A company accused of a data breach that included releasing all W-2s for its U.S. employers to a cybercriminal will soon have to pay a settlement from a class-action lawsuit.
The U.S. District Court for the Eastern District of Pennsylvania approved the settlement agreement reached in the lawsuit against Accolade, Inc., and filed on Sept. 23 by Tashica Fulton-Green and Daniel Crevak on behalf of themselves and others in their situation. The plaintiffs were also awarded attorneys’ fees.
U.S. District Judge Gene E.K. Pratter ruled on the case.
U.S. District Judge Gene K. Pratter
“Because the settlement is fair, reasonable and adequate, the court grants the parties’ motion for final approval, because the proposed attorneys’ fees are reasonable, the court grants class counsel’s motion for attorneys’ fees,” Pratter stated in her ruling.
The settlement agreement allowed class members to join an identity theft protection program for two years via Experian’s ProtectMyID. Those who were already enrolled were told how they could extend their membership by 24 months.
Class members were also allowed to request reimbursement for a total of $1,500 each. But participants had to spend at least one hour handling the theft of their personal information before they could claim their time was lost.
The class was also awarded $300,000 in attorneys’ fees and $5,000 for reimbursement of reasonable costs and expenses, along with $1,000 service awards for Crevak and Fulton-Green.
Accolade’s legal issues began in January 2017 when it became the target of a phishing scandal. A cybercriminal asked for W-2s for current and previous employees in the U.S., and a worker with the company sent over the unencrypted files in an email.
The W-2s included extremely private information from names and addresses to social security numbers and salaries, along with the taxes withheld for 2016. Fulton-Green and Crevak’s PII (personally identifying information) was also a part of the breach.
They filed the class action for negligence, negligence per se, breach of implied contract and breach of fiduciary duty. They reached a settlement agreement that the court has now approved.