A United States District Court Judge has granted final approval of a settlement in the Premera data breach lawsuit, which arose after Premera was the target of an external criminal-cyberattack that began in May 2014 and resulted in the cyberattackers having access to personal information stored on Premera’s computer network system. The settlement does not include any finding of wrongdoing, and Premera is not admitting any wrongdoing or that any individuals were harmed because of the cyberattack.
Following Premera’s announcement of the cyberattack in 2015, the consolidated class action lawsuit was filed in United States District Court for the District of Oregon before the Honorable Michael Simon. The lawsuit alleged that due to Premera’s practices, cyberattackers were able to gain access to the personal information of 10.6 million individuals, including names, dates of birth, social security numbers, and protected health information.
Under the terms of the Settlement, Premera agreed to pay $32 million to resolve the litigation. Those funds will pay for an additional two years of premium credit monitoring, and identity protection services, out-of-pocket losses, and cash payments to all class members who make a claim. The fund also will pay for administrative and notice costs related to the settlement, including attorneys’ fees. The benefits will not be available until any appeals of the Court’s approval of the settlement have been concluded.
In addition, Premera has agreed to guarantee a minimum of $42 million in funding for its information security program over the next 3 years, and implement and/or maintain a number of specific changes to its information security practices, including:
- Encrypting certain personal information;
- Strengthening specified data security controls;
- Increased network monitoring and logging of monitored activity;
- Annual third-party security audits;
- Stronger passwords, reduced employee access to sensitive data, and enhanced email protections; and
- Moving certain data into archived databases with strict access controls.
After reviewing extensive briefing and hearing arguments of counsel, U.S. District Court Judge Simon ruled that the settlement was “fair, reasonable, and adequate” and complied with all applicable legal requirements.
Lead counsel for the Plaintiffs, Kim Stephens, said “After several years of hard-fought litigation, we are pleased that individuals affected by this data breach will receive compensation for their losses and identity theft protection going forward. The settlement also includes extensive and detailed injunctive relief in the form of substantially reformed and improved information security practices, designed to protect the class members’ information from future attacks.” “This is a great result that will provide real and meaningful relief to the class,” added Keith Dubanevich, liaison counsel for Plaintiffs.
Premera’s Executive Vice President and Chief Information Officer, Mark Gregory, said, “We are pleased to be putting this litigation behind us, and to be providing additional substantial benefits to individuals whose data was potentially accessed during the cyberattack. Premera takes the security of its data and the personal information of its customers seriously and has worked closely with state and federal regulators and their information security experts. The company recently achieved an industry-leading HITRUST certification, demonstrating its ability to identify risks, protect assets, detect attacks, and respond and restore capabilities should the need arise.”
Epiq, a global leader in the legal services industry has managed the settlement which has been overseen by the Court. The settlement administrator set up a website regarding this settlement which is the best resource for questions about the settlement, including how to register for the credit monitoring or identity protection services offered, or how to submit claims for out-of-pocket costs or alternative compensation. https://www.premerasettlement.com