Sequoia Benefits Outsourcing and Management Data Breach Class Action

This is yet another data breach class action, with the defendants this time being Sequoia Benefits and Insurance Services, LLC and Sequoia One PEO, LLC. Sequoia offers human resources, payroll, and benefits management and administration for other businesses, so the company stores a great deal of personal information. The complaint alleges Sequoia did not take adequate measures to protect the information in its systems.

A class and two subclasses have been defined for this action:

• The Nationwide Class is all persons in the US whose personal information was compromised in the data breach publicly announced by Sequoia in December 2022.
• The Utah and New York subclasses are all residents of those states, respectively, whose personal information was compromised in the data breach publicly announced by Sequoia in December 2022.

Sequoia has more than 1,700 clients, the complaint alleges. It quotes Sequoia as saying it can help businesses “establish secure processes for uploading health information, storing medical verification documents, and ensuring only the right people have access to this sensitive data.”

According to the complaint, “Sequoia also markets itself as an authority on cybersecurity” and publishes articles giving cybersecurity advice, such as “Guide to Cyber Protection,” “Cyber Liability in the Time of Covid: Ransomware,” and “Policies for Remote Work: Cybersecurity.”

Unauthorized parties gained access to Sequoia’s systems between September 22, 2022 and October 6, 2022, the complaint alleges, gaining access to information stored in the system such as names, dates of birth, Social Security numbers, driver’s license numbers, Covid test results, and vaccination cards.

The complaint claims, “Sequoia’s Data Breach notification letters attempt to downplay the harm caused by the Data Breach, stating that Sequoia conducted a forensic review of the breach and ‘found no evidence that the unauthorized party misused or distributed data’ at this time.” However, the complaint points out that forensic investigations normally look at the company’s own systems to figure out “the scope of the intrusion and what data was taken: they do not typically investigate whether the hackers have misused or distributed the data.”

The complaint claims that the data breach was foreseeable and could have been avoided, if Sequoia had taken adequate precautions to protect its systems. It asserts, “Sequoia knew or should have known of the likelihood of attempted cyberattacks. In fact, Sequoia’s articles on cybersecurity make clear that Sequoia realized the risks of unsecured databases, particularly those hosted in the cloud.”

The Federal Trade Commission (FTC) has published guidelines for data security for businesses, the complaint claims, recommending things such as the encryption of data and intrusion detection systems.

Article Type: Lawsuit
Topic: Privacy
Tags: Exposing Private Information, Exposure to cyber crime, Your Privacy