In re Law Weekly Cybersecurity Disaster
77 U.Va 13 (2025)
Coleman, J., delivers the opinion of the court.
The shareholders of Virginia Law Weekly Co., Ltd. brought this securities class action against the managers and directors of said company. They allege that these corporate actors repeatedly misrepresented the cybersafety of the Law Weekly website, lulling investors into a false sense of security. This came to a head when, in early January, the website domain was forfeited. During this outage, our vast readership was unable to access satirical law school content, and more importantly, the share price of VLW Co. took a nosedive. After being sent to a multidistrict litigation panel, the District Court divided the class into two tranches based on alleged damages. The first cohort alleges only financial harms from the fall in share price. But the second cohort includes those who suffered accompanying physical and emotional damages—such as the pain and suffering from watching a loved one die of a heart attack after not being able to access the paper. We find that the managers and directors did misrepresent the security of VLW Online. This artificially inflated the stock price and caused financial injury to all class members. And, also as a result of the misrepresentations from VLW Co. senior managers, other class members suffered compensable physical injuries. We affirm the District Court’s judgment against VLW Co., and order the University to pay the damages bill.
I
Since VLW Co.’s initial public offering, a key driver of share price has been its website. It memorializes prior editions, offers unique formatting advantages for special articles, and furthers the reach of young writers. It is no wonder that investors were hopeful for the future. But this hope turned to mania after the Christmas of 2024. For some reason, the managers and directors of VLW Co. took increasingly bullish positions on the health and stability of the company’s website in unison:
But sometime in early January, disaster struck. VLW Co. defaulted on its internet service provider payments, which resulted in immediate loss of the domain name. Some managers unconvincingly attempted to distance themselves from the disaster:
When knowledge of the website collapse became widespread, the share price fell from a record high of $1,948 to just $20.14. And, even with the website back up, the public trust is so eroded that investors have lost billions.
Money is not all that was lost. Some plaintiffs saw family members fall into depressive states. Others developed carpal tunnel syndrome as they scoured the web for our content. And some are not people at all, but the estates of those with actions in wrongful death, for the loss of our website was so damaging as to cause fatalities. While not the ordinary damages in a securities class action, this Court will hear their prayers for relief.
II
Liability under the securities laws is a given in this case. These posts obviously reveal a plot within VLW Co. to artificially boost the share price while every official knew that the website came with severe vulnerabilities. So, the question is whether the plaintiffs alleging noneconomic damages can recover in full. We think they can.
Rather than look to the statute in question, this Court first looks to its case law. And we have no history of limiting damages in any way. See The Funding Cases, 77 U.Va. 1 (2024) (allowing punitive damages against the University in a landmark preservation suit; permitting treble damages against the University). So, there is nothing in our case law that would prevent plaintiffs from recovering economic or noneconomic damages deriving from personal injury.
The remaining question is whether the plaintiffs’ injuries are proximately caused by the misrepresentations. We also find this element to be satisfied. The social media posts from these corporate actors lulled consumers into a false sense of security. For them, the availability of our articles was a dependable certainty. The pain of then losing access to our website was exacerbated when that reliance proved detrimental. Therefore, it makes perfect sense that there would be follow on physical injuries, which this Court will address.
Allard, C.J., dissenting.
I dissent from this disastrous opinion for two reasons. Firstly, I believe the majority gravely errs in failing to apply editorial immunity here. See Law Weekly Editors v. Allard, 76 U.Va 21 (2024) (holding that the Law Weekly’s Editor-in-Chief enjoys immunity from suit). By allowing litigants to sue the Law Weekly in its corporate form, of which the Editor-in-Chief is CEO, the Court continues its alarming trend toward hollowing out the EIC’s, i.e., my!!!!! immunity. See Commonwealth v. Allard, 77 U.Va 11 (2024) (declining to extend editorial immunity to criminal convictions by foreign courts).
Second and more importantly, look up “adorable kitty so friendly and nice” on Google Images right now. That is me. That is who you are suing for breach of fiduciary duty. You can’t do that. I respectfully meow. I mean dissent.
---
jxu6ad@virginia.edu
tya2us@virgina.edu