Sunrun Class Action Targets Employee W-2 Data Breach

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

Solar panel maker Sunrun is facing a proposed class action lawsuit brought by a former employee who says the company failed to take necessary precautions to prevent a recent data hack into the company’s payroll system, putting thousands of current and former employees’ sensitive information at risk.

Sometime in late January, Sunrun was hit with a spear-phishing attack and the hacker was able to gain access to W-2 information and other personally identifiable information (PII), including social security numbers, names, addresses, and more on both current and former employees.

A person impersonating Sunrun CEO Lynn Jurich emailed the company’s payroll department requesting tax documents. The employee readily turned over the records compromising the tax data before realizing it was scam, according to SFGate.

Plaintiff Russell Ashlock says he found out about the data breach after reading about it on the internet in early February. He then contacted Sunrun and was informed that the company had disclosed his Form W-2 in the data breach. Ashlock also received a letter from Sunrun on Feb. 6, 2017, informing him that his W-2 information had been exposed.

According to Ashlock, he learned that someone had filed a false tax return on Jan. 29 using his PPI information, the complaint states.

“Plaintiff and class members are now and will be at risk of identify theft for the rest of their lives, requiring constant diligence and monitoring,” the lawsuit contends.

Additionally, Ashlock alleges that Sunrun failed to adequately compensate employees for the data exposure, offering employees just two years of identify theft protection through Experian’s ProtectMyID service.

“Even if an employee accepts the ProtectMyID service, it will not provide employees any compensation for the costs and burdens associated with the fraudulent tax returns that were filed prior to an employee signing up for ProtectMyID,” the complaint says. “Sunrun has not offered employees any assistance in dealing with the IRS or state tax agencies. Nor has Sunrun offered to reimburse employees for the costs-current and future- incurred as a result of falsely filed tax returns.”

The lawsuit goes on to say that Sunrun “betrayed” Ashlock and other putative Class Members by failing to properly safeguard and protect their PII and negligently disclosed this sensitive information to cybercriminals.

Ashlock is seeking to represent a certified Class of all current and former employees of Sunrun Inc. and Sunrun Installation Services Inc. whose PII was compromised as a result of the data breach. The plaintiff also seeks to represent a California subclass.

The class action lawsuit is requesting punitive and statutory damages for Sunrun’s “failure to maintain proper security measures, policies and procedures, and training,” and for failing to timely notify their employees of the data breach.

Ashlock is represented by Eric A. Grover and Robert W. Spencer of Keller Grover LLP.

The Sunrun Employee Data Breach Class Action Lawsuit is Ashlock v. Sunrun Inc., et al., Case No. CGC-17-557027, in the Superior Court of California, County of San Francisco.