University of Central Florida Faces Data Breach Class Action Lawsuit

The University of Central Florida has been named in a proposed class action lawsuit that claims the educational institution did not do its part to properly protect the confidential information of 63,000 current and former university employees and student-athletes.

The class action lawsuit was filed on Feb. 5, which was one day after the university announced the data breach. UCF claims that the hack occurred in January and exposed the identifying information, including the names and Social Security numbers, of 63,000 individuals.

Plaintiffs Anthony Furbush and Logan Berkowitz alleged that the university failed in its duty to take proactive safeguards to protect their personally identifiable information (PII), which led to placing thousands of individuals “in danger of identity theft and possible fraud and abuse.”

The data breach class action lawsuit states, “Plaintiffs and the class have suffered irreparable damages and will continue to suffer irreparable damage from the misuse of their PII. As a proximate result of the breach, plaintiffs and the class have had their PII compromised, their privacy invaded, have incurred or will incur out-of-pocket costs, and have otherwise suffered economic damages.”

Furbush and Berkowitz further allege that they were put at even more risk of harm from identity theft or fraud because the UCF failed to provide them with timely notification that the breach had occurred by releasing the information on the hack more than one month after it happened.

The plaintiffs argue, “UCF owed a duty to plaintiffs and the class to notify them about the breach within a reasonable amount of time under the circumstances, which it failed to do, exposing plaintiffs and the class to additional harm.”

According to the University of Central Florida website, the university became aware of the data breach in January. In response to the information, they reported the data breach to law enforcement, conducted an internal investigation and reviewed security protocol with the help of a cybersecurity firm.

The groups impacted by the data breach include employees who were student leaders, faculty who taught extra courses and resident assistants (RAs) at campus housing. Employee information that was breached included names, employee ID numbers and Social Security numbers.

The student-athletes who were affected include current players and some from the 2014 and 2015 rosters. Their data that was breached included names, student ID numbers, Social Security numbers, course loads, sport played at the university and whether they had been recruited to play for the school or if they had signed up independently.

The plaintiffs brought forth two counts of negligence and violations of Florida’s Deceptive and Unfair Trade Practices Act (FDUTPA) and Federal Educational Rights Privacy Act (FERPA). In addition to seeking class certification, the plaintiffs are seeking declaratory and equitable relief to stop such acts in the future and to engage in a correct notice campaign, other awards of damage, and reimbursement for the cost of litigation.

Following in the footsteps of other organizations, UCF responded to last month’s data hack by offering a free year of credit monitoring and identity protection services to employees and students affected by the data breach.

The plaintiffs are represented by Joshua H. Eggnatz and Michael J. Pascucci of Eggnatz Lopatin & Pascucci LLP.

The University of Central Florida Data Breach Class Action Lawsuit is Anthony Furbush et al. v. University of Central Florida Board of Trustees, Case No. 6:16-cv-00204, in the U.S. District Court for the Middle District of Florida.