Saint Louis University Facing Class Action Over Months-Long Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Saint Louis University (SLU) faces a proposed class action over a months-long data breach that reportedly affected over 93,000 current and former patients, employees and students.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 40-page data breach lawsuit says that the Missouri-based private research university and affiliated hospital in early March 2023 detected “suspicious activity” involving SLU email accounts. An investigation revealed that certain email accounts and documents on SLU’s SharePoint and OneDrive platforms had been subject to unauthorized access on various occasions between December 2022 and July 2023, the complaint shares.

According to an online notice posted by SLU, the cyberattack may have compromised individuals’ names, Social Security numbers, driver’s license numbers, financial account information, passport numbers, online credentials, dates of birth, health insurance information, medical information and student record details.

The filing argues that the SLU data breach stemmed from the university’s failure to implement adequate and reasonable cybersecurity measures, such as encrypting consumers’ sensitive data or deleting it when it was no longer needed. Per the case, SLU neglected its legal duty to keep the private information of its patients, employees and students confidential despite the known risk of a data breach.

“Data thieves regularly target entities in the healthcare industry like [the defendant] due to the highly sensitive information that they maintain,” the complaint says. “[The defendant] knew and understood that unprotected private information is valuable and highly sought after by criminal parties who seek to illegally monetize that private information through unauthorized access.”

The suit claims that SLU’s negligence has placed victims at a “lifetime risk” of identity theft and fraud.

The plaintiff, a patient of Saint Louis University Hospital who received a data breach notice letter from the defendant in December 2023, now anticipates spending considerable time and money to try to address the harms caused by the cyberattack.

The lawsuit looks to represent anyone whose personal or health information was accessed or acquired by an unauthorized party in the Saint Louis University data breach, including all who were sent notice of the incident.

Are you owed unclaimed settlement money? Check out our class action rebates page full of open class action settlements