A former employee of Associated Wholesale Grocers has filed a class-action suit against the company alleging that it should have taken more precautions to protect employees’ personal data.
The Kansas City, Kansas-based grocery distributor suffered a data breach in October of 2023 in which hackers stole names, Social Security numbers, and other personal employee information, according to the suit, which was filed by attorneys on behalf of Toriana Patterson, a former employee of one of AWG’s manufacturing companies. The suit claims that Patterson’s stolen personal information was used by thieves to take out loans in her name.
Patterson realized she was the victim of identity theft when she began receiving calls from loan officers and creditors informing her that she owed money on loans that she did not authorize or take out herself, according to the suit.
The suit alleges that AWG did not store the data in an encrypted format and that personal information about the company’s employees might still be vulnerable to hackers. In addition, the suit alleges, the company did not inform employees about the full extent of the breach until April of last year—about six months after it discovered the breach.
The suit claims that 26,579 individuals had their personal information exposed.
“Due to the defendant’s negligence, cybercriminals obtained everything they needed to commit identity theft and wreak havoc on the financial and personal lives of thousands of individuals,” the lawsuit states.
A spokesperson for AWG told Supermarket News that the company does not comment on pending litigation.
AWG has publicly denied the allegations that the employee data on its servers remains at risk, according to the lawsuit.
In addition to seeking class-action status, the suit seeks an injunction against AWG to force it to take steps to safeguard the employee data on its servers. It is also seeking unspecified monetary damages.
Grocer data breach lawsuits
The lawsuit is among several class-action suits that retailers have faced in recent years alleging damages from the theft of personal data. These cases, which have involved the theft of both customer and employee data, include:
