Upper Peninsula Power Company Data Breach Class Action

Upper Peninsula Power Company (UPPC) is a private utility company based in Michigan which recently experienced a data breach. The complaint for this class action alleges the data breach could have been prevented if UPPC had taken the proper steps to protect the personally identifiable information (PII) it held in its systems. It blames UPPC for the exposure of customer information.

The class for this action is all individuals living in the US whose PII was accessed or acquired by an unauthorized party as a result of the data breach announced by UPPC on or around November 23, 2022.

Those who want to get energy from UPPC are required to provide it with certain private information. “By obtaining, collecting using, and deriving a benefit from the PII…,” the complaint alleges, UPPC “assumed legal and equitable duties to those individuals to protect and safeguard that information from unauthorized access and intrusion.”

Nevertheless, unknown parties intruded into UPPC’s systems on or about June 23, 2022, the complaint alleges.

On or around November 23, 2022, UPPC sent out a Notice of Data Event letter to notify the individual victims, which the complaint quotes as saying, “After a thorough investigation, [UPPC] discovered that a limited amount of information may have been accessed by an unauthorized party in connection with this event. [UPPC] has taken steps to address the event and remains committed to protecting information in our care.”

The complaint faults UPPC for the lack of specifics: “Omitted from the Notice Letter were the date that [UPPC] discovered the Data Breach, the details of the root cause of the Data Breach, the vulnerabilities exploited, why it took over five months from the day of the Data Breach to inform impacted individuals that their information was involved, and the remedial measures undertaken to ensure such a breach does not occur again.”

The complaint alleges that the information stolen included names and Social Security numbers for around 39,000 individuals.

According to the complaint, data breaches can be prevented. The complaint sets forth several lists of recommended measures, put out by the US Government, the US Cybersecurity & Infrastructure Security Agency, and the Microsoft Threat Protection Intelligence Team. UPPC failed to take at least one of these measures, the complaint alleges, and also failed to comply with Federal Trade Commission information security guidelines and industry standards, leaving itself vulnerable to a data breach.

Because of the many high-profile data breaches that have occurred in recent years, the complaint claims, UPPC knew or should have known that its systems might be targeted. UPPC also knew or should have known, the complaint says, “of the foreseeable consequences that would occur if [UPPC’s] data security system was breached, including, specifically, the significant costs that would be imposed” on those whose information could be compromised in the event of such a breach.

Article Type: Lawsuit
Topic: Privacy
Tags: Exposing Private Information, Exposure to cyber crime, Your Privacy