A class action lawsuit has been filed in the U.S. District Court for the District of Massachusetts by the law firm Morgan & Morgan against Injured Workers Pharmacy (IWP) over a breach of the personal information of 75,771 customers.
IWP is an Andover, MA-based pharmacy that serves employees who were injured at work and receive workers’ compensation benefits. On May 11, 2021, IWP discovered several employee email accounts had been accessed by an unauthorized individual, and those email accounts contained sensitive information such as names, addresses, and Social Security numbers. The first email accounts were compromised in January 2021, which allowed unauthorized access to the information in the accounts for 4 months before the breach was detected and the accounts were secured. Affected individuals were offered complimentary credit monitoring and identity theft protection services for 24 months.
Plaintiffs Alexsis Webb and Marsclette Charley allege IWP failed to implement appropriate data security safeguards to ensure the privacy of their personal information and that of the class members, had not followed industry security best practices and had not provided security awareness training to the workforce. IWP failed to issue notification letters about the breach until February 2022, 9 months after the breach was detected. The lawsuit alleges negligence, negligence per se, breach of implied contract and fiduciary duty, invasion of privacy, and unjust enrichment.
The plaintiffs claim they face an imminent and ongoing risk of identity theft and fraud due to the exposure of their sensitive data to cybercriminals and have had to spend time and money protecting themselves against identity theft and fraud. The lawsuit seeks class action status, a jury trial, damages, reimbursement of out-of-pocket expenses, and legal costs.
IWP is no stranger to legal action. In 2020, IWP agreed to settle a case with Massachusetts Attorney General Maura Healey to resolve allegations the company played a role in shipping thousands of illegitimate opioid painkiller prescriptions across the United States between 2006 and 2012. The case was settled for $11 million.
The post Injured Workers Pharmacy Faces Class Action Lawsuit over Email Account Breach appeared first on HIPAA Journal.