$8M Class Action Lawsuit Settlement for Orrick, Herrington & Sutcliffe Data Breach
Listen to the Actumo Podcast
A recent class action lawsuit against Orrick, Herrington & Sutcliffe LLP, one of the top class action lawsuits to watch, has resulted in an $8 million settlement. This legal action stems from an Orrick security breach that exposed sensitive information of the law firm's clients and employees. The incident has drawn attention to the growing concerns about data security in the legal sector and highlights the importance of privacy and cybersecurity matters.
The settlement has an impact on thousands of individuals affected by the breach. It outlines compensation for those whose data was compromised and requires Orrick to implement enhanced security measures. This article will explore the details of the data breach, the terms of the settlement, and its implications for both the affected individuals and the legal industry as a whole. It also serves as a guide for those interested in class action lawsuits to join and provides insights into class action websites that track such settlements.
Overview of the Orrick Data Breach
The Orrick Herrington & Sutcliffe data breach, similar in nature to the recent Wells Fargo data breach, has exposed sensitive information of nearly 638,000 individuals. This incident has raised significant concerns about data security in the legal sector and has led to a class action lawsuit against the firm, adding to the growing list of data breach class action settlements.
Timeline of the incident
The breach occurred between February 28 and March 13, 2023, when hackers gained unauthorized access to Orrick's network. The law firm detected the intrusion in March 2023 and began its investigation. Initially, Orrick reported that the breach affected around 153,000 individuals. However, as the investigation progressed, the scope of the breach expanded significantly, similar to the innovation refunds lawsuit that saw its affected individuals grow over time.
In July 2023, Orrick disclosed that 152,818 individuals were impacted. By August, this number increased to 461,100. The final tally, revealed in December 2023, showed that 637,620 people were affected by the data breach. This substantial increase in the number of affected individuals over time highlights the complexity and scale of the incident.
Scope of affected individuals
The breach has an impact on a wide range of individuals, including Orrick's clients and their customers. Among those affected are people with vision plans from EyeMed Vision Care, dental plans from Delta Dental of California (which is facing its own Delta Dental data breach lawsuit), and health insurance from MultiPlan and Beacon Health Options (now known as Carelon). Additionally, data related to the U.S. Small Business Administration was also compromised.
The geographical spread of the affected individuals is extensive, with 830 residents from Maine among the victims. This wide-reaching impact underscores the far-reaching consequences of the breach in the legal and healthcare sectors.
Types of compromised information
The hackers accessed and stole a vast array of sensitive data from Orrick's systems. The compromised information includes:
Personally identifiable information: Names, addresses, email addresses, dates of birth, Social Security numbers, driver's license numbers, passport numbers, and tax identification numbers.
Financial details: Financial account information, credit or debit card numbers.
Health data: Medical treatment and diagnosis information, insurance claims information (including dates and costs of services), health insurance identification numbers, healthcare provider details, medical record numbers, and prescriber names. This data is particularly sensitive in light of biometric information privacy concerns.
Other sensitive data: Online account credentials and incidental health references.
The extensive nature of the stolen data has raised serious concerns about potential identity theft and fraud risks for the affected individuals. In response to the breach, Orrick has implemented additional security measures and tools, guided by third-party experts, to strengthen the ongoing security of its network. The firm has also sent notification letters to impacted individuals in accordance with its data breach notification obligations.
This incident serves as a stark reminder of the vulnerabilities that exist even in organizations that specialize in cybersecurity and data protection. It has prompted discussions about the need for enhanced security measures in the legal industry and the importance of prompt and transparent communication with affected individuals in the aftermath of such breaches.
Details of the $8M Settlement
The class action lawsuit against Orrick, Herrington & Sutcliffe LLP has resulted in an $8 million settlement agreement. This settlement, which has received preliminary approval from the court, aims to address the concerns of individuals affected by the data breach. The agreement outlines various compensation categories and eligibility criteria for claimants, similar to other notable settlements like the BC BIPA settlement and the LensCrafters class action lawsuit 2023 update.
