A massive data breach has rocked a professional services firm, leaving thousands of individuals vulnerable to identity theft and fraud. On March 11, 2025, Latasha Hammon filed a class-action lawsuit in the United States District Court for the Northern District of Illinois against Legacy Professionals LLP. The complaint alleges that the defendant failed to adequately protect sensitive personal information, leading to a significant cyberattack.
According to the lawsuit, Legacy Professionals LLP discovered the breach in April 2024 but did not notify affected individuals until February 27, 2025. The delay left many victims unaware of their compromised data for nearly a year. The breach exposed names, dates of birth, Social Security numbers, and other personally identifiable information (PII) stored within the firm's network. "Defendant disregarded the rights of Representative Plaintiff and Class Members by intentionally, willfully, recklessly and/or negligently failing to take adequate measures," states the complaint.
The plaintiff accuses Legacy Professionals LLP of violating several laws and regulations by failing to implement proper security protocols and neglecting to encrypt sensitive data. The complaint highlights that despite industry warnings about increasing cyber threats, the defendant did not take necessary precautions to prevent unauthorized access. This negligence has allegedly caused significant harm to Hammon and others affected by the breach.
Hammon seeks damages exceeding $5 million on behalf of herself and all similarly situated individuals across the United States. The lawsuit demands injunctive relief requiring Legacy Professionals LLP to enhance its cybersecurity measures and provide ongoing protection for victims' private information. Additionally, it calls for compensatory damages for lost time dealing with the aftermath of the breach and increased risk of identity theft.
Represented by attorney Laura Van Note from Cole & Van Note law firm in Oakland, California, Hammon is determined to hold Legacy Professionals LLP accountable for its alleged failure to safeguard personal data. The Case ID is: 1:25-cv-02551.