Trucking Company Estes Hit with Class Action Over Cyberattack Affecting 21K

New to ClassAction.org? Read our Newswire Disclaimer

Estes Express Lines faces a proposed class action over a cyberattack announced in December 2023 that reportedly compromised the personal information of over 21,000 individuals.

Did you receive a data breach letter from Estes? Let us know here.

According to a notice letter sent to victims, the freight transportation company learned on October 1, 2023 that an unauthorized third party had gained access to parts of its IT network and deployed ransomware. A subsequent investigation revealed that the threat actor had exfiltrated certain data from the affected system, the notice shares.

The 37-page lawsuit alleges that although Estes has so far “refused to disclose” what specific data was exposed and who was affected, the ransomware attack potentially compromised the names, dates of birth and Social Security numbers of the company’s current and former employees, job applicants and/or customers.

The suit claims that the incident stemmed from Estes’ negligent cybersecurity practices and failure to adequately train its employees in data security. As a result of the company’s negligence, individuals’ private information was put in a “vulnerable position” and made an “easy target[] for cybercriminals,” the case contends.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

“It is unknown for precisely how long the cybercriminals had access to [Estes’] network before the breach was discovered,” the complaint says. “In other words, [Estes] had no effective means to prevent, detect, stop, or mitigate breaches of its systems—thereby allowing cybercriminals unrestricted access to its current and former employees, job applicants, and/or consumers’ [personally identifiable information/protected health information].”

The filing further charges that although the defendant claims to have discovered the cyberattack in early October of last year, it waited until December 4—more than two months later—to begin notifying victims. As the lawsuit tells it, the delay deprived impacted individuals of the opportunity to mitigate the harm caused by the unauthorized disclosure of their sensitive data.

The suit looks to represent anyone in the United States whose personal information was compromised in the data breach discovered by Estes Express Lines in October 2023, including individuals who received notice of the incident.

Did you receive a data breach letter from Estes? Let us know here.