PHILADELPHIA - A company accused of a data breach that included releasing all W-2s for its U.S. employers to a cybercriminal will soon pay a settlement from a class action lawsuit.
The U.S. District Court for the Eastern District of Pennsylvania approved the settlement agreement on Sept. 23 reached in the lawsuit against Accolade, Inc. by Tashica Fulton-Green and Daniel Crevak. U.S. District Judge Gene E.K. Pratter ruled on the case.
“Because the settlement is fair, reasonable and adequate, the court grants the parties’ motion for final approval, because the proposed attorneys’ fees are reasonable, the court grants class counsel’s motion for attorneys’ fees,” Pratter stated in her ruling.
The settlement agreement allowed class members to join an identity theft protection program for two years via Experian’s ProtectMyID. Those who were already enrolled were told how they could extend their membership by 24 months.
Class members were also allowed to request reimbursement for a total of $1,500 each. But participants had to spend at least one hour handling the theft of their personal information before they could claim their time was lost.
The class was also awarded $300,000 in attorneys’ fees and $5,000 for reimbursement of reasonable costs and expenses, along with $1,000 service awards for Crevak and Fulton-Green.
Accolade's legal issues began in January 2017 when it became the target of a phishing scandal. A cybercriminal asked for W-2s for current and previous employees in the U.S., and a worker with the company sent over the unencrypted files in an email.
The W-2s included extremely private information from names and addresses to social security numbers and salaries, along with the taxes withheld for 2016.
The plaintiffs filed the class action for negligence, negligence per se, breach of implied contract and breach of fiduciary duty.