Bayer Heritage Federal Credit Union Data Breach Lawsuit Claims 61K Impacted by Cyberattack

New to ClassAction.org? Read our Newswire Disclaimer

Bayer Heritage Federal Credit Union faces a proposed class action lawsuit that alleges the sensitive personal and medical information of more than 61,000 people was stolen in a data breach last fall. 

Did you receive a data breach notice from Bayer Heritage Federal Credit Union? Let us know here. 

The 46-page Bayer Heritage Federal Credit Union data breach lawsuit says that the company became aware around October 31, 2023, that an unauthorized party had accessed its computer systems. Upon investigation, Bayer Heritage learned that its network and servers were hit by a cyberattack and that files were accessed without permission from October 31 through November 1, 2023, the case says. 

According to the data breach lawsuit, information compromised and exfiltrated in the “foreseeable” incident included names, Social Security numbers, dates of birth, driver’s license and/or state ID numbers, passports, direct deposit bank details and likely more.  

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here. 

The case accuses West Virginia-based Bayer Heritage of negligently and recklessly storing consumers’ sensitive information in a manner “vulnerable to cyberattacks” and failing to timely notify victims that their apparently unencrypted data had been accessed without authorization. 

“Plaintiffs and Class Members’ identities are now at risk because of Defendant’s negligent conduct because the Private Information that Defendant collected and maintained is now in the hands of data thieves,” the suit states. 

Although the Bayer Heritage data breach notice stated that the incident occurred last fall, the company nevertheless waited until January 2024, nearly three months later, to begin notifying victims, the lawsuit stresses. Bayer Heritage’s notice letter notably failed to detail the root cause of the cyberattack and the measures the credit union would take to ensure such an incident does not happen again. 

“To date, these critical facts have not been explained or clarified to Plaintiffs and Class Members, who retain a vested interest in ensuring that their Private Information remains protected,” the suit reads, calling Bayer Heritage’s data breach notice “no real disclosure at all” given the lack of specificity on critical facts about the hack. 

Per the complaint, Bayer Heritage failed to properly implement basic data security measures to protect against unauthorized access and failed to comply with applicable industry cybersecurity standards, which “open[ed] the door to the cyber incident” and caused the data breach. 

The lawsuit looks to cover all persons in the United States whose private information was maintained on Bayer Heritage Federal Credit Union’s computer systems and network that were compromised in the data breach announced by Bayer Heritage in January 2024. 

Did you receive a data breach notice from Bayer Heritage Federal Credit Union? Let us know here.