Step 1:
In a striking legal development, a class action lawsuit has been filed against a prominent private university in Chicago for allegedly failing to protect sensitive personal information of its students and affiliates. The complaint was lodged by Joseph Bowes on November 5, 2024, in the United States District Court for the Northern District of Illinois against Saint Xavier University. This case brings to light significant concerns about data security practices at educational institutions.
According to the complaint, Saint Xavier University suffered a data breach that compromised personally identifiable information (PII), including names and Social Security numbers. The breach was first detected on August 26, 2024, although it is believed that unauthorized access began as early as June 29, 2023. Plaintiff Joseph Bowes claims that the university's failure to secure this information resulted in substantial risks of identity theft and other financial harms for himself and other affected individuals. "The exposed Private Information can—and likely will—be sold on the dark web," states the complaint, highlighting the potential long-term consequences of such breaches.
Bowes accuses Saint Xavier University of negligence and violation of federal and state statutes by not implementing adequate security measures to protect PII from unauthorized access. The plaintiff alleges that despite knowing about vulnerabilities in their systems, the university failed to act promptly or inform affected parties in a timely manner. As a result, Bowes argues that he and others have incurred out-of-pocket expenses related to identity theft prevention and mitigation efforts. The lawsuit seeks damages exceeding $5 million along with injunctive relief requiring the university to improve its data security protocols.
The legal action underscores growing scrutiny over how institutions handle sensitive personal data amid increasing cyber threats. It also raises questions about compliance with privacy laws such as Section 5 of the Federal Trade Commission Act, which mandates reasonable measures for protecting consumer information. In addition to monetary compensation, Bowes is seeking court orders compelling Saint Xavier University to enhance its cybersecurity infrastructure and practices significantly.
Representing Joseph Bowes are attorneys who specialize in complex class action litigation. The case is presided over by judges from the Northern District of Illinois under Case No. 1:24-cv-11388.