HealthEquity Data Breach Lawsuit Claims HSA Administrator Failed to Protect Data of 4.3M People

New to ClassAction.org? Read our Newswire Disclaimer

HealthEquity, Inc. has been hit with a proposed class action lawsuit over a March 2024 data breach that reportedly impacted the personal information of approximately 4.3 million people.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

According to a notice filed with the Maine Attorney General’s Office, HealthEquity—an administrator of health savings accounts (HSAs) and other employee benefits plans—learned of a “systems anomaly” after receiving an alert on March 25, 2024. Per the notice, a subsequent investigation revealed there had been unauthorized access to sensitive information stored in a data repository outside of the company’s core systems.

The 32-page HealthEquity data breach lawsuit relays that the incident primarily affected sign-up information for accounts and benefits managed by the company, potentially including individuals’ full names, addresses, phone numbers, Social Security numbers, employee IDs, employers, payment card details and general contact information of dependents.

The case contends that the data breach stemmed directly from negligent cybersecurity on HealthEquity’s part. Despite the company’s legal duty to protect stored data from unauthorized disclosure, the defendant failed to fulfill “even its most basic obligations,” the complaint claims.

As the data breach suit tells it, the incident is “extraordinarily troubling” given that HealthEquity was well aware of the value of the sensitive information it apparently failed to protect from cybercriminals.

HealthEquity data breach victims now face a lifelong threat of fraud, identity theft and other illegal schemes and must constantly monitor their financial accounts to guard against such cybercrimes, the filing charges.

The HealthEquity lawsuit looks to represent anyone in the United States whose personally identifiable information and/or private health data was compromised as a result of the cyberattack.

Are you owed unclaimed settlement money? Check out our class action rebates page full of open class action settlements.