MarineMax settles data breach class action lawsuit for over $1 million

U.S. yacht retailer MarineMax has agreed to pay more than $1 million to settle a class action lawsuit that resulted from a data security incident the company suffered last year.

 

In March last year, MarineMax, one of the world’s largest yacht retailers, said it identified a cyber security incident where an unauthorised third party gained access to portions of its internal network.

 

MarineMax immediately launched an internal investigation, with assistance from third party cyber security experts to determine the nature and scope of the incident and notified relevant law enforcement authorities about the incident.

 

“Upon detection, the Company initiated its previously determined incident response and business continuity protocols and took immediate measures to contain the incident. As part of this process, the containment measures resulted in some disruption to a portion of the Company’s business,” the company said in a SEC filing.

 

The yacht retailer initially said that the systems affected by the cyber security incident did not store any sensitive personal data, but later confirmed in a separate filing that “some customer and employee information, including personally identifiable information,” was accessed during the incident.

 

A class action lawsuit was filed against the yacht retailer alleging the company failed to implement sufficient cybersecurity measures to prevent the data breach. To settle the lawsuit, MarineMax has agreed to pay $1,018,825.50 to cover all claims, settlement administration costs, attorneys’ fees and costs and any other expenses associated with the class action settlement.

 

Despite agreeing to pay the settlement amount, the company has denied any wrongdoing or liability.

 

The Rhysida ransomware group claimed responsibility for the cyber attack on MarineMax and listed the company as a victim on its data leak site. The group claimed to be in possession of sensitive personal data stolen from the company and threatened to leak it if its ransom demands weren’t met. It is unclear if the company paid a ransom to regain access to the stolen data.