent on theft and fraud monitoring, “benefit of the bargain” injury, intrusion upon seclusion and statutory violations. Plaintiff’s counsel initially filed a purported class action designating another individual who was ultimately determined to never have been a patient of the radiology practice. Plaintiff’s counsel dismissed that action after the team moved for dismissal, and counsel then instituted the parallel suit involving these two plaintiffs and the motion to dismiss follows.

Geoffrey Belzer, Anjali C. Das, Peter J. Larkin and Jennifer S. Stegmaier

Publications

Publications

Publications

Publications

Publications

Events

Bloomberg Law Publishes Cahill on Memecoins
When: January 29, 2025
People: John P. Cahill
HHS-OCR’s Proposed Rule and HIPAA Security Risk Assessment
When: January 15, 2025
People: Mendel Epstein
Cybersecurity Compliance Handbook for Financial Institutions & Credit Unions
When: December 6, 2024
People: Anjali C. Das, Dominik Cvitanovic, Ian A. Stewart and Thomas W. Wilson, Jr.
PLUS Publishes Sheehan on Use of AI in Health Care
When: November 21, 2024
People: Noelle K. Sheehan
NY DFS Issues Guidance on AI Cyber Risk
When: October 21, 2024
People: Anjali C. Das
The Ever-Evolving World of Cyber Coverage
When: June 26, 2024
People: Richard W. Boone, Jr., Jonathan E. Meer, Richard J. Bortnick and Siobhán A. Mueller
Seventh Circuit Finds Access or Disclosure Exclusion Bars Coverage for BIPA Claims
When: June 5, 2024
People: Michael J. Duffy, Michael J. O'Malley and Joseph M. Dybisz
The Essential Guide to HIPAA Compliance
When: May 23, 2024
People: Anjali C. Das
Illinois Legislature Passes Amendment to BIPA to Respond to Plaintiff-Friendly Decisions by Illinois Supreme Court
When: May 22, 2024
People: Michael J. Duffy, Michael J. O'Malley, Lisa Handler Ackerman and Joseph M. Dybisz
SEC’s New Cybersecurity Disclosure Rules
When: January 23, 2024
People: Anjali C. Das
Cahill and Wilson Co-author Article on Defining Digital Assets for Westlaw Today
When: September 7, 2023
People: John P. Cahill and Thomas W. Wilson, Jr.

Events

Bloomberg Law Publishes Cahill on Memecoins
When: January 29, 2025
People: John P. Cahill
HHS-OCR’s Proposed Rule and HIPAA Security Risk Assessment
When: January 15, 2025
People: Mendel Epstein
Cybersecurity Compliance Handbook for Financial Institutions & Credit Unions
When: December 6, 2024
People: Anjali C. Das, Dominik Cvitanovic, Ian A. Stewart and Thomas W. Wilson, Jr.
PLUS Publishes Sheehan on Use of AI in Health Care
When: November 21, 2024
People: Noelle K. Sheehan
NY DFS Issues Guidance on AI Cyber Risk
When: October 21, 2024
People: Anjali C. Das
The Ever-Evolving World of Cyber Coverage
When: June 26, 2024
People: Richard W. Boone, Jr., Jonathan E. Meer, Richard J. Bortnick and Siobhán A. Mueller
Seventh Circuit Finds Access or Disclosure Exclusion Bars Coverage for BIPA Claims
When: June 5, 2024
People: Michael J. Duffy, Michael J. O'Malley and Joseph M. Dybisz
The Essential Guide to HIPAA Compliance
When: May 23, 2024
People: Anjali C. Das
Illinois Legislature Passes Amendment to BIPA to Respond to Plaintiff-Friendly Decisions by Illinois Supreme Court
When: May 22, 2024
People: Michael J. Duffy, Michael J. O'Malley, Lisa Handler Ackerman and Joseph M. Dybisz
SEC’s New Cybersecurity Disclosure Rules
When: January 23, 2024
People: Anjali C. Das
Cahill and Wilson Co-author Article on Defining Digital Assets for Westlaw Today
When: September 7, 2023
People: John P. Cahill and Thomas W. Wilson, Jr.

Events

Bloomberg Law Publishes Cahill on Memecoins
When: January 29, 2025
People: John P. Cahill
HHS-OCR’s Proposed Rule and HIPAA Security Risk Assessment
When: January 15, 2025
People: Mendel Epstein
Cybersecurity Compliance Handbook for Financial Institutions & Credit Unions
When: December 6, 2024
People: Anjali C. Das, Dominik Cvitanovic, Ian A. Stewart and Thomas W. Wilson, Jr.
PLUS Publishes Sheehan on Use of AI in Health Care
When: November 21, 2024
People: Noelle K. Sheehan
NY DFS Issues Guidance on AI Cyber Risk
When: October 21, 2024
People: Anjali C. Das
The Ever-Evolving World of Cyber Coverage
When: June 26, 2024
People: Richard W. Boone, Jr., Jonathan E. Meer, Richard J. Bortnick and Siobhán A. Mueller
Seventh Circuit Finds Access or Disclosure Exclusion Bars Coverage for BIPA Claims
When: June 5, 2024
People: Michael J. Duffy, Michael J. O'Malley and Joseph M. Dybisz
The Essential Guide to HIPAA Compliance
When: May 23, 2024
People: Anjali C. Das
Illinois Legislature Passes Amendment to BIPA to Respond to Plaintiff-Friendly Decisions by Illinois Supreme Court
When: May 22, 2024
People: Michael J. Duffy, Michael J. O'Malley, Lisa Handler Ackerman and Joseph M. Dybisz
SEC’s New Cybersecurity Disclosure Rules
When: January 23, 2024
People: Anjali C. Das
Cahill and Wilson Co-author Article on Defining Digital Assets for Westlaw Today
When: September 7, 2023
People: John P. Cahill and Thomas W. Wilson, Jr.

Events

Bloomberg Law Publishes Cahill on Memecoins
When: January 29, 2025
People: John P. Cahill
HHS-OCR’s Proposed Rule and HIPAA Security Risk Assessment
When: January 15, 2025
People: Mendel Epstein
Cybersecurity Compliance Handbook for Financial Institutions & Credit Unions
When: December 6, 2024
People: Anjali C. Das, Dominik Cvitanovic, Ian A. Stewart and Thomas W. Wilson, Jr.
PLUS Publishes Sheehan on Use of AI in Health Care
When: November 21, 2024
People: Noelle K. Sheehan
NY DFS Issues Guidance on AI Cyber Risk
When: October 21, 2024
People: Anjali C. Das
The Ever-Evolving World of Cyber Coverage
When: June 26, 2024
People: Richard W. Boone, Jr., Jonathan E. Meer, Richard J. Bortnick and Siobhán A. Mueller
Seventh Circuit Finds Access or Disclosure Exclusion Bars Coverage for BIPA Claims
When: June 5, 2024
People: Michael J. Duffy, Michael J. O'Malley and Joseph M. Dybisz
The Essential Guide to HIPAA Compliance
When: May 23, 2024
People: Anjali C. Das
Illinois Legislature Passes Amendment to BIPA to Respond to Plaintiff-Friendly Decisions by Illinois Supreme Court
When: May 22, 2024
People: Michael J. Duffy, Michael J. O'Malley, Lisa Handler Ackerman and Joseph M. Dybisz
SEC’s New Cybersecurity Disclosure Rules
When: January 23, 2024
People: Anjali C. Das
Cahill and Wilson Co-author Article on Defining Digital Assets for Westlaw Today
When: September 7, 2023
People: John P. Cahill and Thomas W. Wilson, Jr.