The News Tribune
Shae Johnson
Updated March 6, 2025
The Pierce College District will pay $1.2 million to settle a class-action lawsuit that arose from a cyberattack two years ago, compromising the personal data of more than 150,000 current or former students, staff and college applicants.
In a lawsuit filed in Pierce County Superior Court after the data breach was discovered in summer 2023, 17 current or former students and employees alleged that the college failed to maintain adequate security protocols.
The college, they said, enabled their personal information to be stolen by cybercriminals and leaked onto the dark web, violating their privacy, causing anxiety and forcing them to spend hours reviewing financial accounts for signs of identity theft or fraud.
Sally McAuley, a plaintiff who attended the college around 2022 and 2023, alleged that she experienced a substantial uptick in spam calls and emails from bad actors and that an unauthorized person tried to use her and her husband’s credit and debit cards to submit an online payment request in their name, leading to the cards being canceled.
Following the data breach, the Pierce College District, which denied wrongdoing, offered a free one-year membership to Experian to assist with detecting fraud and protecting identity.
In a settlement approved Feb. 28, the district agreed to pay $1.2 million and improve its data security, which the college said it had already been working on. The resolution impacts the lawsuit’s named plaintiffs as well as settlement class members who filed nearly 3,000 claims before an advertised deadline expired, according to attorney Tim Emery, who represented the plaintiffs in the case.
In an interview Wednesday, Emery celebrated the settlement as a “big win” for those affected by the cyberattack and alleged that Pierce College had “played ostrich” instead of resolving the breach upon learning of it.
The settlement showed the college’s willingness to make amends, he added.
“In my view, Pierce College did the right thing by their former students and teachers, and this puts this issue to rest but also ensures that future students, teachers and enrollees won’t be at risk for a breach of their personal information,” Emery said.
Pierce College, the largest college district in Pierce County, serves more than 13,500 students per year and maintains campuses in Lakewood and Puyallup.
The district’s legal counsel, Benjamin Wanger, said that the college took immediate steps to secure its network and commenced an investigation, according to a letter he wrote in September 2023 to the state Attorney General’s Consumer Protection Division.
“I’m really happy that we have kind of the whole situation behind us,” Pierce College Chancellor and CEO Julie White said in an interview Wednesday.
While the settlement payout was covered by insurance, the district has paid additional costs to beef up security, according to White, noting that she didn’t want to offer specifics due to security concerns.
The college has worked alongside industry-leading security groups and implemented proactive monitoring and threat mitigation, among other typical security enhancements such as multi-factor authentication, she said.
Some security upgrades were in the process of being implemented, White added, when the college identified suspicious activity within its network on July 24, 2023. A subsequent investigation found evidence that unauthorized actors had acquired certain files on the network between July 23, 2023 and July 24, 2023.
On Sept. 8, 2023, the district notified anyone whose information may have been jeopardized. That group consisted of 155,811 Washington residents described by White as current or former students and staff and people who may not have attended the college but started the enrollment process.
The data breach compromised individuals’ names, Social Security and driver’s license numbers, financial and banking information and full date of birth, according to the state Attorney General’s office’s website that tracks data breaches reported to it by entities such as public agencies.
More than a week after the incident, the college’s electronic systems were down amid the district’s investigation into what it then described as a “service disruption.”
“All in all, it’s hard to find positives in this of course…but I would say it certainly helped all of us understand the importance of staying on top of this,” White said. “I do think that we are in a much better place.”
The $1.2 million settlement will pay out claims for lost money or time, fund claims for three years of identity theft protection and credit monitoring services, award $61,000 in total to the named plaintiffs and cover $400,000 in legal fees, according to Emery and court records.
Read the original article here.