Breakdown of compensation categories
The settlement offers several types of settlement benefits to affected individuals:
Lost Time Compensation: Claimants can seek reimbursement for up to 5 hours of time spent addressing issues related to the data breach, at a rate of $25 per hour.
Out-of-Pocket Expenses: Individuals who incurred actual, unreimbursed expenses due to the breach can claim up to $2,500 in compensation.
Extraordinary Losses: For those who experienced identity theft or fraud as a result of the breach, the settlement provides compensation of up to $7,500, with proper documentation.
Credit Monitoring Services: The settlement offers three years of three-bureau credit monitoring services, including at least $1 million in identity theft insurance.
California Consumer Privacy Act (CCPA) Payment: California residents are eligible for a $150 cash payment in recognition of their statutory claims under the CCPA, one of the key consumer protection laws at play in this case.
Alternative Cash Payment: Instead of submitting claims for lost time, out-of-pocket expenses, or extraordinary losses, individuals can opt for a $75 alternative cash payment.
Eligibility criteria for claimants
To be eligible for compensation under this class action settlement, individuals must meet the following criteria:
They must be residents of the United States.
They must have received notice of the Orrick data breach.
Their personal information must have been compromised in the breach.
Claimants need to provide their unique Class Member ID, which can be found on the notice they received or obtained from the Settlement Administrator.
Claim submission process
To receive benefits from the settlement, eligible individuals must submit a claim form. The process involves the following steps:
Obtain the Claim Form: Claimants can access the form online or request a physical copy from the Settlement Administrator.
Provide Required Information: The form requires personal details and information about the type of claim being submitted (e.g., lost time, out-of-pocket expenses, or alternative cash payment).
Include Supporting Documentation: For claims involving out-of-pocket expenses or extraordinary losses, claimants must provide documentation to support their claims.
Submit the Claim: The completed form can be submitted online or mailed to the Settlement Administrator.
Claim Review: The Settlement Administrator will review each claim to determine its completeness and validity.
The deadline for submitting claims is October 28, 2024. This date applies to both online submissions and mailed claims (based on postmark).
It's important to note that the final amount paid to settlement class members may vary depending on the total number of approved claims. The settlement also allows for up to 25% of the settlement amount to be claimed by class counsel as legal fees, with additional deductions for costs and service awards for lead plaintiffs.
This settlement represents a significant step in addressing the consequences of the Orrick data breach and provides affected individuals with various options for compensation and protection against potential future harm.
Impact on Affected Individuals
The Orrick, Herrington & Sutcliffe data breach has had far-reaching consequences for the nearly 638,000 individuals whose personal information was compromised. This incident has exposed them to various risks and potential harm, necessitating immediate action and ongoing vigilance.
Potential consequences of data exposure
The extensive nature of the exposed data has put affected individuals at significant risk. The compromised information includes highly sensitive details such as Social Security numbers, driver's license numbers, passport numbers, and financial account information. This data can be used by cybercriminals for identity theft, financial fraud, and other malicious activities.
Moreover, the breach exposed medical treatment and diagnosis information, insurance claims data, and health insurance identification numbers. This health-related data could lead to medical identity theft or be used for blackmail purposes. The exposure of online account credentials also puts individuals at risk of unauthorized access to their various online accounts.
The impact of this breach is particularly concerning as many of the affected individuals had already been victims of previous data breaches. For instance, some had vision plans from EyeMed Vision Care or dental plans from Delta Dental of California, companies that had previously experienced their own data breaches. This repeated exposure amplifies the potential for harm and underscores the ongoing challenges in protecting personal information in the digital age.
Steps taken by Orrick to mitigate risks
In response to the breach, Orrick has taken several measures to address the situation and mitigate potential risks to affected individuals:
Notification: The law firm has sent notification letters to impacted individuals, starting in June 2023. These notifications aim to alert people about the breach and the potential risks they face.
Enhanced security measures: Orrick has deployed additional security tools and measures, guided by third-party experts, to strengthen the ongoing security of its network.
Identity monitoring: The firm has offered identity monitoring services to data breach victims, helping them detect any suspicious activity related to their personal information.
