Shareholders sue corporate boards over cybersecurity breach.

• Position: CYBERSECURITY

Corporate board members take heed: you could be held accountable by your shareholders for cybersecurity breaches. Just ask the boards of Wyndham Worldwide and Target.

In May it became public that a shareholder is suing Wyndham Worldwide board directors and officers for failing "to take reasonable steps to maintain their customers' personal and financial information in a secure manner" after the company experienced three data breaches between April 2008 and January 10. The company is already under fire from the Federal Trade Commission regarding the incidents. (See "Wyndham Stands Up to the FTC," in the Up Front section of the November/ December 2013 issue of Information Management.)

In his filing, the shareholder called out the board for failing to ensure that Wyndham had "implemented adequate information security policies and procedures (such as by employing firewalls)" prior to connecting networks. He also chastised the board for allowing the company to use an operating system so woefully out of date that the vendor stopped providing security updates three years prior to the breaches. Further, there was the lack of timely notification to those customers potentially affected by the intrusions; the stockholder cited the board for waiting two and a half years after the third incident to disclose the breaches in the company's financial filings.

Target's board has...