Orrick, Herrington & Sutcliffe Data Breach Lawsuit Investigation
Last Updated on August 1, 2023
Investigation Complete
Attorneys working with ClassAction.org have finished their investigation into this matter.
Check back for any potential updates and take a look at our open investigations here. The information on this page is for reference only.
At A Glance
- This Alert Affects:
- Anyone who received a letter indicating that their information may have been exposed in a March 2023 data breach involving global law firm Orrick, Herrington & Sutcliffe, LLP. These letters were reportedly sent out on or around June 30, 2023.
- What’s Going On?
- Attorneys working with ClassAction.org are investigating whether Orrick, Herrington & Sutcliffe, LLP took proper care to protect consumer information and, if not, whether a class action lawsuit can be filed over the data breach.
- How Could a Class Action Help?
- A class action lawsuit could help compensate victims for any harm they’ve experienced as a result of the data breach, such as the cost of identity theft protection services and time lost responding to the incident. It could also force the law firm to improve its data security practices.
Attorneys working with ClassAction.org would like to speak to anyone who received a letter regarding a data breach involving global law firm Orrick, Herrington & Sutcliffe, LLP.
The breach reportedly exposed highly sensitive data, including birthdates and Social Security numbers, of tens of thousands who were enrolled in a certain vision benefits plan that the firm provided services to.
What Happened?
On March 13, 2023, Orrick, Herrington & Sutcliffe, LLP discovered that an unauthorized third party had gained remote access to a portion of the firm’s network, including a file share used to store certain client files.
Upon investigation, it was discovered that the bad actor had obtained files containing the personal information of participants of CHI Vision Plan. The vision benefits plan had previously retained Orrick as legal counsel in relation to a 2020 security event, which is why the law firm had this information in the first place, the data breach notice explains.
According to a letter sent to the Iowa Attorney General, personal information compromised in the breach may include:
- Names
- Addresses
- Dates of birth
- Social Security numbers
- Phone numbers
- Email addresses
- Vision insurance account/identification number
- Health insurance account/identification number
Attorneys are now investigating whether the law firm had appropriate safeguards in place to keep client information private and, if not, whether a class action lawsuit could be filed.
How Could a Lawsuit Help Data Breach Victims?
A class action lawsuit could compensate victims for any damages they’ve incurred as a result of the breach, such as:
- Reimbursement for lost time spent responding to the breach
- Reimbursement for out-of-pocket losses resulting from the breach, such as the cost of identity theft protection and credit monitoring services
- Compensation for loss of privacy
A lawsuit could also force the law firm to implement better data security practices to ensure sensitive information remains protected against future data breaches.
Before commenting, please review our comment policy.