ABM Class Action Says Data Breach Left Employee Info Vulnerable

An employee of ABM, a facilities management company, says that his and others’ biometric information was exposed in a data breach.

Lead plaintiff Larry Wade alleges in his class action lawsuit that his employer ABM Industries Inc. left his and others’ personal information vulnerable to hackers who allegedly scooped up the data in a phishing scam in August 2017.

The plaintiff further claims that ABM failed to notify workers about the breach for an excessive amount of time – seven months.

The ABM data breach allegedly included employees’ personal information, including email passwords and credit card numbers.

“Despite the fact that Defendant was storing such sensitive information that it knew was of value to, and vulnerable to, cyber attackers, Defendant failed to take basic security precautions that could have prevented the disclosure of its employees’ sensitive Personal Information,” alleges the ABM class action lawsuit.

The plaintiff accuses ABM of having “lax” cybersecurity measures, despite having been targeted in phishing attacks several times. Employee information “should have been secured by adequate levels of protection and should not have been susceptible to unauthorized access through the use of one of the oldest, and least sophisticated, types of cyber-attacks – the ‘phishing email’ scheme,” alleges the ABM data breach class action.

According to the class action lawsuit, ABM’s cybersecurity was unable to detect, prevent, or even respond to the phishing email that led to the data breach.

ABM “has been targeted by cyber-attacks many times in the last decade,” alleges the ABM data breach class action lawsuit. “Notably, in 2011, Defendant was the target of such an attack on its IT Systems. Defendant was not able to thwart the 2011 cyber-attack and, as a result, many employees’ names and social security numbers ended up in the hands of a criminal.”

In the six years since the 2011 attack, points out the class action, ABM was again unable to prevent a similar data breach in August 2017. Further compounding the problem, says the plaintiff, he and other employees were not informed of the breach until March 2018, limiting their ability to protect themselves.

“Had Defendant informed Plaintiff of the Data Breach within a reasonable period of time, as the law requires, Plaintiff and the other members of the putative class would have been able to take actions to protect their identities, accounts, and other potential targets from further hacking attempts,” alleges the ABM data breach class action lawsuit. “Instead Defendants let its employees languish in ignorance as to the real risk of irreversible privacy harms presented.”

ABM is still unaware of the extent of the data exposed in the data breach, alleges the plaintiff, and represents that it still doesn’t know “what happened.”

The plaintiff seeks to represent a nationwide Class of employees whose personal information was in the possession of ABM during the breach, as well as an Illinois subclass.

Wade is represented by Myles McGuire of McGuire Law PC.

The ABM Data Breach Class Action Lawsuit is Larry Wade, et al. v. AMB Industries Inc., Case No. 18­-ch­-03855, in the Circuit Court of Cook County, Illinois.