Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

Last week, Yale University was hit with a class action lawsuit after the Ivy League university mailed letters about a 2008-2009 data breach that reportedly affected 119,000 individuals across the United States.

According to plaintiff Julie Mason, Yale mailed letters on July 26 and 27 to inform individuals that their personal information, including their names, Social Security numbers, and dates of birth had been exposed in a data breach that took place nearly a decade ago.

Some email addresses and physical addresses were also exposed, according to the Yale data breach class action lawsuit.

“Yale discovered this data breach in June 2018 — one decade too late for any of the victims to do anything to protect themselves from the violation of their private, personal information,” Mason alleges.

The Yale data breach reportedly affected graduates of the university as well as staff and faculty members. However, Mason states that the effects of the Yale data breach are much broader. She says her information was accessed even though she was not an alumnus, faculty member or staff member of Yale. She says her relationship to Yale was as an applicant to a visiting student program in or around 1996.

“As part of the application process, Yale promised, and Ms. Mason understood, that Yale would keep her Personal Information confidential and secured,” the Yale data breach class action lawsuit says. “But Yale failed to do so, and her Personal Information was accessed and extracted by unauthorized users.”

Mason says she was the victim of identity theft in 2009, and her credit card accounts were compromised. In 2014, she says close to $60,000 was stolen from one of her bank accounts.

The criminals were able to steal the money by using Mason’s personal identification information to change her online banking account’s password over the phone.

Mason claims that Yale stored “unneeded personal information” for applicants, alumni, faculty and staff, and concealed that it was storing this unneeded information. According to the data breach class action lawsuit, Yale began deleting the unneeded personal information on its databases in 2011.

According the Yale class action lawsuit, the university’s letter stated that it was taking measures to help those whose private information was accessed guard against identity theft.

“However, in the case of Plaintiff and other Class members, Yale’s offer is simply too little, too late,” the Yale data breach class action lawsuit says.

Mason also alleges that Yale’s databases were breached again between March 2016 and June 2018, during which time the personal information of 33 individuals was reportedly accessed.

The Yale data breach class action lawsuit was filed on behalf of Mason and a proposed Class of anyone residing in the United States whose personal identification information was accessed and extracted in the Yale data breach. Mason also seeks to represent a New York subclass.

Mason is represented by James J. Reardon Jr. of Reardon Scanlon LLP and by Scott A. Bursor and Philip L. Fraietta of Bursor & Fisher PA.

The Yale Data Breach Class Action Lawsuit is Julie Mason v. Yale University, Case No. 3:18-cv-01280-AWT, in the U.S. District Court for the District of Connecticut.