Erie Insurance Facing 2 Class Actions Claiming Data Breach

Not one but two class action lawsuits have been filed against Erie Insurance even as the insurer continues to investigate its cybersecurity incident.

One lawsuit was filed by an Illinois customer, Neil Plascencia; the other by Amy Haas, a former Erie employee who lives in Wisconsin. Both claim Erie Insurance was negligent in not protecting their personally identifiable information (PII) and each seeks $5 million in damages.

Both actions assert that a ransomware group accessed Erie’s information network on June 7 and caused a data breach.

According to a report attributed to Google Threat Intelligence Group, the cybercrime group Scattered Spider could be behind Erie’s woes given the timing, although this has not been confirmed. Google has warned insurers that Scattered Spider, which had been attacking retailers in the U.S. and U.K., appears to be now going after insurers.

Erie has not yet publicly confirmed a data breach or a ransomware attack. The insurer has said only that on Saturday, June 7, its information security team identified unusual network activity and the company took immediate action to safeguard its systems and data. The insurer’s systems have been down since then. Phone, email, and online applications have been affected by the outage.

Plaintiff Plascencia maintains he received an emailed letter from Erie in June notifying him that a security incident exposed his PII to criminals.

In its most recent update on June 14, Erie Insurance said it was making “steady progress” in its efforts to restore its computer systems that have been down. It has provided no further information on the incident, its cause or effects.

“Our teams—working alongside leading cybersecurity experts—continue working around the clock to restore access for customers, agents and employees. We’re confident in our actions, but this work is complex and takes time. We appreciate your patience and understanding,” the insurer said in its June 14 update.

A spokesperson said the insurer does not comment on pending litigation.

Topics Lawsuits Cyber Data Driven