Acuity Brands allegedly failed to protect employee info during data breaches

Acuity data breaches overview: 

• Who: Two former explorers hit Acuity Brands with a class action lawsuit.
• Why: They accuse the lighting company of negligence in two data breaches that impacted anyone who applied for a job at the company. 
• Where: The Acuity data breaches lawsuit was filed in a Georgia federal court. 

Acuity Brands was negligent in its data security, leading to two data breaches that exposed as many as 37,000 people’s personal information to hackers, a new class action lawsuit alleges.

Plaintiffs Andrew Smith and Mackenzie Fairfield—both former employees of the lighting company—filed the class action lawsuit against Acuity Brands Inc. on Jan. 25 in a Georgia federal court, alleging negligence and violations of contract and privacy laws.

According to the lawsuit, Acuity became aware of suspicious activity on its servers on Dec. 7, 2021. This prompted an investigation, which revealed an unauthorized person had copied files from the company’s database. The company also uncovered a similar breach from Oct. 6 and Oct. 7, 2020.

The company discovered that the hacker had copied information including individuals’ names, Social Security numbers, driver’s license numbers, financial account information and employees’ health care benefit information, the plaintiffs say. The Acuity data breaches allegedly impacted about 37,000 individuals’ data.

Acuity kept this data because it requires the personal information to apply for employment or certain employment-related benefits, the plaintiffs alleges. However, the company did not safely store or delete the information after its intended use, they say.

Acuity waited before telling plaintiffs about breaches, lawsuit alleges

Acuity did not notify impacted individuals of the data breaches until Dec. 5, 2022, according to the complaint.

“During this time, plaintiffs and class members were unaware that their sensitive [personal information] had been compromised, and that they were, and continue to be, at significant risk of identity theft and various other forms of personal, social, and financial harm,” the plaintiffs say in the Acuity data breaches lawsuit.

The plaintiffs seek to represent anyone nationwide who had their personal information exposed in the breaches. They are suing for negligence, breaches of implied contracts and confidence, invasion of privacy, negligence per se and violations of Georgia’s Uniform Deceptive Trade Practices Act.

The plaintiffs ask the court to require Acuity to delete plaintiffs’ personal information and implement and maintain a comprehensive information security program moving forward. They also seek damages, fees, costs and a jury trial. 

In other data breach news, Volkwagen and Audi recently agreed to pay $3.5 million to resolve claims their customers’ information was stolen in a data breach spanning several years.

Were you a victim of the Acuity data breaches? Let us know in the comments! 

The plaintiffs are represented by MaryBeth V. Gibson of The Finley Firm PC and Gary M. Klinger and David K. Lietz of Milberg Coleman Bryson Phillips Grossman PLLC.

This Acuity data breaches class action lawsuit is Smith et al. v. Acuity Brands Inc., Case No. 1:23-cv-00392, in the U.S. District Court for the Northern District of Georgia. 

Read About More Class Action Lawsuits & Class Action Settlements:

• Zendesk data breach result of employee phishing attack
• Volkswagen, Audi data breach $3.5M class action settlement
• LastPass parent company GoTo suffers data breach 
• FanDuel data breach exposes customer names, email addresses