MACON, Ga. — Mercer University is facing a class action lawsuit for its alleged "failure to properly secure and safeguard" personal information for more than 93,000 individuals impacted by a data breach.
In a lawsuit filed with the United States District Court for the Northern District of Georgia Newnan Division on May 31, a "John Doe" accused the corporation of Mercer University of not taking proper precautions that led to the breach of thousands of people's personal and financial information.
Court documents allege that on April 5 a third-party gained access to students' information with the intent to sell it. The personal identifiable information (PII) could include social security numbers, passport numbers, driver's license numbers and financial account numbers, the lawsuit reads.
Accusing the university of being negligent, attorneys for the plaintiff said they suffered fraudulent credit charges. The plaintiff, only identified as an alumnus of the university who now lives in LaGrange, and others who may have been impacted received a letter of the breach on May 19.
Attorneys said the university is irresponsible for notifying individuals of the breach more than a month after the cyberattack.
To help make up for the impact of the breach, attorneys for the former Mercer University student are asking for a "prayer of relief," in which the members of the class action lawsuit request the court enter a judgment in their favor.
Specifically, the lawsuit asks for a jury trial if required, and members of the lawsuit are asking the court award damages -- including consequential damages -- as allowed by law. As part of a resolution, the lawsuit also asks the court to require Mercer University to protect, including through encryption, all data collected through its course of business. The plaintiff also asks university leaders to implement an information security program and to delete and purge all personal information of the class members unless Mercer has a reasonable justification for retaining them.
11Alive received the following statement from Mercer University, which was posted on the university's website in May. The university added it does not comment on pending litigation:
Mercer University recently detected an incident involving unauthorized access to its computer network. In response to the incident, the University launched an investigation with the assistance of law enforcement and outside legal and technical consultants. Although the University has taken extensive measures to protect the privacy of its information, some data — Social Security numbers and driver’s license numbers — were removed from its systems without authorization. The University has found no evidence that personal financial information was removed.
Mercer is notifying students, faculty, staff and parents whose personal information may have been involved.