Mercer University settles lawsuit over data breach, agrees to compensation

Georgia-based Mercer University has reached a settlement in a lawsuit stemming from a February 2023 data breach that compromised the personal information of over 93,000 individuals. The settlement includes monetary compensation, credit monitoring services, and enhanced data security measures.

According to court documents filed on Thursday, the breach exposed sensitive data, including students’, employees’, and alumni’s Social Security numbers, and driver’s license details. The breach occurred between February 12 and February 24, 2023, but affected parties were notified only on May 19, sparking multiple lawsuits. These lawsuits were consolidated last month into a single class-action case.

Under the settlement terms, Mercer University has agreed to compensate individuals for financial and time losses incurred due to the data breach, offering up to $450 for documented out-of-pocket expenses and lost time and up to $5,500 for extraordinary losses resulting from identity theft or fraud. Additionally, the university will provide two years of credit monitoring and identity theft insurance through Equifax, Experian, or TransUnion, including dark web scanning services to promptly alert individuals if their personal information is detected in unauthorized use.

The plaintiffs include former students Ping Wang, Ana Lehnes, Emily Ramos, an anonymous alumnus identified as John Doe, and instructor Jennifer Kilkus. While these individuals spearheaded the lawsuit, the settlement terms extend benefits to all affected individuals, allowing others to file compensation claims.

Mercer has also committed to spending approximately $800,000 on data security upgrades to prevent future breaches. Additional expenses, including legal fees and administrative costs, will total up to $300,000. The university’s partnership with Epiq, a class-action settlement administrator, will ensure that affected individuals receive clear guidance on claim submissions and settlement conditions via a dedicated website.

While the parties involved have agreed to the settlement, it remains subject to final approval by a federal judge in an upcoming court hearing. If approved, this settlement marks a significant step toward resolution for those impacted and underscores the growing emphasis on institutional accountability in safeguarding personal data.