Nuclear Research Facility Idaho National Laboratory Facing Data Breach Lawsuit Over Nov. 2023 Cyberattack

New to ClassAction.org? Read our Newswire Disclaimer

Idaho National Laboratory (INL) faces a proposed class action over a November 2023 cyberattack that reportedly compromised the private data of at least 45,000 people.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 62-page lawsuit says that the Idaho facility, which conducts nuclear and renewable energy research, was informed on November 20 of last year that a “cyber data breach” had occurred the day before at an off-site data center that stored information related to current and former INL employees and their spouses and dependents.

The suit relays that the sensitive data exposed as a result of the unauthorized network access varied by individual but may have included full names, dates of birth, home addresses, Social Security numbers, email addresses, salary information, financial account numbers and banking details. The cyberattack also may have compromised certain payroll information for current and former employees and retirees, the data breach lawsuit adds.

The complaint points out that the incident did not affect INL’s own systems or other networks or databases used by workers, customers or contractors.

Although INL—one of the national laboratories of the U.S. Department of Energy—had a duty to safeguard the personal data in its care, the research facility negligently failed to take reasonable cybersecurity measures to protect the information from unauthorized disclosure, the filing alleges. The highly confidential information entrusted to INL was stored “unencrypted, unprotected, and vulnerable to acquisition” in its network, the lawsuit contends.

The suit further charges that despite learning of the incident on November 20, 2023, the lab did not begin to inform victims until mid-December of last year. The case argues that this delay deprived impacted individuals of the opportunity to take early action to mitigate the harms caused by the unauthorized disclosure of their private data.

The complaint also asserts that the Idaho National Labs notice letter lacked critical details about the incident, such as how cybercriminals were able to gain entry, what steps are being taken to secure stored data in the future and, most importantly, whether the stolen information remains in the hands of data thieves.

The lawsuit looks to represent anyone whose personal information was compromised in the data breach that is the subject of the notice letter INL sent to impacted individuals on or around December 12, 2023.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.