Papyrus Class Action Says Employees Harmed by Phishing Attack

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

Seven employees of the business behind the Papyrus greeting card company say they were exposed to identity theft after the company failed to safeguard their tax data.

Plaintiffs Irene Sung, Kimberly Carboni, Annie Fulton, Cary Berger, Emmalyne Owens, Ruth Phelps and Christine Willetts are all current or former employees of greeting card company Schurman Retail Group. They allege a January 2017 phishing attack has already led to instances of identity theft for certain company employees like themselves.

Schurman operates the Papyrus brand of greeting cards and several other well-known brands including Carlton Cards/American Greetings. The company sells its products through websites and retail locations under its various brand names.

According to this Papyrus class action lawsuit, the company was hit with a phishing attack in January 2017 that exposed sensitive income tax information of all persons employed by the company in 2016. A phishing attack is an attempt to trick persons in control of sensitive information into sharing that information with a data thief.

The Papyrus phishing attack allegedly began when a company employee received an email from someone who claimed to be the company’s chief executive officer, asking for the information from IRS Form W-2 for all Schurman Retail Group employees from 2016. The employee responded by sending the requested information, not realizing that the original email was from an impostor.

It wasn’t until March 2017 that the data breach was discovered, according to the plaintiffs.

The plaintiffs say that since the Papyrus data breach, several current and former employees have been victims of identity theft. Fraud perpetrators have allegedly filed bogus tax returns in these employees’ names, requested information from the IRS, and used the employees’ information in the course of applying for federal student loans.

The Papyrus class action lawsuit argues that the company is to blame for failing to take reasonable steps to protect its employees’ sensitive tax information. Plaintiffs argue the company was on notice about the possibility of data theft and the potential damage that can result, yet failed to implement necessary policies and procedures to prevent such theft.

The seven named plaintiffs propose to represent a nationwide plaintiff Class that would cover all persons in the U.S. who were employed by Schurman Fine Papers in 2016 and whose personally identifiable information was exposed in the January 2017 data breach. Four proposed subclasses would represent employees from the states of California, Florida, Massachusetts, and North Carolina.

A proposed Third Party Class would represent non-employees whose information was also exposed in the breach. These Class Members would include relatives and other persons associated with Schurman Fine Papers employees.

The plaintiffs seek a court injunction requiring Papyrus to take specific steps to secure its data systems, minimizing the chances that a similar phishing attack could occur – steps such as training employees in proper data management and encrypting all sensitive personal information.

They are asking the court to order Papyrus to provide free monitoring services including credit monitoring, black website surveillance, and public record scanning. They also seek an award of actual damages, court costs and attorneys’ fees.

Attorneys for the plaintiffs are Rosemary M. Rivas and Quentin A. Roberts of Levi & Korsinsky LLP and Gayle M. Blatt of Casey Gerry Schenk Francavilla Blatt & Penfield LLP.

The Papyrus Phishing Attack Class Action Lawsuit is Irene Sung, et al. v. Schurman Fine Papers, Case No. 3:17-cv-02760, in the U.S. District Court for the Northern District of California.