Skidmore College Hit with Class Action Over February 2023 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action alleges a data breach experienced by Skidmore College earlier this year was caused, at least in part, by the school’s failure to implement adequate cybersecurity procedures.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

According to the 44-page case, more than 12,000 individuals had their personal information compromised in a cyberattack that targeted the private Saratoga Springs, New York college around February 15, 2023. The lawsuit says that the data breach, which was reportedly discovered two days later, on February 17, exposed students’ and employees’ names, addresses, Social Security numbers, health insurance information and credit or debit card numbers.

Per the complaint, Skidmore waited about seven months after detecting the intrusion to notify the proper authorities and victims. The defendant’s September 15 notice letter specifies that an unauthorized actor gained access to its network, deployed ransomware that encrypted a “small percentage” of its faculty file-sharing system, and stole files containing victims’ private data.

“As a result of Defendant’s delayed response to the data breach, Plaintiff and Class had no idea their [personally identifiable information] had been compromised, and that they were, and continue to be, at significant and imminent risk of identity theft and various other forms of personal, social and financial harm,” the filing says. “The risk will remain for their respective lifetimes because of [the defendant’s] negligence.”

The lawsuit says that although Skidmore had a legal obligation to keep consumers’ information confidential, secure and protected from unauthorized access, it nevertheless failed to comply with industry-standard data security practices. To compound matters, the threat of a data breach was a “known and foreseeable” risk to the college, one that required reasonable cybersecurity measures to prevent, the case contends.

The lawsuit looks to represent anyone in the United States whose personal information was compromised during the data breach that is the subject of the notice letter published by Skidmore College on or about September 15, 2023.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.