[melq]

I absolutely think JD would escape liability. Consider the more egregious cases of any number of high-profile companies who have had significant customer data breaches in recent memory. Regardless of how negligent they may have been (lets say they stored user passwords in plain text), have you ever heard of a company being held responsible for even the most egregious/reckless behavior?