Easterseals-Goodwill Northern Rocky Mountain Responsible for 2021 Data Breach, Class Action Alleges

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action alleges Easterseals-Goodwill Northern Rocky Mountain (ESGW) failed to prevent a month-long data breach in 2021 that compromised the personal information of potentially thousands of current and former employees and clients.

According to the 35-page case, the job skill training nonprofit’s failure to implement adequate cybersecurity measures allowed unauthorized actors to hack certain employee emails between October 12 and November 11 of last year. The breach, which ESGW reportedly discovered on July 20, 2022, exposed confidential employee and client information, including their names and Social Security and driver’s license numbers, the filing relays.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The complaint states that ESGW notified affected individuals of the incident on September 16, months after it discovered the breach. The company’s failure to timely detect and report the data breach left victims “vulnerable to identify theft without any warnings to monitor their financial accounts or credit reports to prevent unauthorized use of their [personally identifiable information],” the case contends.

The filing argues that ESGW’s delayed notice “deliberately underplayed” the severity of the breach, stating that the company was unaware of any reports of misuse of personal information stored in the infiltrated system. It also offered affected individuals limited identity theft protection services and instructions to place a fraud alert on their credit files, the case says.

Per the complaint, these measures will not sufficiently protect breach victims from the long-term threats associated with the exposure of private data, which may be traded on the dark web for months or even years. One plaintiff, a former ESGW employee, claims to have experienced since the incident fraudulent attempts to use her PayPal account to purchase firearms. Another plaintiff, a pseudonymous individual who is currently employed by ESGW, says that an unauthorized actor behind the breach has attempted to use his Visa card and Costco membership to make purchases in the wake of the incident. Both plaintiffs suffered an increase in spam and phishing attempts via phone, text and email, the suit asserts.

As the case tells it, ESGW used outdated computer systems that are “easy to hack” and do not comply with reasonable industry standards for cybersecurity, including the NIST Cybersecurity Framework and the Center for Internet Security’s Critical Security Control. ESGW also overlooked the Federal Trade Commission’s cyber-security guidelines for businesses, the filing claims. 

The non-profit’s negligence “demonstrates a willful and conscious disregard for privacy,” the case charges.

The lawsuit seeks to cover anyone in the United States whose personal information was compromised in the data breach disclosed by Easterseals-Goodwill Northern Rocky Mountain in September 2022.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.