Class Action Says ‘Wealth’ of General Electric Employee Info Compromised in Feb. 2020 Canon Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

General Electric Company (GE) and contracted employee document processor Canon Business Process Services are on the receiving end of a proposed class action centered on a February 2020 data breach affecting potentially hundreds of thousands of current and former GE workers.

The plaintiff, a former GE employee, alleges the data breach was the result of the defendants’ failure to implement adequate and reasonable security measures necessary to protect sensitive and personally identifiable information. 

According to the 43-page case, GE learned in February 2020 that Canon, who processes and stores documents for current and former GE employees entitled to benefits, was involved in a data security incident. The case says that between roughly February 3 to 14, an “unauthorized party” gained access to a Canon employee’s email account that contained documents pertaining to certain GE workers, former workers and beneficiaries. The unauthorized party was allegedly able to access what the case describes as “a wealth” of GE employee data, including details of:

• Direct deposit forms;
• Driver’s license numbers;
• Passports; 
• Birth, marriage and death certificates;
• Medical child support orders;
• Tax withholdings; 
• Beneficiary designation records;
• Applications for retirement, severance and death benefits; and
• Names, addresses, Social Security numbers and dates of birth.

The lawsuit argues that although GE claimed to maintain employee data in step with industry standards, this representation “was belied by its failure and the failure of its agent, Canon,” to have in place requisite safeguards. General Electric and Canon, the complaint says, maintained proposed class members’ data in a “reckless manner,” in particular in that such was housed on Canon’s computer network “in a condition vulnerable to cyberattacks.” The suit claims the mechanism by which the hackers accessed current and former GE employees’ data was “a known risk” to the companies, who were thus on notice with regard to their apparent data protection shortcomings.

In addition, the case claims Canon and its employees were negligent in failing to properly monitor the computer systems and network in which the compromised GE employee information was contained.

“Had Canon properly monitored its property, it would have discovered the intrusion sooner,” according to the complaint.

As a result of the data breach, proposed class members, the suit claims, have been exposed to a heightened risk of fraud and identity theft for which they may incur out-of-pocket expenses related to credit monitoring and identity protection. The lawsuit argues that although GE and Canon have offered those affected by the data breach 24 months of credit monitoring at no cost, such is “wholly inadequate,” and shifts the burden of the defendants’ conduct onto proposed class members, given current and former GE employees face potentially years of ongoing identity theft.