The recently alleged data privacy and security incident involving Aetna and one of its vendors is now the basis of class action litigation. Both the vendor and Aetna are named defendants in the class action suit, which raises potentially novel issues for companies and their third-party service providers to consider when contracting for technology and non-technology services that touch data security and privacy matters.