Sav-Rx Facing Class Action Over October 2023 A&A Services Data Breach Affecting 2.8M

New to ClassAction.org? Read our Newswire Disclaimer

A&A Services, LLC, which does business as Sav-Rx, faces a proposed class action lawsuit over an October 2023 data breach that reportedly exposed the private information of more than 2.8 million people.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 54-page A&A Services data breach lawsuit says Sav-Rx, which provides medication benefits management services to health plan customers, only recently began notifying affected individuals of a cyberattack that occurred around October 3 of last year.

According to an FAQ page on Sav-Rx’s website, an unauthorized party accessed the defendant’s IT systems and stole data belonging to current and former participants of associated health plans or current and former employees. Full names, addresses, Social Security numbers, and dates of birth were among the information exposed in the breach, the case says.

The data breach lawsuit alleges that the exposure of victims’ information was a direct result of Sav-Rx’s failure to implement reasonable cybersecurity measures. The defendant’s negligence has exposed affected individuals to a heightened risk of identity theft and fraud, the case stresses.

Per the filing, Sav-Rx was fully aware of the risks of a data breach and its obligations to safeguard the personal information in its care under contract law, common law, HIPAA, Federal Trade Commission guidelines and industry standards. Despite the foregoing, the defendant failed to comply with its legal responsibilities regarding data security, the filing asserts.

The suit also takes issue with Sav-Rx’s alleged failure to timely and adequately notify victims that their information had been subject to unauthorized access by nefarious third parties. The defendant’s notice letter—which it began to issue on May 10, 2024—lacked details about the root cause of the incident, which vulnerabilities were exploited and the measures that were taken to prevent future data breaches, the complaint says.

“Without these details, Plaintiff’s and Class Members’ ability to mitigate the harms resulting from the Data Breach is severely diminished,” the filing contends.

The lawsuit looks to represent anyone in the United States whose personal information was accessed and/or acquired by an unauthorized party as a result of the data breach reported by Sav-Rx in May 2024.

Are you owed unclaimed settlement money? Check out our class action rebates page full of open class action settlements.