In response to a significant data breach in May 2023 that exposed the personal information of 3.5 million Oregon residents, a lawsuit has been filed against the state. Plaintiffs Caery Evangelist and Brian Els are seeking class-action status for all affected residents whose driver license and ID card information were compromised. The breach, attributed to a Russian cybergang, targeted a wide array of organizations globally, affecting over 90 million individuals worldwide, according to anti-malware company Emsisoft.
The lawsuit, filed in Marion County Circuit Court, alleges negligence on the part of the state in safeguarding residents’ data. It demands substantial compensation, setting a minimum floor of $10 million without specifying an upper limit. Additionally, the plaintiffs seek lifetime credit monitoring and identity theft insurance for all affected residents.
According to the lawsuit, the data breach has resulted in significant personal and financial burdens for affected individuals. Victims have spent numerous hours protecting themselves from potential fallout, including monitoring credit reports and researching credit monitoring services. Evangelist, one of the plaintiffs, reportedly spent $65 to sign up for a credit monitoring service.
The lawsuit also highlights the potential risks posed by the stolen data, describing it as a “gold mine for data thieves.” It warns that cybercriminals could exploit the stolen information for various criminal activities, including identity theft, financial fraud, and obtaining false identification documents.
The Oregon Department of Transportation and Oregon Driver & Motor Vehicle Services, the entities responsible for driver license data, declined to comment on the pending litigation. However, state officials have previously urged individuals affected by the breach to assume their information was stolen and take necessary precautions.
The lawsuit was filed by Lake Oswego attorneys Paul Barton and Alex Graven, underscoring the legal ramifications of data breaches and the importance of holding entities accountable for protecting individuals’ sensitive information.
For further details and updates on the lawsuit, individuals are encouraged to follow developments in the case closely.
