Software Makers Under Scrutiny: Exploring the Potential for Increased Liability in the Aftermath of MOVEit Lawsuit

Class-Action Lawsuits Highlight Vulnerabilities in Software

Introduction

A nationwide class-action suit filed against Progress Software following the MOVEit breach has caught the attention of legal experts who believe it could lead to further litigation against software companies whose vulnerable applications are exploited in large-scale supply chain attacks. The lawsuits claim negligence and breach of contract by Progress Software after the Cl0p ransomware gang exploited a zero-day flaw in its MOVEit managed file transfer application. The breach has affected major organizations like Shell Oil and British Airways, as well as smaller public and private organizations. The plaintiffs argue that Progress failed to properly secure their personally identifiable information (PII), thus exposing them to the risk of identity theft and other financial losses.

The Implications for Software Providers

If this case proceeds and results in a favorable outcome for the plaintiffs, it could set a precedent for the potential liability of software providers when they fail to address vulnerabilities in their products before they are exploited by attackers. This could have significant consequences for the entire software industry, forcing vendors to be more vigilant in protecting against breaches. The number of breaches and related lawsuits is increasing, signaling greater scrutiny and potential legal action against software companies.

Precedent for Large Settlements

Historically, plaintiffs in similar lawsuits have been able to secure multi-million dollar settlements. The Accellion data breach case, for example, resulted in an $8.1 million settlement due to claims of negligence, breach of contract, and invasion of privacy. In cases involving ransomware attacks, where victims may choose to pay the ransom, the potential for substantial losses increases. The estimated $100 million earnings for the Cl0p ransomware gang from the MOVEit breach make it more likely that affected companies will seek legal action to recoup their losses.

Establishing Liability

It remains unclear whether Progress Software will be held liable for the breach in the MOVEit application. While the software vendor patched the flaw immediately after it was disclosed, the class-action suits claim that the vulnerability had existed since 2021. The outcome of the case will depend on whether Progress was negligent in failing to identify the flaw before it was exploited and whether the company fulfilled its responsibilities to customers, such as maintaining adequate data retention policies, training staff on data security, and complying with industry standards.

The Need for Legislation

These lawsuits come at a crucial time when discussions around software vendor liability are gaining traction, and the Biden administration is considering its response. The current liability paradigm rarely holds software vendors accountable for exploited flaws in their solutions. The National Cybersecurity Strategy proposed by the Biden administration aims to address this issue by developing legislation to establish liability. While this process will take time, it is seen as necessary to drive accountability and encourage the production of safer software products and services.

Editorial and Advice

These class-action lawsuits and the discussions around software vendor liability highlight the urgent need for increased scrutiny and regulation of the software industry. Software applications play a crucial role in today’s society, and failure to address vulnerabilities can lead to significant consequences for both individuals and organizations.

To protect themselves and their customers, software vendors must prioritize cybersecurity measures. This includes regularly updating and patching software to address vulnerabilities, implementing robust data protection practices, and complying with industry standards. Vendors should also invest in ongoing training and education for their staff to ensure they are well-versed in the latest cybersecurity best practices.

For organizations relying on software applications in their operations, it is essential to stay informed about any security vulnerabilities and apply patches promptly. Additionally, organizations should carefully review the security measures and track records of software vendors before integrating their solutions into their systems.

The MOVEit lawsuit serves as a reminder that cybersecurity is a shared responsibility. Consumers, organizations, and software vendors must work collaboratively to mitigate risks and ensure the security of sensitive data. Ultimately, maintaining a robust cybersecurity posture is critical in today’s digital landscape.