New Enchantment Group Hit with Class Action Over October 2022 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims New Enchantment Group, LLC (NEG) is responsible for an October 2022 data breach that reportedly impacted thousands of current and former employees.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 47-page case more specifically alleges that NEG, which develops and manages resorts, spas and golf courses, was negligent in maintaining employees’ private information and failed to take necessary steps to secure the data from cyber intrusions. Consequently, an unknown third party infiltrated the company’s system between October 3 and 4 of last year and gained unrestricted access to files containing the personal data of 5,568 employees, the complaint contends.

According to the suit, the exposed data included employees’ Social Security numbers, names, driver’s license numbers, health insurance information, and financial account numbers or credit/debit card numbers with security codes, access codes, passwords or PINs.

Although the company claims to have discovered the incident as early as October 4, NEG did not begin issuing notice letters to affected individuals until around February 23, the case says. To make matters worse, NEG revealed in April 2023 that data thieves had stolen additional documents during the cyberattack, leading to another batch of notice letters from the company on May 6, the suit states.

The lawsuit stresses that those affected by the breach now face “a lifetime risk of identity theft,” given that their personal information was unlawfully acquired and possibly sold on the dark web. Per the filing, NEG’s “measly” offer of one year of credit monitoring does not make up for the long-lasting repercussions caused by its failure to properly secure and encrypt its servers. 

What’s more, the harm done to victims has been exacerbated by NEG’s slow disclosures of the incident, the first of which “deliberately underplayed” the severity of the intrusion and omitted pertinent details about the breach, the case contends.

“Plaintiff and the Class Members remain, even today, are [sic] in the dark regarding what particular data was stolen, the particular ransomware used, and what steps are being taken, if any, to secure their Private Information going forward,” the complaint reads.

The lawsuit looks to cover anyone in the United States that New Enchantment Group identified as a person impacted by the data breach—including anyone that was sent a data breach notice letter by the company. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.