Both 2017 and 2018 saw several high-profile companies suffering large data breaches affecting tens of millions of people. News outlets and social media made quick work of headlines and consumers were reminded, yet again, that their personal information was vulnerable and subject to theft. The now-tired adage, “it’s not a matter of if, but when you will be breached” was trotted out by experts and the media alike, making it sound as if a data breach inevitably leads to a class action lawsuit against the targeted company.

But the untold story was the 600+ publicly reported data breaches per year that did not make the news and that did not result in class action litigation. Despite numerous large and public data breaches, the risk that a company will face litigation following a data breach remains relatively low year-after-year, between 4-6%, consistent with prior years’ studies published by our firm.