Unum Group Responsible for 2023 Data Breach, Class Action Alleges

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims that Unum Group’s failure to safeguard the personal information stored within its network resulted in a data breach that occurred between May 31 and June 1 of this year.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

According to the 51-page case, the insurance services provider revealed on August 3 that it had been affected by a cyberattack perpetrated against MOVEit Transfer, a third-party software application it uses to transfer data. The lawsuit claims that during the incident, an unauthorized party exploited a security vulnerability in the software and copied data belonging to former and current customers of Unum’s subsidiary insurance companies.

The complaint alleges that potentially thousands of individuals have had their private information exposed, including their names; dates of birth; addresses; Social Security or individual tax identification numbers; and medical, health insurance claim and policy information. The breach also involved financial information and other government-issued identification numbers for a “limited number of individuals,” Unum’s notice letter states. 

As the suit tells it, Unum “disregarded the rights of Plaintiff and Class Members” by failing to properly encrypt or redact files and file servers containing consumers’ private information. The filing also argues that Unum had a legal duty to audit, monitor and verify the security practices of its IT vendors and affiliates.

In fact, the case claims, the defendant was obligated under the Federal Trade Commission Act, the Health Insurance Portability and Accountability Act (HIPAA), industry standards and contractual promises to keep consumers’ data confidential by implementing reasonable cybersecurity measures.

The plaintiff, a Florida resident who received notice from Unum that her personal information was involved in the MOVEit data breach, claims that cybercriminals have likely sold her data on the dark web. Like other victims, the plaintiff now faces a “present and continuing risk” of identity theft and fraud and must pay out-of-pocket expenses associated with preventing, detecting and recovering from the misuse of her information, the complaint says.

The filing further chides Unum for its alleged failure to timely and accurately notify affected individuals of the breach. Although the company claims to have detected “suspicious activity” involving an instance of its MOVEit Transfer application on June 1, it waited more than two months to report the incident to proposed class members, the case says, noting that the letter omitted details about the root cause of the breach and the remedial measures the company has taken to prevent a future attack.

“This ‘disclosure’ amounts to no real disclosure at all, as it fails to inform, with any degree of specificity, Plaintiff and Class Members of the Data Breach’s critical facts,” the suit claims. “Without these details, Plaintiff’s and Class Members’ ability to mitigate the harms resulting from the Data Breach is severely diminished.”

The lawsuit looks to cover anyone in the United States whose private information was disclosed in the data breach announced by Unum Group.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.