IBM, Johnson & Johnson class action claims companies failed to safeguard protected health information

IBM, Johnson & Johnson data breach class action lawsuit overview: 

• Who: Elaine D. Malinowski filed a class action lawsuit against International Business Machines Corp. and Johnson & Johnson Health Care Systems Inc. 
• Why: Malinowski claims IBM and Johnson & Johnson failed to properly safeguard and secure the personally identifiable information and private health information of customers during a cyberattack they “purportedly” discovered on Aug. 2. 
• Where: The class action lawsuit was filed in New York federal court. 

IBM and Johnson & Johnson failed to properly safeguard and secure the personally identifiable information (PII) and private health information (PHI) of their customers from becoming exposed during a cyberattack, a new class action lawsuit alleges. 

Plaintiff Elaine D. Malinowski claims IBM and Johnson & Johnson failed to adequately protect their network servers and left highly sensitive PII and PHI unprotected during a cyberattack the companies “purportedly” discovered on Aug. 2.

In addition to allegedly failing to prevent the data breach, Malinowski argues IBM and Johnson & Johnson waited until Sept. 15 to disclose the incident despite allegedly learning about it as early as Aug. 2. 

“Indeed, Representative Plaintiff and Class Members were wholly unaware of the Data Breach until they received letters from Defendants informing them of it,” the Johnson & Johnson class action states. 

Malinowski wants to represent a nationwide class of individuals who had their PII/PHI exposed to unauthorized third parties during the data breach discovered by IBM and Johnson & Johnson on Sept. 15. 

IBM, Johnson & Johnson responsible for “harms” to customers impacted by data breach, says class action

Malinowski argues IBM and Johnson & Johnson are responsible for “the harms (the companies) caused and will continue to cause” herself and thousands of others who were impacted by the “massive and preventable cyberattack.” 

“By obtaining, collecting, using, and deriving a benefit from Representative Plaintiff’s and Class Members’ PHI/PII, Defendants assumed legal and equitable duties to those individuals,” the IBM class action states. 

Malinowski claims IBM and Johnson & Johnson are guilty of unjust enrichment, breach of fiduciary duty, breach of the implied covenant of good faith and fair dealing, breach of implied contract, breach of confidence, negligence per se, and negligence. 

The plaintiff is demanding a jury trial and requesting declaratory and injunctive relief along with an award of actual and/or statutory damages for herself and all class members. 

A separate class action lawsuit was filed against Johnson & Johnson earlier this month over claims it falsely advertises that its Sudafed PE nasal congestion medication is effective at tackling sinus issues. 

Were you impacted by the IBM and Johnson & Johnson data breach? Let us know in the comments! 

The plaintiff is represented by Jared R. Cooper of Robinson Yablon Cooper & Bonfante LLP, and Daniel Srourian of Srourian Law Firm PC. 

The IBM, Johnson & Johnson data breach class action lawsuit is Malinowski v. International Business Machines Corp., et al., Case No. 1:23-cv-08421, in the U.S. District Court for the Southern District of New York.

Read About More Class Action Lawsuits & Class Action Settlements:

• Ransomware group claims to have hacked all of Sony systems
• MGM class action claims data breach exposed sensitive customer information
• Tesla class action claims data breach exposed employee info
• Honeywell class action claims data breach exposed personal information of 100,000+