Savannah College of Art and Design Hit with Class Action Over 2022 Data Breach Affecting Alumni, Employees

New to ClassAction.org? Read our Newswire Disclaimer

The Savannah College of Art and Design (SCAD) faces a proposed class action in the wake of a “widespread” data breach in which the personally identifiable information of thousands of current and former students, their parents, admission applicants and employees was apparently stolen off the school’s computer systems. 

The 71-page suit says the data exposed and then stolen in the incident, which was reportedly discovered by SCAD on August 22, 2022, included at least names, dates of birth and Social Security numbers. The case alleges SCAD, who has physical campuses in Atlanta and Savannah, Georgia and Lacoste, France, and offers online education through SCADnow, failed to implement and maintain “reasonable data security measures,” such as standard encryption or redaction of sensitive data, prior to the incident. 

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

According to the Office of the Maine Attorney General, nearly 17,000 people were affected by the SCAD data breach. The lawsuit says “notorious” hacker group AvosLocker has claimed credit for the incident and peddled the stolen personal information, reportedly housed within 69,000 exfiltrated files, online. 

DataBreaches.net wrote on September 4 that many of the file names contained descriptions that included individuals’ names and “clues as to the content of the files,” e.g., passports, payroll information, bank statements and recommendation letters. The website states that it was told by the hacker group that SCAD “did negotiate” on a ransom demand to destroy the stolen data but “seemed to be more trying to buy time.” 

Although some proposed class members first learned of the data breach when they received notice letters from the private college dated September 21, 2022, “[m]ost” victims, including the plaintiff, did not receive a notice from the school until last month, the lawsuit states. The letters apparently did not explain “the precise scope” of the incident, what steps the school took afterward, how the breach occurred, or how long the “unauthorized actor” responsible for the intrusion had access to SCAD’s network, the complaint says. 

“The letter provides no further information regarding the Data Breach and only goes on to recommend how victims can place a fraud alert or credit freeze on their account and how to sign up for identity monitoring services Defendant offered in response to the Data Breach,” the filing reads. 

As the lawsuit tells it, hackers targeted and obtained the personally identifiable information in SCAD’s possession “because of its value in exploiting and stealing the identities” of proposed class members. 

“The risks to these persons will remain for their respective lifetimes,” the complaint says. 

The injuries suffered by SCAD data breach victims include the lost or diminished value of their personally identifiable information; the loss of privacy; out-of-pocket expenses related to preventing, detecting and recovering from identity theft and fraud; and lost time spent trying to avoid unauthorized or fraudulent charges, changing usernames and passwords, and dealing with spam messages and emails, the case states. 

According to the lawsuit, there exists “little doubt” that AvosLocker has “followed through on its threat” to sell proposed class members’ information online “as a result of SCAD’s reported failure to pay the ransom.” 

Per the suit, the hack was a foreseeable risk to SCAD given the prevalence of data breaches against school districts, colleges and universities nationwide. 

The lawsuit looks to cover all United States residents whose personally identifiable information was compromised in the Savannah College of Art and Design data breach announced by the school in September 2022. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.