90 Degree Benefits Data Breach Sparks Class Action Lawsuit

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action alleges the failure of 90 Degree Benefits to properly secure consumers’ personal and health information led to a data breach in December 2022.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

According to the 54-page lawsuit, 90 Degree Benefits launched an investigation after detecting “suspicious activity” on its network on or about December 10 of last year. The health insurance company concluded that hackers had breached its “inadequately defended” systems between December 5 and December 11 and accessed certain files containing personal information belonging to 181,543 customers, the case relays.

The data exposed during the incident included patients’ and plan members’ names, Social Security numbers, addresses, dates of birth, medical/health information and payment details, the suit says.

Per the filing, the cyberattack was a direct result of 90 Degree Benefits’ failure to implement reasonable cybersecurity measures in accordance with its own representations concerning privacy practices, industry standards and federal and state laws.

“As a result of the Data Breach, Plaintiffs and Class members are at an imminent risk of identity theft and fraud,” the complaint stresses. “This risk will continue to exist for years to come, as Plaintiffs and Class members must spend their time being extra vigilant, due to Defendants’ failures, to try to prevent being victimized for the rest of their lives.”

Although 90 Degree Benefits claims to have discovered the breach in December, many patients remained unaware that their sensitive data had been stolen, and likely traded on the dark web, until the company sent affected individuals a notice letter around April 7, 2023, the case says.

The complaint contests that 90 Degree Benefits “knew or should have known” that it would be a target for malicious actors considering the substantial increase in data breaches in recent years, as well as widespread coverage and industry alerts of similar cyberattacks. 

To add insult to injury, the filing continues, 90 Degree Benefits had already suffered a major data breach in February 2022. The case contends that the company, in light of the incident last year, was on “direct notice of the need to implement advanced data security protections but clearly failed to do so.”

The lawsuit looks to represent anyone in the United States whose personally identifiable information or protected health information was accessed or acquired as a result of the data breach that is the subject of the notice sent by 90 Degree Benefits around April 7, 2023.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.