BREAKING: Georgetown Alumna Files Class Action Lawsuit Over Data Breach

Mary Margaret Cleary (CAS ’14), current professor at the University of Virginia School of Law, filed a class-action lawsuit against Georgetown University on October 18, citing negligence after a data breach compromised sensitive personal information of current and former students. . The lawsuit alleges that Georgetown failed to properly secure and store personally identifiable information (PII), including Social Security numbers and tax identification numbers.

THE Voice contacted Cleary’s attorneys, but have not received a response at this time.

Georgetown University’s data management system, Ellucian, experienced a data breach between 8:00 a.m. on Wednesday, October 16 and 8:30 a.m. on Thursday, October 17, during which sensitive information was accessible to users of the university network, according to to an email from news director Doug Little. Data included current students and alumni dating back to 1990.

In a university-wide email, Little wrote that 29 recent or current students may have had access to unauthorized data, potentially compromising current and alumni information. The university has contacted those involved, asking them to delete all data obtained.

The lawsuit seeks damages, including monetary and punitive damages, and demands the creation of a fund to provide financial assistance to those affected. Cleary is also calling on Georgetown to improve its data security protocols, conduct annual security audits and offer credit monitoring services to anyone whose personal information has been compromised. Additionally, the suit requests that individuals be promptly notified of any future data breaches.

The lawsuit accuses Georgetown of five counts: negligence for failing to use safeguards to protect personal information, negligence per se in violating the Federal Trade Commission Act, breach of the implied contract between Georgetown students and the University, unjust enrichment of Georgetown through a monetary advantage in the form of personal information. , and declaratory and injunctive relief by requiring Georgetown to use personal information protection measures that comply with the law and industry standards.

Under the negligence charge, Cleary is suing Georgetown for 13 failures, including “failure to use systems and train employees to protect against unauthorized disclosure,” “failure to comply with industry standards for security software and servers” and “inability to properly update its systems during scheduled maintenance.

The legal complaint focuses on the risks posed to those whose personal information was exposed, noting that the data breach leaves individuals vulnerable to identity theft and fraud. Compromised data includes names, social security numbers, dates of birth and physical addresses.

“The exfiltrated personal information therefore remains in the hands of unauthorized individuals who have accessed the personal information and may exploit the personal information of Plaintiff and Class Members,” the lawsuit states.

In the lawsuit, Cleary alleges she has felt “anxiety and stress” since the breach due to an “increased risk of financial fraud, identity theft, fraud and other types of monetary loss due to the stolen information.”

“Plaintiff and Class Members are entitled to damages, including actual, compensatory, punitive, and nominal damages suffered as a result of the data breach, in an amount to be proven at trial,” the lawsuit states.

This story is ongoing and will be updated as more information becomes available.