On November 25, 2020, a shareholder of First American Financial Corporation (“First American”) filed suit against the company and its officers and directors over a massive data security breach that exposed hundreds of millions of sensitive customer records. The shareholder derivative action, filed by Norman Hollett in Delaware federal court, alleges breaches of fiduciary duties, unjust enrichment, abuse of control, gross mismanagement, waste of corporate assets, and multiple violations of the Securities Exchange Act of 1934, all relating to the failure to contain and timely disclose the breach.

In times of crisis, fraudsters attempt to exploit the latest news developments to lure investors into scams, and the once-in-a-century global health crisis we are currently facing is no exception. On February 4, 2020, the SEC noted in an Investor Alert that it was aware of a number of web-based promotions claiming that the products or services of publicly-traded companies could prevent, detect, or cure COVID-19—and that the stock of these companies would skyrocket as a result. The Investor Alert warned market participants to be vigilant and put publicly-traded companies on notice that the Commission is watching.

The COVID-19 pandemic has brought great economic uncertainty and significant market volatility, creating an environment where investors that are trying to assess the financial impact of the virus are looking to glean any insight they can from a company’s disclosures and are hanging on every statement made by company leaders. This environment of heightened investor focus has, not surprisingly, increased the legal risks that companies, their officers, and their directors face when informing the market about the impact of COVID-19. The coming months are likely to see increased activity from both the SEC Enforcement Division and from plaintiffs’ firms bringing shareholder suits challenging overly optimistic disclosures companies make about their capacity to manage the challenges presented by the pandemic. Consequently, disclosures concerning the business and financial risks to a company posed by COVID-19 must be made with the utmost prudence and caution to limit a company’s exposure to actions brought by the SEC Enforcement Division or shareholder suits.