Herff Jones Exposure of Customer PII Class Action

Herff Jones sells class rings and rents other items related to graduation, such as caps and gowns. The complaint for this class action alleges that the company had a data breach, claiming that a number of students who rented caps and gowns for their graduations from Herff Jones suffered fraudulent credit and debit card charges on their cards. The complaint alleges, “These rentals were the only common charges that all students had in common.”

The Nationwide Class for this action is all individuals whose PII was compromised in the data breach that is the subject of this complaint. Subclasses have also been defined for individuals living in California, Indiana, and New York.

Around May 5, 2020, graduating students posting on Reddit claimed they had found fraudulent charges on their debit and credit cards, after renting caps and gowns from Herff Jones. By May 12, the complaint says that news organizations began reporting that the company had suffered a data breach which exposed customers’ personally identifiable information (PII), resulting in fraudulent charges on their payment cards.

The complaint claims that students at the University of Houston, Purdue University, the University of Illinois and Urbana-Champaign, the State University of New York at Binghamton, and other schools had reported that their PII had been stolen.

Schools contract with Herff Jones for the rental of “regalia” for graduation. Students can only do business with the company their school has chosen.

According to the complaint, hackers were able to steal the students PII, including names and payment cards. The complaint alleges, “That means the Data Breach worked. Hackers accessed and then offered for sale the unencrypted, unredacted, stolen PII to criminals. Because of [Herff Jones’s] Data Breach, customers’ PII is still available on the dark web for criminals to access and abuse. Herff Jones’[s] customers face a lifetime risk of identity theft.”

The complaint adds to this an accusation: “All of this personally identifiable information was compromised due to [Herff Jones’s] negligent and/or careless acts and omissions and the failure to protect customers’ data.”

While the company has confirmed that it experienced a data breach, it has not yet provided details about it. The complaint, which was filed on May 27, 2021, alleges, “As of this writing, Herff Jones has not yet provided notice to state attorneys general, to the public via press release, or to customers and les[s]ees via e[-]mail or physical mail, leaving many customers in the dark as to the vulnerability of their data.”

The complaint guesses that the data breach may have been done via scraping or skimming data entered on the website. It contends that Herff Jones “did not use reasonable security procedures and practices appropriate to the nature of the sensitive information they were collecting, causing customers’ PII to be exposed and sold on the dark web.”

Article Type: Lawsuit
Topic: Privacy
Tags: Exposing Private Information, Exposure to cyber crime, Your Privacy