Lewis & Clark College will pay $500,000 into a special fund to settle a class-action federal lawsuit filed on behalf of about 45,050 people whose personal data was breached in a cyberattack in February 2023.
Each class member who submitted a valid claim could receive up to $5,000 to reimburse documented out-of-pocket losses or a prorated cash award, as well as two years of credit monitoring services.
The class includes all students, staff, employees and alumni whose personal information may have been compromised by the security breach.
Out-of-pocket losses include any costs or expenses resulting from identity theft, falsified tax returns or misuse of personal information, costs associated with freezing or unfreezing credit reports or other expenses related to notary, fax, postage, copying, long-distance phone calls or credit monitoring since Feb. 28, 2023, the earliest verified evidence of the breach.
The suit alleged that the school failed to adequately secure personal data, including the names, dates of birth, Social Security numbers, driver’s license or state identification numbers, passport numbers, medical and health insurance information and financial account and routing numbers.
The college didn’t send individual notices to staff, students, employees and alumni whose personal information had been compromised until more than a year later, the suit alleged.
According to Lewis & Clark’s website, the cybercriminals responsible published “some amount of Lewis & Clark data on the ‘dark web, ’” and first notified the college community of the security breach in March 2023.
In letters to alumni, students and staff sent in April 2024, the college said an “extensive manual review of the data” was then done, and the school determined whose personal information was stolen and was sending notification letters “to each potentially affected individual for whom it has enough information to determine a physical address.”
U.S. Magistrate Judge Stacie F. Beckerman on Monday morning approved the settlementfinding it fair and reasonable.
As part of the settlement, the college denied wrongdoing or liability but determined that the settlement was appropriate to prevent further litigation.
Attorney David W. Schelberg, representing the college, said he did not oppose the agreement.
Attorney Kaleigh Boyd, representing those who sued, urged the judge’s approval of the settlement, calling it “overwhelmingly positive” and said the claims rate of 13%, representing about 5,860 claims, was the “highest claims rate” she has seen in a data breach case.
The claims rate refers to the number of people who were eligible and submitted claims due to the data breach. Typically in such cases, the response rate is 1 to 5 %, Boyd said.
“We are very pleased with the result,” she said. “We had an unusually high amount of interest from the class members.”
She noted that 93% of the people in the settlement class were notified. The money will provide “meaningful monetary and non-monetary relief” for the damages suffered, Boyd said.
A settlement administrator has been assigned to handle claims and set up a toll-free help line to provide class members with additional information about the settlement.
The judge also approved awards of $2,000 for each of the five named plaintiffs: Lisa Unsworth, who worked at the college from 2005 to 2009; Michael Ramone, who graduated from the college in 2003; Christopher Potter, a former visiting physics professor; Charles Sanderson, a 1991 graduate; and Therese Cooper, a former student who last attended in spring 2012.
Beckerman also granted $166,666.67 in fees and costs of $13,311 for the class-action attorneys to be paid.
No criminal charges resulted from the data breach, though some of the named plaintiffs indicated they had experienced some fraudulent activity, Boyd said.
With the approval of the settlement, Beckerman dismissed the civil claims from the lawsuit against the college.
For questions about the settlement, people can contact the settlement administrator at info@lcdatasettlement.com.
— Maxine Bernstein covers federal court and criminal justice. Reach her at 503-221-8212, mbernstein@oregonian.com, follow her on X @maxoregonianon Bluesky @maxbernstein.bsky.social or on LinkedIn.
