Navistar Hit with Class Action Over May 2021 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Navistar, Inc. faces a proposed class action over a May 2021 data breach during which the personal information of current and former employees was reportedly compromised.

The 30-page case alleges the breach, wherein cybercriminals were able to access employee names, Social Security numbers, driver’s license numbers and medical information, was a direct result of Navistar’s “negligent and reckless” failure to implement proper safeguards to protect the sensitive data in its care.

The lawsuit alleges Navistar, the parent company of International-brand commercial trucks and engines, IC Bus-brand school and commercial buses, OnCommand Connection advanced connectivity services and aftermarket parts brands Fleetrite, ReNEWed and Diamond Advantage, has more than 12,000 worldwide employees whose data it has a duty to protect. 

“Defendant maintained the Private Information in a reckless manner,” the complaint alleges. “In particular, the Private Information was maintained on Defendant Navistar’s computer network in a condition vulnerable to cyber-attacks of this type.”

Per the suit, Navistar discovered on May 20, 2021 a “potential security incident” on its IT systems and learned on May 31 that “certain data had been extracted” from its systems. On the same day, data stolen from the defendant was posted on Marketo, a “dark web” marketplace for stolen data, the lawsuit relays.

The case alleges the breach was a result of Navistar’s failure to follow Federal Trade Commission and industry standards in implementing reasonable data security practices and procedures. According to the suit, Navistar was “well aware” of the consequences consumers might face in the event of a data breach yet failed to take proper steps to secure their information.

Moreover, it wasn’t until late September that Navistar began informing certain current and former employees that their data had been compromised, the case says. The lawsuit argues that although Navistar’s notice letters included an offer for a “complementary two-year membership” to a credit monitoring service, this offer is “wholly inadequate” given affected individuals may face “multiple years of ongoing identity theft and financial fraud.”

Aside from financial injury and lost time, those affected by the cyberattack have also been burdened with significant emotional damages, according to the suit:

The lawsuit looks to cover anyone whose personally identifiable information or protected health information was compromised as a result of the cyberattack discovered by Navistar around May 20, 2021 and was sent notice of the data breach.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.