Class Action Filed Over 2022 Knox College Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Knox College faces a proposed class action over a November 2022 data breach that exposed the personal information of approximately 63,100 current and former students and faculty members.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 32-page case claims that an entity that identifies itself as the Hive Ransomware Group was able to infiltrate the Galesburg, Illinois private liberal arts college’s network on November 24 of last year because the institution failed to implement basic cybersecurity measures.

The complaint says it wasn’t until January 3 of this year that Knox sent out a notice of the data security incident, informing victims that the compromised information may include their names, addresses, dates of birth, and Social Security, driver’s license and passport numbers.

However, days before Knox announced the breach, the ransomware group sent an email to alumni and students claiming it accessed their “medical records, psychological assessments, and many other sensitive data [sic],” the case states. The cybercriminal group also revealed that it possessed proposed class members’ data for “several weeks,” and planned to leak on its website less than 24 hours after the email was sent, the suit relays.

Before this news came to light, however, Knox College emailed alumni on December 8 to inform them that it would be permanently disabling all alumni email accounts by December 10 due to “a system disruption caused by ransomware here at Knox,” the complaint states

The lawsuit contends that after the hackers made themselves known to the community, Knox College “made no effort to confirm or deny the email from the purported ransomware group, nor did it offer any assistance or answer questions from the alumni community about exactly what information had been accessed or infiltrated.” The college has also failed to announce specifics about what measures it has undertaken to ensure a breach like this does not occur again, the filing adds.

Knox College has offered affected individuals 12 months of credit monitoring and identity protection services, but the case argues that these measures hardly make up for the fact that victims are now at risk of identity theft and other fraudulent misuses of their personal information for the rest of their respective lifetimes.

To make matters worse, the complaint claims, the risk of such an attack “was widely known and completely foreseeable to the public and to anyone in Defendant’s industry,” given that data breaches have become a regular occurrence for entities that store personal information. The filing alleges that, despite receiving warnings from the Federal Bureau of Investigation and U.S. Secret Service to safeguard sensitive information, Knox College opted to overlook reasonable and publicly available industry and national best practices for cybersecurity.

“The student newspaper at Knox College has noted that the Data Breach also caused the Registrar and tuition payment portals to be taken down for weeks,” the filing adds.

The lawsuit looks to represent anyone in the United States whose sensitive personal information was compromised in the data breach announced by Knox College on or about January 3, 2023.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.