Sur La Table Hit with Class Action Over March 2023 Data Breach Affecting Current, Former Employees [UPDATE]

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit claims Sur La Table, a cookware and dining supplies retailer, failed to protect the personal information of current and former employees during a March 2023 cyberattack.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 52-page lawsuit says that Sur La Table announced on May 11 that, after experiencing “unusual activity” in its network, a subsequent investigation determined that an unauthorized third party had accessed its computer systems between March 15 and 25 of this year. The suit relays that the information compromised in the breach included current and former employees’ full names, driver's license or state ID numbers and medical and health insurance details.

The case argues that the “foreseeable and preventable” breach was a direct result of the company’s failure to implement reasonable data security to adequately protect employees’ information, which it allegedly stored unencrypted and in a “reckless manner” on its computer systems. The complaint contends that “[h]ad the information been properly encrypted, the data thieves would have exfiltrated only unintelligible data.”

Sur La Table also failed to provide adequate notice to victims of the breach, the filing alleges. Per the lawsuit, the notice letter sent to impacted individuals offered little detail about the incident and did not explain how the cybercriminals gained access, when the unusual activity was detected and what steps are being taken to secure the information against future attacks.

Though the defendant has apparently offered victims 12 months of identity-monitoring services, this gesture is “wholly inadequate,” the suit claims, as it fails to account for the lifelong risk of fraud and identity theft that data breach victims now face.

The plaintiff, a Texas resident who worked for Sur La Table more than a decade ago, received notice on May 24 that his personal information had been compromised in the breach, the case relays. As a result of the cyberattack, the man has noticed an increase in spam communications and incurred two fraudulent charges, totaling around $900, to his debit account, the complaint shares.

The lawsuit looks to represent anyone whose private information was maintained on Sur La Table’s computer systems and was compromised in the data breach announced in May 2023.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.