Solera Holdings Hit with Class Action Lawsuit Over 2016 Employee Tax Form ‘Data Compromise’

New to ClassAction.org? Read our Newswire Disclaimer

Solera Holdings, Inc. is the defendant in a proposed class action case filed in Florida in which the plaintiff alleges the risk management and asset protection software firm failed to implement reasonable safety measures that could have prevented a 2016 data breach that compromised employee data. 

The lawsuit explains that on April 14, 2017, Solera—which the complaint says operates through subsidiaries AudaExplore, Hollander, Identifix, AutoPoint, DST, LYNX Services, APU and Enservio—sent a letter to current and former employees informing them their 2016 W-2 tax form information had been the subject of “a data compromise.” According to the defendant, the data breach stemmed from a phishing email sent to an employee who, in response, unknowingly provided cyber criminals with data related to proposed class members’ W-2 forms. Specifically, the case continues, the employee reportedly sent the bad actors “an unencrypted data file” that contained either copies of W-2 forms or all of proposed class members’ personal information, including mailing addresses, Social Security numbers, and wage and withholding data. 

The complaint slams Solera for effectively falling for a well-known phishing scheme about which the company’s human resources and accounting departments should have been warned.

“Solera disregarded the rights of [the plaintiff] and class members by intentionally, willfully, recklessly, or negligently failing to take and implement adequate and reasonable measures to ensure that the data it stores was safeguarded, failing to take available steps to prevent the disclosure from happening, and failing to follow applicable, required and appropriate protocols, policies and procedures regarding the encryption of data even for internal use,” the 34-page lawsuit reads, alleging that proposed class members will permanently be at risk of identity theft as a result of Solera’s supposed data protection shortcomings.