H&K Perforating Failed to Prevent 2022 Data Breach, Class Action Says

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims H&K Perforating failed to prevent a March 2022 ransomware attack that compromised the personal and health information of thousands of current and former employees.

The 36-page lawsuit alleges H&K, a perforated metal manufacturer with facilities in Illinois, Pennsylvania and Tennessee, neglected to implement reasonable cybersecurity procedures to protect employees’ sensitive data. The case argues that as a result, cybercriminals were able to gain access to employees’ names, addresses, Social Security and driver’s license numbers, financial accounting and medical information, emails, usernames, passwords and electronic signatures between March 2 and 5 of this year.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

Although H&K discovered the attack on March 5, the company waited five months before alerting affected individuals on August 19, the filing relays. Per the complaint, the company failed to notify its employees in the “most expedient time possible and without unreasonable delay,” as required by Illinois law.

The lawsuit contends that H&K’s notice of the incident was short on specifics.

“[E]ven now, H&K has not definitively concluded the unauthorized intrusion has been blocked from its system,” the case states.

The lawsuit says that the manufacturer has not offered complimentary credit monitoring services to victims, even though they now face a significant, lifelong risk of identity theft and must pay out-of-pocket expenses associated with the fraudulent use of their personal information. 

The plaintiff, a former H&K employee, claims to have experienced a fraudulent charge of $1,000 on his debit card in the spring of 2022, only weeks after the incident concluded. 

“It took Plaintiff’s bank 30-days [sic] to reimburse Plaintiff for the fraudulently debited amount, causing him loss of those funds in the interim,” the lawsuit says. “The Data Breach and resulting identity theft Plaintiff experienced also prevented Plaintiff from timely filing his 2021 tax returns.”

According to the filing, H&K’s network was easy to hack because it failed to maintain an up-to-date cybersecurity strategy, overlooking measures recommended by the U.S. Cybersecurity & Infrastructure Security Agency and the Microsoft Threat Protection Intelligence Team. The case also asserts that the company did not comply with the Federal Trade Commission guidelines for data security.

The lawsuit looks to represent anyone whose personally identifiable information and protected health information was compromised in the data breach disclosed by H&K in August 2022, including those who were sent a notice of the data breach.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.