Credit Control Corporation Facing Class Action Over March 2023 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Debt collection agency R&B Corporation of Virginia, which does business as Credit Control Corporation (CCC), faces a proposed class action after it fell victim to a data breach that occurred between March 2 and 7 of this year.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

According to the 35-page complaint, the data breach was a “foreseeable” result of CCC’s failure to properly safeguard the sensitive data stored on its network, which belongs to its clients’ current and former customers. More specifically, the case claims that CCC failed to implement or adequately train its employees on appropriate data security measures to prevent, detect and stop cyber intrusions.

The lawsuit says that the personal information of 286,699 individuals was compromised during the incident, including their names, addresses, Social Security numbers and information relating to their accounts with CCC’s business partners, such as their account numbers, account balances and dates of service.

The company’s May 12 online notice of the incident says the breach may have impacted the following business partners:

• Sentara Health System;
• Riverside Health System;
• UVA Health System;
• Bayview Physicians Group;
• Pariser Dermatology Specialists, Inc.;
• Valley Health System;
• Dominion Pathology Laboratories;
• Chesapeake Radiology;
• Children’s Hospital of the King’s Daughters Health System and its affiliates;
• VCU Health System;
• Chesapeake Regional Medical Center;
• Mary Washington Healthcare;
• Urology of Virginia;
• Fauquier Health System; and
• Tidewater Physicians Multispecialty Group.

Although CCC says that it became aware of “unusual activity” involving certain systems within its network on March 7 and concluded its investigation of the breach on March 14, the company did not begin to notify victims until May 15, the case states.

The plaintiff, a Virginia resident whose medical debt was purchased by CCC three years ago and then paid in full, says she would have never allowed her personal information to be entrusted to the company had she known it would not be adequately secured. Like other data breach victims, the plaintiff now faces a heightened risk of identity theft and fraud for many years, the complaint stresses.

In fact, the plaintiff claims to have received since the breach a notification that $134 had been fraudulently withdrawn from her Virginia Retirement System account and that the account had been closed by an unauthorized individual. The woman has also received significantly more spam texts and calls since the incident transpired, the complaint says.

“Given the above fraudulent use of Plaintiff’s [personally identifiable information] following the Data Breach, it is obvious that her [personally identifiable information] unauthorizedly disclosed in the Data Breach is now in the possession of cybercriminals and/or on the Dark Web and being utilized for fraudulent and criminal purposes,” the suit reads.

Per the filing, CCC “knew or should have known of these harms which would be caused by the Data Breach they permitted to occur, and strengthened its data systems accordingly.”

The lawsuit looks to cover anyone whose personally identifiable information was compromised as a result of the data breach experienced by Credit Control Corporation beginning on March 2, 2023.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.