A plaintiff has filed a class action lawsuit against a university for allegedly failing to protect sensitive personal information from a data breach. On November 5, 2024, Iridian Martinez lodged the complaint in the United States District Court for the Northern District of Illinois against Saint Xavier University. The case centers around a cyberattack that exposed the personal data of numerous individuals.
The lawsuit claims that between June 29 and July 18, 2023, an unauthorized actor accessed Saint Xavier University's network and extracted sensitive information, including names and Social Security numbers. According to the complaint, Saint Xavier University only notified affected individuals on October 30, 2024—over sixteen months after the breach occurred. The delay in notification is one of several issues highlighted by Martinez, who argues that this lapse left victims vulnerable to identity theft and fraud without adequate warning or protection.
Martinez accuses Saint Xavier University of negligence in safeguarding personal information and failing to implement reasonable cybersecurity measures. The lawsuit contends that the university's inadequate security protocols directly resulted in the data breach. It further alleges that Saint Xavier University maintained its computer systems in a manner susceptible to cyberattacks and failed to monitor its networks effectively. As a result, hackers were able to access private information undetected for an extended period.
The plaintiff seeks various forms of relief from the court, including actual damages, compensatory damages, nominal damages, and reimbursement for out-of-pocket expenses incurred due to the breach. Additionally, Martinez requests injunctive relief to prevent future breaches and demands lifetime credit monitoring services for all affected individuals.
Representing Martinez are attorneys Andrew J. Shamis and Leanna Loginov from Shamis & Gentile P.A., based in Miami, Florida. The case is identified as Case No. 1:24-cv-11405.