Class Action Decries Altice’s ‘Woefully Inadequate’ Response to Nov. 2019 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Altice USA, Inc. is on the receiving end of a proposed class action filed in the wake of a November 2019 data breach that reportedly affected over 12,000 current and former employees, as well as a small number of customers. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.

The lawsuit alleges that the defendant, a cable and internet provider who operates under the Optimum brand, failed to maintain adequate security systems and properly respond to the breach, which the suit says has exposed affected individuals to an ongoing risk of identity theft and fraud.

According to the case, an undisclosed number of current Altice employees fell victim to a phishing campaign in November 2019 that allowed unauthorized parties to gain access to company accounts containing “a treasure trove” of personally identifiable information (PII). The suit alleges one account housed an unencrypted report that may have contained the names, employment information, dates of birth, Social Security numbers and some drivers’ license numbers of “everyone who has ever worked for Altice or an Altice-owned company.” Altice has admitted that, at the least, the private information of the company’s more than 12,000 current employees, and many former employees, were contained in the report, the lawsuit says.

The plaintiff, a former Altice employee, claims a company as large as Altice has no excuse for failing to maintain adequate security systems, and should have known better than to store such sensitive information in unencrypted files.

“No sophisticated business in the 21st century should permit a document containing the PII of all 12,000+ of its current employees to be stored—unencrypted—in company email inboxes,” the complaint scathes. “And reasonable care dictates that a business would dispose of all former employee’s information as soon as it is no longer needed, and until then it should be segregated into an encrypted system, separate from the email servers. None of this information should have been stored in unencrypted documents that were emailed around the company network.”

The lawsuit argues that Altice’s negligence has provided cyber criminals with “everything they need” to open fraudulent accounts, apply for credit, file fraudulent tax returns, steal government benefits, sell fraudulent identification cards and commit various other crimes related to identity theft.

Moreover, the case claims Altice’s offer of one year of free credit monitoring to those affected by the breach is “woefully inadequate” given the compromised information could be used for many years to come.

Lastly, the lawsuit sticks on Altice’s disclosure of the security incident, noting that the company waited until January 2020 before notifying several state attorneys general and beginning to mail out letters to affected individuals. The case says Altice has yet to publicly announce the breach, and claims that had the company disclosed the breach sooner and investigated more diligently, some of the damage “could have been mitigated.”

Are you owed unclaimed settlement money? Check out our class action rebates page full of open class action settlements.