Regret and acknowledgment: Orrick has expressed regret for the inconvenience caused by the breach, acknowledging the seriousness of the situation.
Available resources for victims
Affected individuals have several resources and recommended actions available to them:
Identity monitoring services: Victims should take advantage of the identity monitoring services offered by Orrick to keep track of any suspicious activity related to their personal information.
Password changes: It's crucial for affected users to immediately update passwords for any potentially compromised accounts. They should also reset passwords for other accounts where they might have used similar credentials.
Two-factor authentication: Enabling two-factor authentication on all important online accounts can significantly reduce the risk of unauthorized access.
Account monitoring: Victims should keep a close eye on their financial and online accounts for any suspicious activity and report unauthorized transactions or changes immediately.
Credit monitoring: Regularly checking credit reports for any unusual activity is essential in detecting potential identity theft early.
By taking these precautions and utilizing the available resources, affected individuals can better protect themselves against the potential consequences of this data breach. However, the incident serves as a stark reminder of the ongoing challenges in data security and the need for constant vigilance in protecting personal information.
Legal Implications and Future Precautions
The Orrick, Herrington & Sutcliffe data breach has significant legal implications and highlights the need for enhanced cybersecurity measures in the legal sector. This incident has sparked discussions about potential regulatory changes and the importance of protecting sensitive client information.
Lessons learned from the breach
The Orrick data breach serves as a wake-up call for law firms and other organizations handling sensitive data. One key lesson is the importance of timely notification. The lawsuits against Orrick alleged that the firm failed to inform victims about the breach until months after the incident. This delay has an impact on affected individuals' ability to take prompt action to protect themselves.
Another crucial lesson is the need for robust cybersecurity measures. The lawsuits claimed that the cyberattack could have been prevented if Orrick had implemented necessary and appropriate cybersecurity measures and followed industry best practices. This highlights the importance of staying up-to-date with the latest security protocols and technologies.
Importance of cybersecurity for law firms
The Orrick case underscores the critical need for law firms to prioritize cybersecurity. According to a 2023 survey by the American Bar Association, 29% of law firms reported experiencing a security breach, while 19% were unsure if one had occurred. This data points to a significant vulnerability in the legal sector.
Law firms have ethical and regulatory obligations to protect client information. Under the ABA Rule 1.6 Confidentiality of Information, attorneys must make reasonable efforts to detect breaches and avoid client data loss. Failing to do so can result in ethical violations and costly lawsuits.
Potential regulatory changes
The Orrick data breach and similar incidents may lead to stricter regulations in the legal industry. The Securities and Exchange Commission (SEC) has already amended its privacy rule, Regulation S-P, to establish a federal minimum standard for covered institutions to notify affected individuals of a data breach.
These amendments require covered institutions to develop, implement, and maintain written policies and procedures for an incident response program. They also establish a 30-day notification deadline for data breaches involving sensitive customer information.
While these changes primarily affect financial institutions, they may set a precedent for similar regulations in the legal sector. Law firms may need to prepare for more stringent requirements regarding data protection, breach notification, and oversight of service providers.
As cybersecurity threats continue to evolve, law firms must stay vigilant and adapt their security measures accordingly. The Orrick case serves as a reminder that even firms specializing in cyber governance and response are not immune to attacks. By learning from this incident and implementing robust security measures, law firms can better protect their clients' sensitive information and maintain their trust and reputation in an increasingly digital world.
Conclusion
The Orrick data breach and subsequent $8 million settlement have a significant impact on the legal industry, highlighting the crucial need for robust cybersecurity measures. This incident serves as a wake-up call for law firms to prioritize data protection and stay ahead of evolving cyber threats. The settlement provides affected individuals with various options to address potential harm, including compensation for lost time and expenses, as well as credit monitoring services.
Looking ahead, this case may lead to stricter regulations and heightened scrutiny of data security practices in the legal sector. Law firms must learn from this incident to enhance their security protocols, improve breach response times, and maintain client trust. By taking these lessons to heart, the legal industry can work towards creating a more secure environment for sensitive client information in our increasingly digital world.