Georgia Law Firm to Blame for Data Breach Affecting 19K People, Class Action Says

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit claims negligence on the part of law firm Smith, Gambrell & Russell International resulted in a “massive and preventable” data breach that compromised the personal information of over 19,000 people.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 40-page lawsuit says the Atlanta firm—which supports Aaron’s, a retailer of furniture, electronics and appliances—failed to protect consumers’ data from cybercriminals who the defendant purportedly learned infiltrated its network servers on August 9, 2021. The suit relays that the personal information of around 19,322 adults and children was compromised in the cyberattack, and included consumers’ full names and Social Security and driver’s license numbers.

As the case tells it, the breach was a direct result of the law firm’s failure to implement adequate cybersecurity measures to protect the private data stored in its servers, data which Smith, Gambrell & Russell allegedly left “unprotected.”

The complaint also takes issue with the defendant’s “unreasonable” delay in notifying victims of the breach. Although the firm claims to have discovered the unauthorized access in early August 2021, it was not until approximately a year later, in August and September 2022, that it began to provide notice to affected consumers, the filing shares.

The lawsuit alleges that this lengthy delay prevented victims from taking active steps to secure their personal information further.

What’s more, the notices themselves included little more than basic details about the incident, leaving victims “in the dark” with regard to what precise data was stolen, how the hackers gained access, and what steps are being taken to protect their personal information in the future, the suit contends.

Victims of the data breach have been “left to speculate as to where their [personal information] ended up, who has used it and for what potentially nefarious purposes,” the case states.

By collecting and storing consumers’ private data, the defendant had a legal duty to safeguard it from unauthorized disclosure, and as a “large, sophisticated organization with the resources to deploy robust cybersecurity protocols,” the law firm should have implemented the stringent measures required to uphold its data-protection obligation, the complaint charges.

The plaintiff, a Georgia resident and Aaron’s customer, received notice of the data breach in a letter dated September 8, 2022, informing her that her personal information had been compromised in the cyberattack, the filing says. Like other victims, the plaintiff now faces a substantially increased risk of fraud, identity theft, and other illegal schemes as a result of the defendant’s alleged negligence, the case claims.

The lawsuit looks to represent anyone in the United States whose personal and/or financial information was exposed to unauthorized third parties as a result of the data breach discovered by Smith, Gambrell & Russell International in August 2021.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.