American Water Data Breach Lawsuit Filed in New Jersey Over 2024 Cyberattack

New to ClassAction.org? Read our Newswire Disclaimer

American Water Works Company, Inc. faces a proposed class action lawsuit in the wake of an October 2024 data breach allegedly caused by the utility’s failure to properly protect consumers’ sensitive information.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter.

The 56-page American Water data breach lawsuit says that the Camden, New Jersey-based water and wastewater utility company, which services more than 14 million people across 14 states, reported in a regulatory filing that on October 3, it learned of “unauthorized activity” on its computer networks, which it later determined to be “the result of a cybersecurity incident.” American Water stated online around October 7 that it had “disconnected or deactivated certain systems,” including its customer portal service, MyWater, to protect consumers’ data and prevent any further harm, the filing relays.

The data breach lawsuit accuses American Water, the largest regulated water and wastewater utility in the United States, of failing to adequately protect consumers’ information, such as by encrypting or redacting it, and says the cyberattack stemmed from the utility’s “negligent and/or careless acts and omissions.”

“More specifically, American Water failed to take and implement available steps to prevent an unauthorized disclosure of data, and failed to follow applicable, required, and appropriate protocols, policies, and procedures regarding the encryption, storage, and destruction of data, even for internal use,” the case scathes.

According to the American Water lawsuit, consumer information that could have been compromised in the 2024 data breach includes names, email addresses, dates of birth, home addresses, Social Security numbers, driver’s license numbers, bank account and financial details, and account specifics.

American Water represented online that it would keep safe and confidential the sensitive data consumers provide in the course of doing business with the company, and that it would delete any sensitive information after it was no longer required to maintain it, the complaint states. Further, American Water claims to be the first U.S. water and wastewater company to earn the Support Anti-Terrorism by Fostering Effective Technologies (SAFETY) Act designation, the suit says.

Per the suit, American Water’s systems went back online on October 10.

Nowhere in its disclosures of the data breach did American Water detail the root cause of the incident, the vulnerabilities that were exploited, and the specific measures taken to ensure such an incident does not happen again, the filing highlights, calling the announcements “no real disclosure at all.”

The American Water data breach class action lawsuit looks to cover all United States residents whose personally identifiable information was compromised in the American Water data breach, including all those who received notice of the incident.

Looking for class action lawsuits to join? Check out ClassAction.org’s lawsuit list for the latest top class action lawsuits.