Wabtec Corporation Hit with Class Action Over 2022 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Wabtec Corporation faces a proposed class action that alleges a data breach last year was caused by the locomotive and rail system manufacturer’s failure to implement adequate cybersecurity measures.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 24-page lawsuit claims Wabtec, purportedly the world’s leading rail technology company, launched an investigation after detecting “unusual activity” on its network in June 2022. The company concluded on November 23 last year that hackers had installed malware on some of its servers in March before exfiltrating the personal information stored in those impacted systems, the complaint says.

Wabtec’s cybersecurity failures, the case claims, exposed employees’ full names; dates of birth; non-U.S. national ID numbers; non-U.S. social insurance numbers or fiscal codes; passport numbers; IP addresses; Employer Identification Numbers; USCIS or Alien Registration Numbers; medical records and health insurance information; photographs; gender; gender identities; salaries; Social Security numbers; financial account information; payment card information; account usernames and passwords; biometric information; race and ethnicity details; criminal convictions and offenses; sexual orientations; religious beliefs and union affiliations.

“While Wabtec has not released the total number of individuals impacted by the Data Breach, Wabtec employs approximately 27,000 persons, and upon information and belief thousands of individuals were impacted by the Data Breach,” the suit reads, adding that information belonging to customers and other non-employees appears to have been exposed as well.

The case alleges that LockBit, a well-known cybercriminal group responsible for the ransomware attack, published the stolen data on its website on August 20, 2022 after the Wabtec refused to pay a $30 million ransom. It wasn’t until December 30, the filing says, that Wabtec began notifying victims that they had been affected by the data breach.

As a result of Wabtec’s negligence, data breach victims must now deal with a “significantly increased and certainly impending” risk of identity theft and fraud, and they must devote considerable amounts of time, money and energy to protect themselves from any misuse of their information, the complaint states.

According to the suit, Wabtec should have adopted reasonable cybersecurity measures to properly safeguard its employees’ sensitive information based on the knowledge that manufacturing companies, especially ones as “wildly successful” as itself, have become “prime targets” for hackers.

“Cybercriminals have further targeted manufacturing companies in part because of the critical role these companies play in the global supply chain and because successful attacks against manufacturing companies immediately create problems in the production and supply chain, making it more likely that cybercriminals can demand lucrative ransoms,” the case expands.

The lawsuit looks to represent anyone in the United States whose personally identifiable information and/or protected health information was compromised in the Wabtec data breach announced on or about December 30, 2022.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.