Second lawsuit echoes first, including claims Erie Insurance was negligent in safeguarding personal data in computer network outage. Company calls claims ‘baseless.’
Erie Insurance spokesman explains highlights of new downtown office building
Matthew Cummings, spokesman for Erie Insurance, talks about the company’s new building, which is being dedicated Wednesday.
Jim Martin, Erie Times-News
- Erie Insurance faces a second class-action lawsuit related to a June network outage, a day after the first suit was filed.
- The lawsuit claims Erie Insurance failed to protect sensitive employee data during what plaintiff claims was a “ransomware” attack.
- The plaintiff seeks compensation for damages, improved cybersecurity practices and class-action status.
Just 24 hours after being named in a class-action lawsuit over what a plaintiff claims was a “ransomware” attack, Erie Insurance is now facing a second, nearly identical legal challenge.
The plaintiff in the latest complaint, filed June 16 in federal court in Erie, is Amy Haas, a Wisconsin resident and former Erie Insurance employee. According to the filing, Haas was required to provide the company with a wide range of sensitive personal information — including her Social Security number, driver’s license and financial details ― as a condition of employment.
Like the first lawsuitfiled June 15 in federal court in Erie, by Illinois resident Neal Plascencia, the new complaint claims Erie Insurance failed to implement adequate cybersecurity protections during what the plaintiffs say was a ransomware attack on or around June 7.
Both lawsuits stem from a major network outage that Erie Insurance confirmed on June 8. That outage, whichaffected all systems and left customers locked out of their online accounts, was described by the company as an “information security event” in a June 11 filing with the Securities and Exchange Commission.
While the company is cooperating with law enforcement, it has not confirmed whether the incident was a ransomware attack or whether any data was stolen. Neither lawsuit provides direct evidence that ransomware was involved.
Legal arguments mirror the first lawsuit
The second lawsuit echoes the legal arguments made in the first: that Erie Insurance was negligent in safeguarding personal data, failed to follow federal data protection standards and violated the trust of those who shared their information in confidence. It also claims the company was unjustly enriched by collecting data it didn’t adequately protect and breached an implied contract to keep that data secure.
Matt Barkett, a spokesperson for Erie Insurance, provided the following statement to the Erie Times-News in response to the first lawsuit, which mirrors the second in scope and substance:
“Erie Insurance does not typically comment on pending litigation. However, the allegations made in this complaint are baseless and without merit, and we intend to vigorously defend against them.”
The two lawsuits now filed in rapid succession show how scrutiny is mounting over how the company handled the incident. The lawsuits — and similar ones that could be filed — could still be active in court long after Erie Insurance fixes its network issues.
Class-action lawsuits filed in the same federal district can be consolidated under certain circumstances, according to the federal rules of civil procedure.
What is the new lawsuit seeking?
The second lawsuit is asking the court to certify the case as a class action, allowing Haas to represent a class of individuals whose personal data might have been compromised.
The lawsuit demands a formal declaration that Erie Insurance violated federal and state laws by failing to adequately protect sensitive customer and employee data.The lawsuit also seeks financial compensation, including actual damages for those affected, statutory penalties where applicable and restitution.
The lawsuit further calls for injunctive measures to ensure Erie Insurance strengthens its cybersecurity practices and prevents future breaches. Both plaintiffs are also seeking any additional relief the court deems appropriate to address the harm caused by the data breach.
A.J. Rao can be reached atarao@gannett.com. Follow him on X @Etno.
