Class Action Suit Filed in College BreachLatest in a Series of Complaints Tied to Arizona Incident
Maricopa County Community Colleges District in Arizona now faces a fifth lawsuit over a data security incident that potentially affected 2.5 million current and former students, faculty and staff. MCCCD operates 10 community colleges.
See Also: HIPAA Audits: A Revised Game Plan
The college district first reported the incident in November 2013, providing scant details, according to local news reports.
"This was a situation when we looked at the security of our data [and] we found it wasn't what it should have been," Tom Gariepy, spokesperson for MCCCD, told Information Security Media Group, declining to provide more information. "As a result, we sent out notification, including [an offer of free] credit monitoring, to about 2.5 million people."
Gariepy says MCCCD doesn't know if unauthorized individuals ever reviewed or took any information that may have been exposed as a result of the security issues.
For employees, names, birth dates, benefits information and Social Security numbers could have been compromised, Gariepy says. For students, names, birth dates, academic records and, in some cases, Social Security numbers were potentially exposed.
In the latest legal action stemming from the incident, a class action lawsuit was filed in Maricopa County Court April 15 on behalf of Jason Liebich, a current student at Phoenix College, one of MCCCD's community colleges. The suit, filed by the law firm Hagens Berman Sobol Shapiro LLP, alleges MCCCD failed to notify impacted individuals immediately and neglected to put sufficient security measures in place regarding sensitive information.
"The MCCCD data breach could have been prevented," the suit claims. "In January 2011, MCCCD was specifically warned by the FBI that several of its databases had been breached and made available for sale on the Internet. MCCCD employees were independently aware of this security breach at the time. Even though MCCCD was aware of the breach, it failed to implement any changes or take any actions to secure those databases. This failure to act resulted in a second breach in 2013."
Liebich is suing MCCCD for negligence and breach of contract. The suit seeks unspecified damages; it asks for MCCCD to pay appropriate compensatory damages, including credit monitoring credit restoration and identity protection, as well as punitive damages.
Gallagher and Kennedy, a Phoenix, Ariz.-based law firm, has filed four other legal claims against the college district.
On March 25, the law firm sent MCCCD a notice of individual and class-action claims over the breach. The complaint, sent on behalf of an unnamed plaintiff who allegedly was a victim of identity theft, proposes a settlement of $24,000. "Absent such a settlement, we intend to file suit not only on behalf of claimant, but on behalf of the entire class of persons whose private, personal, confidential information was accessed without authorization," the lawsuit states.
On March 18, Gallagher and Kennedy filed a complaint in Maricopa County Court over the MCCCD's "complete failure to produce public records as required under Arizona's Public Records Law."