TIC International Corporation Facing Class Action Over 2022 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

TIC International Corporation faces a proposed class action over a 2022 data breach that reportedly exposed the personal and health information of 187,341 current and former benefit fund participants.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 41-page case alleges the benefit fund administrator could have prevented the ransomware attack, which began on March 30 last year and continued undetected for months, had it employed adequate cybersecurity measures to properly safeguard fund participants’ information. To add insult to injury, TIC waited nearly six months after the breach began to notify victims that their names, addresses, Social Security numbers, dates of birth and protected health information had been accessed and exfiltrated from its systems, the suit says.

Even worse, TIC opted to maintain deficient data security measures at a time when data breaches are “alarmingly commonplace” and applicable industry standards for cybersecurity are publicly available and relatively inexpensive to implement, the suit stresses.

According to the complaint, TIC was “completely unaware” that a ransomware group known as Conti had “uninhibited” access to its servers until the group caused a system disruption by encrypting files stored in the company’s network. “It is unknown whether TIC made a ransom payment to the Conti group,” the suit adds.

Although the company claims in its September 2022 notice to victims that it was “not aware of the misuse of any potentially affected individuals’ information,” the case contends that Conti has posted the compromised data on the dark web. The filing stresses that such unauthorized disclosures put affected individuals at an “ongoing and imminent” risk of identity theft and financial fraud that cannot be sufficiently remediated by the one year of credit and identity monitoring TIC has offered victims.

Moreover, the complaint says that TIC has “placed the burden of protecting against fraud and dealing with the risk of the Data Breach on Plaintiffs and Class members by creating a laundry list of burdensome and expensive tasks for them to undertake,” including monitoring their accounts, reporting fraud, and placing security freezes and fraud alerts on their credit reports,  in order to keep their data safe.

One of the plaintiffs, a fund participant from Michigan, says that in the late spring or summer of 2022, an unauthorized actor attempted to purchase a $1,000 Best Buy gift card using his information, and an unknown actor had an auto part shipped to his address. The plaintiff also claims to have received more spam texts and phone calls since the incident occurred.

Not only did TIC fail to honor its express and implied promises to safeguard consumers’ personal information, the company also did not meet its obligations under the Health Insurance Portability and Accountability Act (HIPAA) to properly maintain the security of its participants’ data, the filing says. 

The lawsuit looks to cover any Indiana citizen whose personally identifying information or personal health information was compromised in TIC International Corporation’s data breach.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.