UMPC Data Breach Class Action Lawsuit Filed by Employees

Last week, employees of the University of Pittsburgh Medical Center filed a class action lawsuit claiming their employer failed to protect their personal data, which was subsequently stolen and used to commit identity theft.

Plaintiffs Barbara A. Dittman and Gary R. Douglas filed the class action lawsuit, which alleges that the Social Security numbers, names and addresses of employees were stolen by criminals. They claim that this sensitive personal information, including their W2 forms, was then used to file fraudulent tax returns and open bank accounts in their names.

“Defendants had a duty to protect the private, sensitive, personal and financial information and the tax documents of Plaintiffs,” the class action lawsuit says. “Because of UPMC’s negligent conduct and breach of implied contracts, Plaintiffs have experienced intrusions into their privacy, identity theft, lost wages, emotional distress and anxiety.”

Dittman says that she attempted to file a tax return but was informed that a tax return had already been filed with her Social Security number. According to the class action lawsuit, she took off a full day of work in attempt to resolve the situation. In addition, she received a “welcome packet” from Ally Bank even though she had not opened an account with the bank. She learned that an account had been opened in her name. She subsequently learned that other UPMC employees also had fraudulent tax returns filed in their names.

More than 50 UPMC employees are allegedly aware that their sensitive information has been used to fraudulently open bank accounts and/or file fraudulent income tax returns, the UPMC employee data breach lawsuit alleges.

According to the class action lawsuit, UPMC employs more than 62,000 people. The hospital keeps records on all of its employees containing highly sensitive personal information, including birth dates, Social Security numbers, full names and addresses.

The plaintiffs filed the class action lawsuit on behalf of all former and current UPMC employees whose personal information was allegedly compromised while in the hospital’s care. The plaintiffs claim that more than 50 employees have experienced identity theft as a result of the alleged data breach.

“UPMC’s failure to maintain reasonable and adequate security procedures to protect Plaintiffs’ personal information directly resulted in this information being taken and used fraudulently,” the class action lawsuit says.

The UPMC employee data breach lawsuit brings charges of negligence, invasion of privacy and breach of implied contract. The plaintiffs are seeking an order compelling UPMC to cover the costs of Class Members’ credit monitoring services for 10 years and a judgment for damages they suffered as a result of the data breach. They are also seeking reasonable attorneys’ fees and costs, punitive damages and costs of the class action lawsuit.

The plaintiffs are represented by Elizabeth Pollock-Avery, Michael L. Kraemer and David M. Manes of Kraemer Manes & Associates LLC.

The UPMC Employee Data Breach Class Action Lawsuit is Barbara A. Dittman, et al. v. UPMC and UPMC McKeesport, in the Court of Common Pleas of Allegheny County, Pennsylvania.