Class Action Filed in Wake of A. Duda & Sons Ransomware Attack

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit alleges A. Duda & Sons Inc. failed to safeguard consumers’ personally identifiable information from a ransomware attack in June and July 2022. 

According to the 49-page suit, the data breach exposed personal information provided to the defendant and subsidiaries Duda Farm Fresh Foods, Duda Ranches, DUDA Commercial Properties, the Viera Company, Viera Builders and Duran Golf Club.

Per the case, the data compromised in the incident was “varied and substantial” and may have included consumers’ full names; Social Security and employee ID numbers; payroll data; financial information; dates of birth; email and physical addresses; telephone numbers; and employee dependent information.

The lawsuit says Duda’s failure to protect consumers’ data from unauthorized access has exposed victims to an “imminent risk of fraud and identity theft.”

Per the complaint, the defendant revealed around August 3, 2022 that in June and July, an unauthorized actor had used “sophisticated security exploits” to gain access to the company’s computer systems and, on July 9, deployed ransomware that encrypted most of the defendant’s network. Duda further relayed that the cybercriminals had downloaded files from its systems that contained personally identifiable information, the suit says.

The lawsuit shares that the data breach notice sent to victims failed to state whether Duda had contained or ended the ransomware threat, “leaving victims to fear whether the [personally identifiable information] that DUDA continues to maintain is secure.” Moreover, although the defendant’s systems were compromised in June, consumers whose information was affected were not notified until August, the suit says.

The case additionally claims that Duda has failed to disclose “the exact dates of the breach” and how it occurred.

“All of this information is vital to victims of a data breach, let alone a data breach of this magnitude due to the sensitivity and wide array of information compromised in this specific breach,” the complaint contends.

The lawsuit goes on to claim that Duda has done “next to nothing” to protect data breach victims or compensate them for the unauthorized disclosure of their personal information. Per the case, Duda’s offer of two years of identity monitoring services is “inadequate” to protect victims from the many years of risk they will face, and “places the burden squarely on [victims]” by requiring them to expend time and effort signing up for the service and addressing any issues.

The lawsuit looks to represent anyone Duda has identified as among those who were impacted by the data breach, including individuals who were sent notice of the breach.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.