Class Action Alleges Indianapolis Housing Agency Failed to Prevent September 2022 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims the Indianapolis Housing Agency’s (IHA) failure to keep its cybersecurity up to date resulted in a data breach that went undetected for 11 days in September 2022.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org's free weekly newsletter here.

The 25-page case says the IHA was hit by a ransomware attack between September 23 and October 4 of last year, compromising the personal information of approximately 212,910 consumers who have utilized the federally-funded agency's services. According to the lawsuit, negligence on the part of the IHA resulted in the unauthorized access and disclosure of consumers' names, addresses, dates of birth and Social Security numbers.

The agency waited nearly four months after the data breach had occurred before notifying victims, the complaint relays. Although IHA stated in its January 23 notice that it has "no reason to believe that any of [their] information has been or will be misused," it nevertheless instructed consumers to "monitor [their] account statements, financial transactions, and free credit reports for potential fraud and identity theft," and offered victims 12 or 24 months of complimentary credit monitoring and identity protection services, the suit relays.

However, the case contends that this offer is "insufficient" considering that stolen information may exist on the black market for years, and that the costs associated with prevention, detection, recovery and remediation after identity theft or fraud will inevitably fall to the victims after IHA's services have expired. The plaintiff, a Missouri resident who received services from IHA, says he confirmed with Discover last fall that his personal information was already being traded on the dark web.

Per the filing, IHA made itself an easy target for cybercriminals by failing to employ appropriate measures to safeguard consumers' sensitive data and adequately train its employees to prevent such cybersecurity incidents.

To make matters worse, IHA expressly represented to consumers that it would handle their data with care and control, the case says. The suit contends that consumers, who must provide their personal information to receive services from IHA, reasonably trusted that the agency would keep its explicit and implicit promises to adequately safeguard their information.

The lawsuit looks to cover anyone whose personal information was compromised in the Indianapolis Housing Agency data breach announced to affected persons on or about January 23, 2023.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org's free weekly newsletter here.