Attorneys for Ohio residents file lawsuit over data leak that compromised personal info of unemployment claimants
Updated May 21, 2020; Posted May 21, 2020
By Evan MacDonald, cleveland.com
CLEVELAND, Ohio – Attorneys representing three Ohio residents filed a lawsuit Thursday over a data leak that resulted in roughly two-dozen people viewing the personal information of others seeking unemployment benefits amid the coronavirus crisis.
The lawsuit, filed in Cuyahoga County Common Pleas Court, accuses Deloitte Consulting LLP of failing to protect the personal and financial information of Ohio residents applying to the new Pandemic Unemployment Assistance program. The federal government set up the program as part of a coronavirus stimulus package to provide relief to self-employed workers and independent contractors who do not qualify for traditional unemployment benefits.
The Ohio Department of Job and Family Services said a technical glitch resulted in 26 users viewing other users’ personal information, including Social Security numbers, names and addresses. The state hired Deloitte Consulting, which is registered as an LLP in Delaware, to administer the PUA program in Ohio.
The lawsuit says the plaintiffs are seeking class-action status and an unspecified amount in damages.
Cuyahoga County resident Daniel Bozin, Franklin County resident Timothy Smith and Portage County resident Alexandria Polichena are named as plaintiffs. Attorneys Marc Dann, a former Ohio attorney general now with the Cleveland firm DannLaw, and Thomas A. Zimmerman of the Zimmerman Law Offices in Chicago filed it on their behalf.
Deloitte Consulting is the only defendant named in the suit. A spokesman for the company did not immediately respond to a request for comment Thursday afternoon.
The suit says Deloitte failed to take cybersecurity precautions to protect claimants’ personal and financial information. It also says anyone whose personal information was exposed will be at increased risk of identity theft moving forward.
“I think everybody involved had a reason to expect their Social Security numbers would be kept secret,” Dann said Thursday in a phone interview. “And talk about insult to injury at this time in their lives.”
Deloitte notified Bozin, Smith and Polichena of the data leak on May 20. All three bought credit and identity monitoring through LifeLock, and intend to close their financial accounts in case they were compromised, the suit says.
The ODJFS, which is not named as a defendant in the lawsuit, has contacted about two-dozen individuals who mistakenly viewed other claimants’ data. The agency did not find evidence of widespread compromise, Director Kimberly Hall said Thursday.
The issue appears to be related to Deloitte’s work on the PUA system, because it also occurred in Colorado and Illinois, Hall said. Deloitte is also tasked with administering the PUA program in those states.
Hall said it’s unclear how many users had personal and financial information exposed. The ODJFS reported Thursday that Ohio has received more than 161,000 applications to the new PUA program since launching it May 12.
Hall said Thursday that officials would typically test a system like the one used to administer the PUA program for six months before rolling it out to the public. The rapid onset of the coronavirus crisis forced Deloitte and the ODJFS to get it up and running within four weeks, she said.
“Some of these things are just naturally going to be a function of moving at the speed of light in order to be as responsive as every state can to what the federal government asked us to do,” Hall said in a videoconference with media.
Deloitte, which also issued a statement confirming the data leak, is offering 12 months of credit monitoring to anyone who filed for the PUA program.
