SEATTLE–(BUSINESS WIRE)–The parties have reached a settlement in the Premera data breach
lawsuit, which arose after Premera was the target of an external
criminal-cyberattack that began in May 2014 and resulted in the
cyberattackers having access to personal information stored on Premera’s
computer network system. The settlement, which is still subject to
approval by the court, does not include any finding of wrongdoing, and
Premera is not admitting any wrongdoing or that any individuals were
harmed because of the cyberattack.
Following Premera’s announcement of the cyberattack in 2015, the
consolidated class action lawsuit was filed in United States District
Court for the District of Oregon before the Honorable Michael Simon.
This consolidated class action alleges that due to Premera’s practices,
cyberattackers were able to gain access to the personal information of
10.6 million individuals, including names, dates of birth, social
security numbers, and protected health information.
Under the terms of the proposed Settlement, Premera has agreed to pay
$32 million to resolve the litigation. Those funds will pay for an
additional two years of premium credit monitoring, and identity
protection services, out-of-pocket losses, and cash payments to all
class members who make a claim. The fund also will pay for
administrative and notice costs related to the settlement, including
attorneys’ fees. The benefits will not be available until the settlement
has been finally approved by the Court and any appeals have been
concluded.
In addition, Premera has agreed to guarantee a minimum of $42 million in
funding for its information security program over the next 3 years, and
implement and/or maintain a number of specific changes to its
information security practices, including:
• Encrypting certain personal information;
• Strengthening specified data security controls;
• Increased network monitoring and logging of monitored activity;
• Annual third-party security audits;
• Stronger passwords, reduced employee access to sensitive data, and
enhanced email protections; and
• Moving certain data into archived databases with strict access
controls.
Interim lead counsel for the Plaintiffs, Kim Stephens, said “After
several years of hard-fought litigation, we are pleased that individuals
affected by this data breach will receive compensation for their losses
and identity theft protection going forward. The settlement also
includes extensive and detailed injunctive relief in the form of
substantially reformed and improved information security practices,
designed to protect the class members’ information from future attacks.”
“This is a great result that will provide real and meaningful relief to
the class,” added Keith Dubanevich, interim liaison counsel for
Plaintiffs.
Premera’s Executive Vice President and Chief Information Officer, Mark
Gregory, said, “We are pleased to be putting this litigation behind us,
and to be providing additional substantial benefits to individuals whose
data was potentially accessed during the cyberattack. Premera takes the
security of its data and the personal information of its customers
seriously and has worked closely with state and federal regulators and
their information security experts. The company recently achieved an
industry-leading HITRUST certification, demonstrating its ability to
identify risks, protect assets, detect attacks, and respond and restore
capabilities should the need arise.”
The plaintiffs filed a motion for preliminary approval of the settlement
today. If granted, class members will receive further notice of the
settlement terms, including details regarding the timing and process
through which to file a claim for settlement benefits.
A third-party settlement administrator will manage the settlement, which
will be overseen by the Court in this litigation. The settlement
administrator will be the best resource for questions about the
settlement, including how to register for the credit monitoring or
identity protection services offered, or how to submit claims for
out-of-pocket costs or alternative compensation. If the Court
preliminarily approves the settlement, the settlement administrator will
set up a website regarding this settlement.
Contacts
Kim D. Stephens; Tousley Brain Stephens PLLC; [email protected]
