University of Minnesota sued over massive data breach – MPR News

A lawsuit filed in federal court alleges the University of Minnesota failed to “establish appropriate security safeguards” for sensitive personal data in university records.

The U began investigating a potentially massive data breach in late July after the tech journal The Cyber Express reported claims that a hacker had potentially gained access to more than 7 million Social Security numbers.

The lawsuit, filed Friday in U.S. District of Minnesota on behalf of a former student and a former employee of the University, seeks class action status. If the court approves, others could join the suit.

The lawsuit claims the University violated the Minnesota Government Data Practices Act which prohibits releasing personally identifying information without consent.

The legal filing claims the stolen information includes records as far back as 1989.

“Exposure of this type of data puts individuals at a significant and prolonged risk of fraud and identity theft,” said Minneapolis attorney Brian C. Gudmundson in the filing.

Last week, U of M spokesperson Jake Ricker said the U would notify and offer resources to anyone affected by the breach. He said “the preliminary assessment is that the data at issue is from 2021 and earlier.”

Since that time, the school has improved security with additional monitoring and enhanced multi-factor user authentication, he said.

Asked for a response to the lawsuit on Wednesday, Ricker said the University does not comment on active litigation but added “I want to reiterate that the safety and privacy of all members of the University community are among our top priorities.”

The plaintiffs in the lawsuit are Geoff Dittberner, a former student and U employee from Inver Grove Heights and Mary Wint from Mora, who was a U of M employee for 20 years.

The plaintiff’s attorney did not immediately respond to an interview request.

Reporter Matt Sepic contributed to this story.