Pharmacy Delivery Service Hit With Class Action Over Data Breach

Injured Workers Pharmacy Data Breach Class Action Overview: 

• Who: Patients who used the pharmacy delivery service Injured Workers Pharmacy are suing the company.
• Why: The patients say the company failed to protect their personal information when it was hit with a data breach that exposed sensitive information.
• Where: The lawsuit was filed in Massachusetts federal court.

Drug delivery service Injured Workers Pharmacy (IWP) failed to protect the private information of its patients, leading to a data breach, according to a class action lawsuit.

Plaintiffs Alexsis Webb and Marsclette Charley filed the class action complaint against IWP May 23 in a Massachusetts federal court, alleging negligence and invasion of privacy. 

IWP distributes prescription medications to the homes of injured workers.

According to the complaint, the company failed to protect the personal information of more than 75,000 customers amid a data breach and then didn’t notify the patients until nine months later.

The plaintiffs claim the company failed to implement data security safeguards, train its employees for IT security or take other steps to protect its customers’ private, personally identifiable information before it was compromised during a January 2021 data breach.

“IWP’s negligent conduct caused the data breach,” the class action lawsuit claims.

“IWP violated its obligation to implement best practices and comply with industry standards concerning computer system security, IWP failed to comply with security standards and allowed its patients [personally identifiable information] to be accessed and stolen — for nearly four months — by failing to implement security measures that could have prevented, mitigated or detected the data breach,” the lawsuit states.

Patients Not Alerted to Breach Until Nine Months Later, According to Class Action 

The patients say their credit reports, financial information, Social Security numbers and other sensitive data was exposed to cybercriminals.

Despite this, they say, they weren’t alerted of the breach until Feb. 3, almost nine months after the company said it discovered it. 

Since then, the plaintiffs say they have spent time and money trying to protect and monitor their accounts to protect themselves from identity theft. Webb says she believes her information has been used by a cybercriminal. 

The plaintiffs seek to represent a class of current and former IWP customers.

They’re suing for negligence, negligence per se, breach of implied contract and fiduciary duty, unjust enrichment and invasion of privacy, and seek certification of the class action, damages, fees, costs and a jury trial.

The news comes after Capital One agreed to pay $190 million as part of a settlement to resolve claims it jeopardized customer information in a 2019 data breach.

Have you been affected by a data breach? Let us know your experience in the comments. 

The patients are represented by H. Luke Mitcheson of Morgan & Morgan. 

The IWP Data Breach Class Action Lawsuit is Webb et al. v. Injured Workers Pharmacy LLC, Case No. 1:22-cv-10797, in the U.S. District Court for the District of Massachusetts.

Read About More Class Action Lawsuits & Class Action Settlements:

• Parker Hannifin Class Action Alleges March Data Breach Caused by Lapsed Security
• DOJ Won’t Prosecute ‘Good Faith’ Cybersecurity Researchers Who Report System Flaws
• FTC Announces Updates To Children’s Data Privacy Protections
• Data Privacy Highlighted in Recent BIPA Class Actions, Settlements