Security News > 2023 > June > Identity thieves can hunt us for 'rest of our lives,' claims suit after university data leak

Because the data includes the identity fraud goldmine of the victims' names and social security numbers, one of the lawsuits claims the danger to those affected could continue throughout "Their lives."

According to the data breach notice by Mercer University in Macon, Georgia, 93,512 people were affected.

"The breach notice said the attack took place over February 12-24 and was only discovered on April 30. Data including name and"other personal identifiers" in combination with driver's licenses and Social Security numbers was nicked.

All of the lawsuits allege negligence, claiming little care was taken to protect the plaintiffs' PII, with Doe's suit alleging: "Not until over a month after it claims to have discovered the data breach did defendant begin sending the notice to persons whose PII and/or financial information defendant confirmed was potentially compromised as a result of the data breach."

The Register noticed Mercer filed the data breach notice with the Maine state attorney general, under a law which only applies to personal data that is not encrypted, but not wanting to take this at face value, we asked the institution whether it had any encryption in place.

The Feds learned the hard way, only requiring encryption of sensitive data stored on its laptops after a 2006 theft of computer equipment that contained data on 26.5 million veterans.

News URL

https://go.theregister.com/feed/www.theregister.com/2023/06/06/mercer/