Waste Management Employee Info Exposed in Data Breach, Class Action Says

New to ClassAction.org? Read our Newswire Disclaimer

Waste Management, Inc. and USA Waste-Management Resources, LLC face a proposed class action lawsuit over their apparent failure to protect sensitive employee information. 

At the center of the 50-page case is a data breach reported by the defendants to have taken place between January 21 and 23, 2021. According to the suit, employee data exposed during the incident, in which an unauthorized party entered the Waste Management system and accessed and took a number of files, includes names, Social Security and driver’s license numbers (or National IDs) and dates of birth. 

Waste Management, the suit alleges, has failed to provide current and former employees with timely notice of the data breach or information on precisely what types of information were unencrypted and in the possession of the perpetrator(s). Its “Notice of Data Breach,” sent to current and former employees around May 28, stated only that Waste Management discovered “suspicious activity in our network environment” and that the company launched an investigation to determine what information may have been contained within the improperly accessed files.

“Defendant WMI boasts that it ‘value[s] safety’ and is one of the ‘world’s most ethical companies,’ yet has failed to meet its obligation to protect the sensitive [personally identifiable information] entrusted to it by its more than 45,000 current and former employees,” the complaint, filed in Texas federal court, says. 

Although the cybersecurity incident took place in January, Waste Management, a leading nationwide provider of waste collection, disposal and recycling services, determined on May 4 and in the weeks that followed that the files potentially accessed by an unauthorized actor contained sensitive information on current and former employees, the case relays. Part of the “bargain” between Waste Management and its workers is that the company would have in place reasonable and appropriate data security measures, in particular given the long-term harm that can result from the exposure of personal information, the lawsuit stresses:

“Part of the bargain of obtaining a job requires turning over to employers valuable PII, including names, Social Security numbers (or National IDs), dates of birth, and driver’s license numbers. Identity thieves can use this highly sensitive information to fraudulently open new accounts, access existing accounts, perpetrate identity fraud or impersonate victims in myriad schemes, all of which can cause grievous financial harm, negatively impact the victim’s credit scores for years, and cause victims to spend countless hours mitigating the impact.” 

According to the suit, Texas-headquartered Waste Management currently employs more than 45,000 workers and has tens of thousands of former employees.

The plaintiffs, former Waste Management employees, say they’ve been forced to spend time dealing with and responding to the direct consequences of the data breach, including exploring credit monitoring and identity theft protection services and self-monitoring each of their accounts. After receiving Waste Management’s data breach notice, each plaintiff spotted an uptick in the amount and frequency of phishing emails they were receiving, in particular related to unwanted car warranties, the suit claims. 

Other than providing what the plaintiffs call a “woefully inadequate” 12 months of credit monitoring to current and former employees, Waste Management does not appear to be taking any other measures to help those affected by the breach, according to the case. 

“This is wildly inadequate especially in light of the fact that some Plaintiffs and Class members worked at WM well over 20 years ago,” the complaint reads. “It begs the question: Why would WM not secure such important and sensitive PII?”

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.