CAIRE Failed to Protect Employee Info from Cyberattack, Class Action Alleges

New to ClassAction.org? Read our Newswire Disclaimer

Oxygen supply manufacturer CAIRE Inc. faces a proposed class action over a recently announced data breach that affected at least 2,607 current and former employees.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 46-page data breach lawsuit alleges that CAIRE’s failure to implement adequate cybersecurity measures allowed cybercriminals to infiltrate its computer systems and steal files containing employees’ names and Social Security numbers. According to the complaint, the company detected the intrusion on February 11, 2023, when it noticed “suspicious activity” that impacted “the operability of certain systems.”

“It is unknown for precisely how long the cybercriminals had access to [CAIRE’s] network before the breach was discovered,” the filing says. “In other words, [the defendant] had no effective means to prevent, detect, stop, or mitigate breaches of its systems—thereby allowing cybercriminals unrestricted access to its current and former employees’ [personally identifiable information].”

The case claims the incident has subjected victims to a lifetime risk of identity theft and fraud, given that cybercriminals have already posted, or will soon post, their information on the dark web.

Per the filing, CAIRE deprived affected individuals of the chance to mitigate these threats in a timely manner by waiting more than a year after it purportedly discovered the incident to notify them of the breach.

The plaintiff, a New York resident, says he received a notice letter from CAIRE in early March 2024 informing him that his data was compromised in the cyberattack. The complaint notes that the man was employed by a company now owned by CAIRE from 2009 to 2013, which, according to the suit, means the defendant “negligently retained” his information for no “defensible reason” for over a decade after his employment ended.

Although the company says it has reviewed its data security policies to “reduce the likelihood of a similar future incident,” the filing claims this effort is “too little too late.”

“Simply put, these measures—which [the defendant] now recognizes as necessary—should have been implemented before the data breach,” the case says.

The lawsuit looks to represent anyone in the United States whose personal information was compromised in the data breach discovered by CAIRE in February 2023, including all those individuals who received notice of the incident.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.