Erie Insurance is now the target of two separate class action lawsuits following a cybersecurity incident that remains under investigation.
One suit has been brought by Neil Plascencia, a customer based in Illinois, while the other was filed by Amy Haas, a former employee from Wisconsin. Both plaintiffs allege that Erie failed to adequately protect their personally identifiable information (PII), and each is seeking $5 million in damages.
According to both legal complaints, a ransomware group infiltrated Erie’s information systems on June 7, resulting in a data breach.
Although not officially confirmed, Google’s Threat Intelligence Group has linked the incident’s timing to cybercriminal group Scattered Spider, which has previously targeted retailers in the U.S. and U.K. Google has recently cautioned that the group may now be turning its focus toward the insurance industry.
Erie has yet to publicly confirm a ransomware attack or data breach. The company has only disclosed that on Saturday, June 7, its cybersecurity team detected unusual activity on its network and responded immediately to secure its systems and data. The disruption has left Erie’s systems offline since that date, affecting its phone lines, email, and digital services.
Plaintiff Plascencia claims he received an email from Erie in June informing him that his PII had been exposed as a result of the incident.
In its latest public statement on June 14, Erie Insurance reported that it was making “steady progress” in restoring its IT systems. However, it has not provided any new details regarding the nature, cause, or extent of the breach.
“Our teams—working in partnership with top cybersecurity professionals—are continuing to work around the clock to bring services back online for our customers, agents, and employees. While we are confident in the actions we’re taking, the process is complex and requires time. We thank you for your patience and understanding,” the company stated in its June 14 update.
A company spokesperson noted that Erie does not comment on active legal matters.
This is really concerning. Companies like Erie Insurance should be held accountable for protecting customer data better.
I think it’s too early to judge Erie Insurance without knowing all the facts. Data breaches can happen even with strong security measures.
Data breaches are becoming all too common. It’s good these lawsuits are pushing for better data protection policies.