BOSTON (Legal Newsline) - A woman has filed a class action lawsuit against the University of Massachusetts, claiming that her information was included in a data breach that exposed the private data of thousands of patients.
Plaintiff Alana Joseph filed a class action lawsuit in the U.S. District Court for the District of Massachusetts against the University of Massachusetts (UMass) Chan Medical School, alleging negligence, breach of implied contract, breach of implied covenant of good faith and fair dealing, and unjust enrichment.
Her lawsuit claims that the university failed to have proper data security in place, that the stolen information wasn't even encrypted and that the university didn't notify her of the data breach until three months after the incident.
According to the lawsuit, on May 27, the defendant experienced a massive data breach wherein cybercriminals gained access to the private financial information and "personally identifiable information" (PII) of approximately 134,000 users, including the plaintiff. The PII that was exposed in this breach includes users' passwords, social security numbers, dates of birth, and bank account numbers.
Joseph claims that she was unaware of the data breach until she received a letter from UMass informing her of the incident dated August 14 and claims she was unaware that the defendant was even storing her personal data.
The lawsuit claims that UMass had a duty to safeguard the private information of the users of its systems, but that it was negligent in failing to implement adequate and reasonable measures to ensure that users' information was protected and that the stolen data wasn't even encrypted.
Joseph claims that as a result of the defendant's negligence, she has been injured in the form of lost time in dealing with the consequences of the data breach and that she now faces an increased risk of identity theft in the future.
Joseph is seeking money damages for herself and the proposed class, plus court costs, interest, attorney fees, and any other relief the court deems proper. She is also requesting the court issue an order requiring the defendant to encrypt all user data, delete all PII of users, and implement measures to improve user data safety and security.
The plaintiff is represented by attorneys Erica C. Mirabella of Mirabella Law, LLC in Boston and Kevin Laukaitis of Laukaitis Law, LLC, in San Juan, Puerto Rico.
U.S. District Court for the District of Massachusetts case number 4:23-CV-40120-DHH