U.S. accounting firm settles major data breach lawsuit for $7.25 million

U.S.-based accounting firm Berry, Dunn, McNeil & Parker has agreed to pay $7.25 million to settle a class-action lawsuit associated with the breach of the personal information of over 1.1 million individuals.

 

The Maine-headquartered accounting and consulting service provider agreed to the settlement after facing significant backlash over a data security incident it suffered in 2023 that compromised the sensitive personal information of more than 1.1 million individuals. 

 

The company previously informed the Office of the Maine Attorney General that on September 14, 2023, one of its vendors, Reliable Networks of Maine, identified suspicious activity in its internal network that affected the internal systems of the company and HAPG. Reliable is a service provider for BerryDunn’s Health Analytics Practice Group (HAPG).

 

BerryDunn immediately launched an investigation, with assistance from third party cyber security experts, to determine the nature and scope of the incident.

 

“The investigation found that an unauthorised actor gained access to Reliable’s network and took some data stored on the HAPG systems,” the company said.

 

The compromised data included names, addresses, dates of birth, Social Security numbers, health insurance policy numbers, Medicare or Medicaid numbers, state or governmental ID numbers, passport numbers, and medical information.

 

The filing with the Maine state regulator also revealed that at least 1,107,354 individuals were impacted by the data security incident.

 

Recently, a class-action lawsuit filed against the accounting firm in the U.S. District Court of Maine alleged that the firm failed to adequately safeguard the personal and private health information of its customers.

 

“Berry Dunn waited seven months to notify the public that they were at risk. As a result of this delayed response, Plaintiffs and Class Members had no idea for seven months that their Private Information had been compromised, and that they were, and continue to be, at significant risk of identity theft and various other forms of personal, social, and financial harm. This risk will remain for their respective lifetimes,” the lawsuit reads.

 

Under the terms of the settlement, class members may submit a claim for up to $5,000 by May 22. Furthermore, class members will receive 3 years of complimentary credit monitoring and identity theft protection services worth $270.