2 class action lawsuits alleging data breach filed against Bloomington company
A Bloomington-based customer engagement agency that is also known for its role in debt collections is the subject of two class action lawsuits that allege the company did not properly notify more than 260,000 people of a data breach in July 2021.
Both lawsuits contend the company, Afni, knew of a data breach that month yet waited 12 more months before telling its employees and other affected people that identifying information had been leaked online, including social security numbers, birth dates and addresses.
When the company did notify the roughly-261,449 people affected that their data had been leaked, "it obfuscated its nature and downplayed the threat to victims, telling them that hackers only 'may' have viewed or stolen their data and that Afni was only notifying them about the breach 'out of an abundance of caution,'" according to one federal complaint filed by a former employee.
Even when notified, victims were not told why it took the company 12 months to alert them that their personal information had been compromised, and whether any data was recovered, according to that same complaint.
One lawsuit was filed in late July on behalf of Marian Caldwell Powell, a woman who provided her personal identifying information (PII) to Afni, and found out via a letter that it had been leaked. Caldwell Powell's lawsuit alleges negligence on Afni's part for not protecting personal data and that she would "not have allowed Afni to have access to her PII if she had known Afni would not adequately protect her PII."
Another federal complaint was filed on Monday by a Normal woman, Nicole Prochnow, who previously worked for the company.
Her filing said she was only notified on June 14 that her data had been leaked, despite the leak having occurred nearly 12 months earlier, and that her identity had been stolen seven times as a result.
Neither Afni nor the attorneys for Caldwell Powell or Prochnow responded to requests for comment.