Forty Niners Football Company Data Breach Class Action

The Forty Niners Football Company, LLC, which operates a professional football franchise that is part of the National Football League (NFL) stores a great deal of personally identifiable information (PII) as well as medical and financial information. The complaint for this class action alleges that the company bears responsibility for the exposure of that information in a data breach.

A class and a subclass have been proposed for this action:

• The Nationwide Class is all individual in the US whose PII or financial information was exposed to unauthorized third parties as a result of the data breach that occurred between February 6 and February 11, 2022.
• The Indiana Subclass is all individuals in Indiana whose PII or PHI was stored by Forty-Niners Football Company or was exposed to unauthorized third parties as a result of the data breach that occurred between February 6 and February 11, 2022.

The Forty Niners system stored PII such as names, dates of birth, and Social Security numbers for some 20,000 people, but the complaint alleges it did not discover the data breach until August 9, 2022, and did not being notifying victims until September 2022.

The complaint alleges that the information the Forty Niners provided was insufficient and that the individual victims “remain, even today, in the dark regarding what particular data was stolen, the particular malware used, and what steps are being taken, if any, to secure their PII and financial information going forward.”

The Forty Niners company bears responsibility for the data breach, the complaint claims, because it “disregarded the rights” of the persons whose information it stored, “by intentionally, willfully, recklessly, or negligently failing to take and implement adequate and reasonable measures to ensure that … PII was safeguarded, failing to take available steps to prevent an unauthorized disclosure of data, and failing to follow applicable, required and appropriate protocols, policies and procedures regarding the encryption of data, even for internal use.”

The complaint claims that the Forty Niners company was warned about the possibility of such attacks because of the high-profile data breaches that have been occurring for the past several years and should have prepared for such an attack on its own systems. The complaint says, “This is especially true given that [the Forty Niners company] is a large, sophisticated operation[] with the resources to put adequate data security protocols in place.” Nevertheless, it claims, the company did not take the necessary steps.

According to the complaint, “data breaches are preventable.” It quotes the Data Breach and Encryption Handbook as saying, “In almost all cases, the data breaches that occurred could have been prevented by proper planning and the correct design and implementation of appropriate security solutions.”

Article Type: Lawsuit
Topic: Privacy
Tags: Exposing Private Information, Exposure to cyber crime, Your Privacy