Lee University reaches $1.75M settlement over 2024 cyber attack

Lee University, based in Tennessee, has agreed to settle a class action lawsuit stemming from a 2024 data security breach.

 

In March 2024, Lee University said that it experienced a cyber security incident after an unauthorised actor gained access to parts of its network. The breach, which occurred on March 9, 2024, exposed sensitive personal information belonging to approximately 136,928 individuals. 

 

The compromised data varied by person but may have included names, Social Security numbers, driver’s license or other government-issued identification numbers, financial account information, and medical information. 

 

A class action lawsuit was filed in the District Court for the Eastern District of Tennessee following the cyber attack. The plaintiffs alleged that Lee University failed to implement reasonable security measures to protect their personal information. The lawsuit also alleged that the University failed to implement reasonable and appropriate cyber security measures, resulting in the data breach. 

 

While Lee University denied any wrongdoing or negligence, both sides agreed to settle the case to avoid the costs and risks of continued litigation and allow Class members to receive benefits under the settlement.

 

As part of the settlement, Lee University will create a $1.75 million settlement fund to pay eligible claims submitted by class members, in addition to covering settlement administration expenses, attorneys’ fees and costs, and any court-approved service awards.

 

Under the settlement, eligible class members who submit a valid and timely claim can receive one year of complimentary one-bureau credit monitoring services, regardless of whether they previously accepted the university’s earlier offer of credit monitoring. 

 

The settlement also provides two cash payment options: reimbursement of up to $5,000 for documented out-of-pocket losses related to the data breach, subject to a proportional reduction based on the number of valid claims, or an estimated $100 cash payment for those without documented losses, with the final amount also subject to a proportional adjustment depending on the total number of approved claims.

 

The proposed settlement has been granted preliminary approval by the court but has not yet become final. A final approval hearing is scheduled for September 3, when the court will decide whether to approve the settlement.