Syracuse University Hit with Class Action Over Sept. 2020 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Syracuse University faces a proposed class action over its apparent failure to safeguard thousands of individuals’ personal information from unauthorized access.

The lawsuit centers on a September 2020 data breach during which cybercriminals, in a successful “phishing” attempt, reportedly gained unauthorized access to an employee email account that allowed them to then access the personal information of upward of 9,800 students, alumni and applicants. According to the case, the breach, which saw the exposure of individuals’ names, dates of birth, Social Security numbers, financial information and other personal data, was a direct result of Syracuse University’s failure to implement reasonable data security procedures and protocols.

The university’s failure to safeguard the data with which it was entrusted has exposed affected individuals to a heightened risk of identity theft and fraud, the lawsuit alleges, emphasizing that unauthorized access to someone’s private information can allow a cybercriminal to “ransack the victim’s life.”

According to the case, the breach of students, alumni and applicants’ information followed a successful “phishing” attempt whereby hackers were able to access a Syracuse employee’s email account between September 24 and 28, 2020. Despite representing to students and applicants that their details would be kept safe, Syracuse allegedly failed to honor its obligation to protect the information, including by failing to maintain an adequate data security system, monitor its system for intrusions and ensure that anyone with access to the data followed reasonable security procedures.

The suit goes on to allege that the defendant “compounded the actual and potential harm” to those whose information was compromised by waiting until February 2021, more than four months after the breach was discovered, to send notification letters to those affected. Per the suit, this “unjustified delay” prevented the victims from being able to mitigate the effects of the breach.

The lawsuit further claims that the purported relief offered to those affected is inadequate to compensate them for the harm they’ve suffered. According to the case, the notification letter sent to data breach victims contained an offer for “only a single year” of free credit monitoring services and allowed recipients an “unreasonably short window of opportunity” to claim the offer, which was available until only April 4.

“Conspicuously absent” from the notification letter, the case says, was an offer of compensation for out-of-pocket losses incurred by those whose information was unlawfully accessed. The plaintiff claims to have experienced an unauthorized charge on his checking account in July 2021 that required him to spend time and effort resolving the issue and waiting for a replacement debit card from his bank.

The case, which was initially filed in Onondaga County, New York Supreme Court on September 2 before being removed to the state’s Northern District Court on September 29, 2021, looks to cover anyone whose sensitive information that was provided to Syracuse University as part of the school’s application or enrollment process was exposed to unauthorized access through the September 24, 2020 data breach.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.