Donald Smith writes on SearchSecurity.com, “Who will win a landmark case on customer data protection?

Who decides whether a business is responsible for your data, or if you yourself are? Now it may be a judge and jury.

According to a report in The Register, Joe Lopez, a small businessman from Florida, alleges that Bank of America was negligent because it failed to protect his account from compromise through known risks. He regularly used the bank’s online services to send and receive money from the U.S. and Latin America, but last April he discovered an unauthorized wire transfer for $90,348 sent to a bank in Latvia. When he became aware of the fraud, he notified the police, and when the Secret Service performed a forensic examination of his PCs, they uncovered an infection by a Trojan called Coreflood.

According to the accounts, Lopez’s legal case is that Bank of America did not inform its customers of the risk posed by Coreflood, even though they knew it posed a risk. He goes on to allege several other charges, including negligence and intentional misrepresentation. He is bringing the lawsuit to reclaim his stolen money, plus lost interest.

In the same report, Bank of America denied a breach of its e-banking system, and denies responsibility for its customer’s losses.

What makes this particular case stand out more than any other? This appears to be the first time cybercrime is the basis of such a lawsuit. As tensions build in the political arena concerning information security, privacy of data and a company’s responsibility to secure its customers’ data, this case has the ability to define the lines of responsibility. When a customer has a direct loss because his information was used for fraud, is the customer responsible for the theft, or is the bank responsible for accepting fraudulent ID, in the same way they would for cashing a check with a fake driver’s license?”

Full article: Customer vs. Bank of America: Who’s to blame?