Deloitte Faces Heat Over Unemployment System Data Breach

By Danielle Nichole Smith
Law360 is providing free access to its coronavirus coverage to make sure all members of the legal community have accurate information in this time of uncertainty and change. Use the form below to sign up for any of our daily newsletters. Signing up for any of our section newsletters will opt you in to the daily Coronavirus briefing.

Sign up for our Cybersecurity & Privacy newsletter

You must correct or enter the following before you can sign up:

Select more newsletters to receive for free [+] Show less [-]

Thank You!



Law360 (June 1, 2020, 3:14 PM EDT) -- Deloitte Consulting LLP has been hit with a proposed class action in New York federal court accusing the company of dropping the ball on securing personally identifiable information for those applying for benefits under the federal Pandemic Unemployment Assistance program.

According to the Friday complaint, Deloitte contracted with state governments, including Colorado, Illinois and Ohio, to create web-based portals to help administer the Pandemic Unemployment Assistance, or PUA, program, which is meant to assist certain workers usually ineligible for unemployment benefits.

However, when the company's cloud-based PUA portal went live in May, it didn't have the "appropriate safeguards" for protecting applicants' personally identifiable information, or PII, the suit said. Melissa Alexander, the Ohio resident behind the proposed class action, brought claims against Deloitte for negligence, breach of contract and unjust enrichment.

"Because of defendant's failure to exercise due care, members of the public were able to access unemployment applicants' PII, including Social Security numbers," the complaint said. "As a result, plaintiff and the class members have been injured through the loss of control of their PII, the need to take appropriate steps to mitigate their injury and the heightened and imminent risk of identity theft or fraud."

A reported 130,000 people in Ohio and and 72,000 people in Colorado were affected, according to the suit. And although the exact number of individuals affected in Illinois hasn't been disclosed, 44,000 applied for benefits through the state's portal the first day it was open, and the number of applicants since then is "likely substantially higher," the complaint said.

Alexander, who is looking to represent a nationwide class of PUA applicants whose data was compromised, as well as a class of Ohio residents, said they will have to spend "substantial amounts of time and expense" trying to mitigate the fallout of the data breach.

"As a direct and proximate result of defendant's inadequate data security practices — in particular, making communications through the PUA portal, including applicants' PII, publicly available to other applicants — plaintiff and the class members have sustained a concrete injury," the suit said.

The complaint noted that Deloitte is providing 12 months of free credit monitoring for all the PUA applicants in the three states. The suit seeks, among other things, compensatory damages and equitable disgorgement and restitution.

Counsel for Alexander and a representative for Deloitte didn't immediately respond to requests for comment Monday.

Alexander is represented by Katherine M. Aizpuru and Hassan A. Zavareei of Tycko & Zavareei LLP, Melissa S. Weiner and Joseph C. Bourne of Pearson Simon & Warshaw LLP and Jeff Ostrow and Jonathan M. Streisfeld of Kopelowitz Ostrow Ferguson Weiselberg Gilbert.

Counsel information for Deloitte wasn't immediately available Monday.

The case is Alexander v. Deloitte Consulting LLP, case number 1:20-cv-04129, in the U.S. District Court for the Southern District of New York.

--Editing by Stephen Berg.

For a reprint of this article, please contact reprints@law360.com.

View comments

Attached Documents

Useful Tools & Links

Related Sections

Case Information

Case Title

Alexander v. Deloitte Consulting, LLP


Case Number

1:20-cv-04129

Court

New York Southern

Nature of Suit

Contract: Other

Judge

Lewis J. Liman

Date Filed

May 29, 2020

Law Firms

Companies

Government Agencies

Hello! I'm Law360's automated support bot.

How can I help you today?

For example, you can type:
  • I forgot my password
  • I took a free trial but didn't get a verification email
  • How do I sign up for a newsletter?
Beta
Ask a question!