Progressive Hit with Class Action Over Cyberattack Affecting 347K People

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims lax data security practices on the part of Progressive Casualty Insurance Company resulted in a “massive,” years-long data breach that compromised the personal information of roughly 347,100 individuals.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 41-page lawsuit says that on May 19, 2023, Progressive was notified that certain call center representatives employed by a third-party service provider had improperly shared their Progressive access credentials with unauthorized individuals. The unauthorized actors were then able to access the defendant’s network and view the private data of certain customers, the complaint contends.

Per the suit, a subsequent investigation revealed that the information compromised in the breach included at least individuals’ names, addresses, Social Security numbers, driver’s license numbers, and financial details such as account numbers and credit or debit card numbers.

The case alleges that, disturbingly, the breach had been allowed to occur for years “unnoticed and unchecked.” According to the complaint, Progressive reported that its third-party vendor had, at the earliest, hired some of the potentially involved employees in May 2021, though most were apparently hired during or after the fall of 2022.

“Thus, unauthorized individuals had unfettered access to [the plaintiff’s] and the Class’s private information for more than just days or weeks, but likely years (May 2021 through May 2023),” the filing contends.

The lawsuit argues that the cyberattack was a direct result of the insurance company’s failure to take the necessary precautions to safeguard the personal information stored in its network. As the suit tells it, the defendant should have ensured that any third-party vendors it hired had adequate cybersecurity procedures in place to prevent the unauthorized disclosure of sensitive data.

“Due to [Progressive’s] negligence and lack of oversight and supervision, unauthorized individuals obtained everything they needed to commit identity theft and fraud and wreak havoc on the financial and personal lives of hundreds of thousands of individuals,” the case charges.

The complaint also takes issue with the company’s untimely notification of data breach victims. Though Progressive purportedly learned of the incident in May 2023, it did not begin sending notices to affected individuals until early August, nearly three months later, the filing states.

Further, the defendant is reportedly “no stranger to inside data security threats,” as incidents in 2006 and 2015 indicate that “Progressive does not take data security seriously and does little (if anything) to protect customer data,” the lawsuit claims.

The plaintiff, an Illinois resident, received notice on August 1 informing him that his personal information had been compromised in the breach, the suit says. The man claims that, since the incident, he has discovered an unauthorized transaction associated with his bank account and believes the fraudulent activity is related to the Progressive data breach.

The lawsuit looks to represent anyone in the United States who received a notice letter from Progressive informing them that their information may have been compromised in the data breach.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.