Orrick, Herrington & Sutcliffe Data Breach Lawsuit Investigation

Last Updated on August 28, 2024

Investigation Complete

Attorneys working with ClassAction.org have finished their investigation into this matter.

Check back for any potential updates. The information on this page is for reference only.

Free Consumer Tools: 

View List of Lawsuits
→
Comments |

Case Update

July 2, 2024 – Orrick, Herrington & Sutcliffe Data Breach Lawsuits Settled for $8M
Orrick, Herrington & Sutcliffe has agreed to pay $8 million to settle four consolidated class action lawsuits filed over the March 2023 data breach.

The deal received preliminary approval from the court on May 31, 2024, and covers anyone in the United States who was sent notice that their personal information was accessed as a result of the Orrick, Herrington & Sutcliffe cyberattack.

The official Orrick, Herrington & Sutcliffe data breach settlement website can be found at https://www.OHSClassActionSettlement.com/.

For more details on the class action settlement, read ClassAction.org’s write-up about the settlement here.

At A Glance

This Alert Affects:
Anyone who received a letter indicating that their information may have been exposed in a March 2023 data breach involving global law firm Orrick, Herrington & Sutcliffe, LLP. These letters were reportedly sent out on or around June 30, 2023.
What’s Going On?
Attorneys working with ClassAction.org are investigating whether Orrick, Herrington & Sutcliffe, LLP took proper care to protect consumer information and, if not, whether a class action lawsuit can be filed over the data breach.
How Could a Class Action Help?
A class action lawsuit could help compensate victims for any harm they’ve experienced as a result of the data breach, such as the cost of identity theft protection services and time lost responding to the incident. It could also force the law firm to improve its data security practices.

Attorneys working with ClassAction.org would like to speak to anyone who received a letter regarding a data breach involving global law firm Orrick, Herrington & Sutcliffe, LLP.

The breach reportedly exposed highly sensitive data, including birthdates and Social Security numbers, of tens of thousands who were enrolled in a certain vision benefits plan that the firm provided services to. 

What Happened?

On March 13, 2023, Orrick, Herrington & Sutcliffe, LLP discovered that an unauthorized third party had gained remote access to a portion of the firm’s network, including a file share used to store certain client files.

Upon investigation, it was discovered that the bad actor had obtained files containing the personal information of participants of CHI Vision Plan. The vision benefits plan had previously retained Orrick as legal counsel in relation to a 2020 security event, which is why the law firm had this information in the first place, the data breach notice explains.  

According to a letter sent to the Iowa Attorney General, personal information compromised in the breach may include: 

  • Names
  • Addresses
  • Dates of birth
  • Social Security numbers
  • Phone numbers
  • Email addresses
  • Vision insurance account/identification number
  • Health insurance account/identification number

Attorneys are now investigating whether the law firm had appropriate safeguards in place to keep client information private and, if not, whether a class action lawsuit could be filed.

How Could a Lawsuit Help Data Breach Victims?

A class action lawsuit could compensate victims for any damages they’ve incurred as a result of the breach, such as:

  • Reimbursement for lost time spent responding to the breach
  • Reimbursement for out-of-pocket losses resulting from the breach, such as the cost of identity theft protection and credit monitoring services  
  • Compensation for loss of privacy

A lawsuit could also force the law firm to implement better data security practices to ensure sensitive information remains protected against future data breaches.

Before commenting, please review our comment policy.