Americold Hit with Class Action Over Late-2020 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims Americold Realty Trust failed to adequately protect current and former employees’ private information from a late-2020 data breach.

The 39-page lawsuit alleges the breach occurred between October and November of last year as a result of the cold-temperature supply chain giant’s “negligent and/or careless acts and omissions,” and was made worse by Americold’s decision to wait until earlier this month before notifying those who were affected.

“As a result of this delayed response, Plaintiff and Class Members had no idea their [personally identifiable information] had been compromised, and that they were, and continue to be, at significant risk of identity theft and various other forms of personal, social, and financial harm,” the complaint states. “The risk will remain for their respective lifetimes.”

Atlanta-based Americold describes itself as “the leader in providing technology-based engineered solutions for the temperature-controlled supply chain industry,” and employs nearly 13,000 workers, the case begins. Employees, according to the suit, relied on “this sophisticated Defendant” to keep their confidential personal information safe, restrict its use to business purposes and make only authorized disclosures of the data.

Despite its duty to protect employees’ information by utilizing “reasonable security procedures and practices,” Americold allegedly failed to prevent a ransomware attack from occurring between October 29 and November 16, 2020, during which the personal information of roughly 140,000 current and former employees and their beneficiaries was compromised. Per the suit, the information exposed to unauthorized third parties included individuals’ names; Social Security numbers; dates of birth; government-issued ID numbers; financial account numbers; credit and debit card numbers; passwords and login credentials; digital signatures; mothers’ maiden names; birth certificates; biometric information; and medical or health insurance information.

Despite discovering the breach in mid-November, the defendant waited until early March 2021 to inform those affected, according to the lawsuit. The case claims, however, that the data breach notices left out material information, including the root cause of the breach, the vulnerabilities exploited by the hackers, and the measures undertaken to ensure another breach does not occur.

According to the case, the breach was caused by Americold’s failure to implement reasonable security measures, including a number of measures recommended by government agencies and industry experts. The suit argues that the defendant could have prevented the breach by properly securing and encrypting the personal information entrusted with which it was entrusted, or simply destroying the data from former employees and their beneficiaries. The ramifications of the breach on proposed class members will be “long lasting and severe,” the lawsuit says.

“Once [personally identifiable information] is stolen, particularly Social Security numbers, fraudulent use of that information and damage to victims may continue for years,” the complaint reads.

The lawsuit looks to represent anyone whose personally identifiable information was compromised in the data breach that is the subject of the March 4, 2021 notice sent to the plaintiff, as well as a proposed subclass of current and former Americold employees who had contracts related to the personally identifiable information that was compromised in the breach.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.