Entrust Corporation and Entrust MN Corporation provide cybersecurity services, the complaint for this class action alleges, including securing transactions and managing sensitive data for companies and government entities. Although Entrust claims to be a leader in cybersecurity, the complaint alleges this is a false claim, because it failed to provide safe or secure storage for the information and suffered a data breach and ransomware attack.
The class for this action is all individuals living in the US whose sensitive information was compromised in the data breach revealed by Entrust in July 2022.
Entrust maintains personally identifiable information (PII), including Social Security numbers, protected health information (PHI) like medical records, and financial information like payroll data and account information. The complaint alleges, “Entrust’s cybersecurity services are specialized for businesses who manage highly sensitive data.”
As long ago as 2014, the complaint alleges, it warned about the costs to companies of data breaches and gave its clients cybersecurity webinars and presentations. The complaint quotes it as saying that “cybercrime black market may be more profitable than international drug crime.”
Its ads, as depicted in the complaint, claim that “The world’s most entrusted organizations trust us” and that it “Enabl[es] trusted identities, payments, and digital infrastructure.”
However, the complaint alleges that on June 18, 2022, Entrust experienced a ransomware attack on its back office system, which stored its client and employee information. The complaint alleges that the hackers were the LockBit ransomware group, who began to release some of the data it had stolen on a data leak page in August. The complaint alleges, “LockBit is one of the most active ransomware actors, and Entrust, as a cybersecurity company, knew or should have known of the tactics that groups like LockBit employ.”
According to the complaint, the stolen data includes Social Security numbers, bank routing and account numbers, driver’s license numbers, and health information, among other things. The complaint alleges that Entrust did not give the individual victims notice until December 2022 or even later.
The complaint quotes findings in orders issued by the Federal Trade Commission (FTC) against businesses that did not implement reasonable measures to protect private information. The complaint claims, “These orders, which all preceded Entrust’s Data Breach, further clarify the measures businesses must take to meet their data security obligations.” It alleges that Entrust did not follow the FTC’s cybersecurity guidelines for businesses.
Also, it claims, the failure to adequately protect medical information violates the Health Insurance Portability and Accountability Act (HIPAA).
Article Type: LawsuitTopic: Privacy
Most Recent Case Event
Entrust Corporation Ransomware Attack and Data Breach Complaint
February 17, 2023
Entrust Corporation and Entrust MN Corporation provide cybersecurity services, the complaint for this class action alleges, including securing transactions and managing sensitive data for companies and government entities. Although Entrust claims to be a leader in cybersecurity, the complaint alleges this is a false claim, because it failed to provide safe or secure storage for the information and suffered a data breach and ransomware attack.
Entrust Corporation Ransomware Attack and Data Breach ComplaintCase Event History
Entrust Corporation Ransomware Attack and Data Breach Complaint
February 17, 2023
Entrust Corporation and Entrust MN Corporation provide cybersecurity services, the complaint for this class action alleges, including securing transactions and managing sensitive data for companies and government entities. Although Entrust claims to be a leader in cybersecurity, the complaint alleges this is a false claim, because it failed to provide safe or secure storage for the information and suffered a data breach and ransomware attack.
Entrust Corporation Ransomware Attack and Data Breach Complaint