Last year, the Maricopa County Community College District suffered a data breach in April, but waited until November before advising former students and employees that their academic and/or personal data may have been compromised. Approximately 2.4 million people were impacted by this breach, or roughly the population of Pittsburgh, Pennsylvania. Among the data that may have been breached were social security numbers, dates of birth, and bank account numbers.
Recently, a current student of Phoenix College sued the College District in Maricopa County Court, making a number of allegations, including that the College District was warned by the FBI in January of 2011 that a number of its databases had been breached and made available for sale on the internet and that the College District’s IT department knew of the breaches but failed to report their findings. The lawsuit alleges that the College District’s most egregious act was its failure to notify victims of the breach in a reasonable or timely manner. The lawsuit seeks class certification, compensatory damages, and other causes of action. Other lawsuits have also been filed against the College District arising out of data breaches.