Class Action Claims Hope College Failed to Prevent Data Breach Affecting Over 156K Consumers

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit accuses Hope College, a private liberal arts school in Michigan, of failing to protect students’ and employees’ personal data from a cyberattack in September 2022.

According to the 47-page lawsuit, the “widespread” breach of the college’s computer systems has compromised the sensitive data of at least 156,713 people—current and former students, their parents, admission applicants, contractors, and current and former employees.

The case alleges that the personally identifiable information (PII) accessed in the data breach was not encrypted and included full names, dates of birth, Social Security numbers, driver’s license numbers, student ID numbers and employment ID numbers. In addition, businesses that have worked with the college also face the exposure of their business names, tax ID numbers and any associated Social Security numbers, the suit explains.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The complaint alleges that Hope College “negligent[ly]” and “careless[ly]” failed to take necessary precautions and implement reasonable security policies to protect its students’ and employees’ information from cyberattacks.

“There are approximately 3,251 students currently enrolled at Hope College,” the lawsuit reads. “Yet, Hope College has inexplicably collected, stored, and failed to protect the highly sensitive PII of over more than 156,000 individuals.”

The frequency of data breaches in recent years means the ransomware attack on Hope College’s computer systems should have been “entirely foreseeable” to the defendant, the filing charges.

According to the suit, the data breach was discovered by Hope College in late September 2022, and official notices were sent to those impacted in December of that year. Nevertheless, the college has yet to provide information on the full extent of the data breach and what data was ultimately affected, the case claims.

“The letters Plaintiff and other Class Members received do not explain how the Data Breach occurred, what steps Hope College took following the Data Breach, whether Hope College made any changes to its data security, or most importantly, whether Plaintiff’s PII remains in the possession of criminals,” the complaint reads.

Subsequent attempts made by Hope College to make amends for its system failure have been inadequate, the suit contends. The college has only offered impacted individuals one year of credit monitoring services, the case claims, and alleged victims are instructed to “direct their concerns and questions to a call center—that is closed on weekends and holidays, and only open during select hours on weekdays.”

The plaintiff, a resident of Michigan and a small business owner who has worked with Hope College for approximately fifteen years, entrusted his personal information as well as business and tax details to the defendant, the filing explains. In December, he received the official notice informing him that his “business name and tax ID number (EIN) may have been compromised, along with his own personal Social Security number,” the lawsuit says.

Per the case, the plaintiff has suffered “[irreparable] harm” due to the exposure of his private information. The suit charges that “[f]or the rest of his life, [he] will have to worry about when and how his PII, including his Social Security number and business tax number (EIN), may be shared or used to his detriment.”

The lawsuit looks to represent anyone identified by Hope College as among those who were affected by the September 2022 data breach, including those who were sent notice of the breach.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.