A proposed class action lawsuit is targeting a community college district in Tempe, Ariz., that allegedly violated several state and federal data protection laws, including waiting too long to notify affected students, alumni and employees after a breach.
According to the lawsuit, filed last week, the Maricopa County Community College District not only failed to prevent a massive data breach in April 2013, it waited nearly seven months to notify the individuals affected.
Administrators of the community college district were notified by the Federal Bureau of Investigation in January 2011 that several of its databases had been breached and were being made available for sale on the Internet, according to a civil lawsuit filed April 15 in the Maricopa County Superior Court in Phoenix.
The lawsuit claims district administrators did nothing to address the breach at the time, and that their inaction resulted in a second breach in April 2013. The lawsuit also accuses the community college district of waiting until November 2013 to notify current and former students, employees and third-party vendors that their personally identifiable information — including names, addresses, Social Security Numbers, personal financial information and benefits information had been accessed and possibly sold on the Internet.
The plaintiff in the case, current MCCC student Jason Liebich, is seeking class action status on behalf of the estimated 2.5 million individuals affected by the April 2013 breach. Mr. Liebich has accused the college district of violating several state and federal data protection and notification laws, and has asked the court for compensatory damages including unlimited compensations for credit monitoring, restoration and identity protection costs.
A second group of plaintiffs notified the school in March of their intent to pursue a similar lawsuit.