Lighting and building management firm Acuity Brands discloses two data breaches

Lighting and building management firm Acuity Brands, which employs roughly 13,000 people and operates in North America, Europe, and Asia, has disclosed two data breaches in recent years.

In a data security incident notice, the Atlanta, Georgia-based firm said early in December 2021; it learned that someone had accessed its systems without authorization and stolen data. A different, unrelated breach that occurred in October 2020 that involved attempts to copy files from compromised systems was accidentally discovered during the investigation into the incident.

The exposed information belonged to current and former employees and Acuity’s health plan members. The information included name, Social Security number, financial account information, Acuity health plan information, driver’s license number, limited health information, and other details related to employment. However, there is no indication that customer information was stolen.

Although the data security incident notice does not mention ransomware, reports suggest that the 2021 cyber attack might have been carried out by the notorious Conti ransomware group, stating that Red Packet Security’s ransomware website archives list out some of the leaked data allegedly stolen by Conti from Acuity in January 2022. Reports say that file names suggest that information is related to human resources and finances.

Reports say these security incidents may result in legal action against Acuity Brands. On Wednesday, a California-based class law firm issued a press release urging those affected to contact them.