Renovate America Class Action Filed Over Recent Data Hack

A California man says Renovate America is responsible for the theft of his and other employees’ personally identifiable information.

Plaintiff Michael Means is suing his former employer, Renovate America Inc., over a data breach that allegedly exposed the Form W-2 information for several of the company’s current and former employees. He says that each affected employee is now exposed to a risk of identity theft and credit fraud.

According to Means, the data breach happened in January 2017, when a Renovate America employee fell for a phishing scam. The employee allegedly complied with a phony email asking them to forward the 2016 Form W-2 information on the company’s current and former employees.

The exposed data included those employees’ names, addresses, salaries, and Social Security numbers, Means says.

The exposure of this information puts employees at risk for any number of different fraudulent schemes, such as filing false tax returns, making false applications for credit, or false applications for government-issued identification. Means says some employees have already had to deal with fraudulent tax returns filed in their name.

Fraudsters could also use the employees’ information to commit other crimes under a false identity, Means claims.

He alleges the data thieves who obtained that information could now exploit it themselves, or they could sell it to other cybercriminals, spreading it throughout what are known as “dark markets” for personal information.

Means blames the data breach on a failure by Renovate America to train their workers to use procedures and controls that would keep employee information safe.

He also points out that Renovate America is no stranger to data breaches. In 2014, a hacker stole data from the company, forcing them to pay for its return in Bitcoin. That breach should have put the company on notice of its data vulnerabilities and the importance of protecting employee information, Means argues.

However, a Renovate America Spokesperson said that within hours of January’s phishing attack, the company notified affected employees and offered them “two years of enrollment in Experian’s ProtectMyID service, which detects, protects and resolves instances of identification theft. Additional employee security training was also provided.”

Means says this remedy is nowhere near adequate to protect Class Members from fraud or to compensate them when it happens. According to Means, ProtectMyID does nothing to prevent identity theft. It does not provide real-time monitoring of bank and credit card records, he says, and it can’t detect fraudulent activity that would not show up on a credit report, such as filing of a fraudulent tax return. ProtectMyID merely offers assistance in dealing with identity theft once it’s discovered, Means claims.

Despite the plaintiff’s allegations, Renovate America said in a statement that “No customer data was compromised during the attack, and the company is working with the FBI, the IRS, and the California Franchise Tax Board. Moreover, the next business day after the scam occurred, Renovate America filed a court action in San Diego Superior Court against the perpetrator of the phishing attack.”

Means is proposing to lead a plaintiff Class that would cover all current and former employees of Renovate America whose personally identifiable information was disclosed in the January 2017 data breach.

He seeks a court order finding that Renovate America breached its duty to safeguard the information exposed in the data breach. He also seeks an award of damages, court costs and attorneys’ fees, and equitable relief as appropriate.

Renovate America says the company will vigorously dispute these meritless claims.

Means is represented by attorney Stephanie E. Yasuda, Kenneth H. Yoon and Brian G. Lee of Yoon Law APC and by Douglas Han, Shunt Tatavos-Gharajeh and Daniel J. Park of Justice Law Corporation.

The Renovate America Data Breach Class Action Lawsuit is Michael Means v. Renovate America Inc., Case No. 37-2017-00005317-CU-BC-CTL, in the Superior Court for San Diego County, California.