Clients sue Pompano company over data breach

A Pompano Beach-based business services company, ComplyRight, was sued in two separate federal court actions just days after notifying clients that their personal information was exposed in a data breach.

The company sent letters to customers on July 13 stating that names, addresses, telephone numbers, email addresses and Social Security numbers were “accessed and/or viewed” in what it called “unauthorized access” of its website between April 20 and May 22. It said it was unaware of any identity fraud resulting from the breach and told letter recipients they were entitled to 12 months of free credit monitoring.

A week after sending the letter, five Chicago attorneys sued the company in the Northern District of Illinois on behalf of Susan Winstead, identified in the suit only as a resident of Illinois. Winstead received a letter from ComplyRight on July 17, three days before the suit was filed on July 20, the suit said.

The suit cites a nearly twomonth lag between when ComplyRight said it discovered the data breach and when it sent the notification letters, saying the company kept the incident secret during its forensic investigation and gave the data thieves three months since the breach began “to perpetuate fraud … with no victim aware of the threat.”

The number of victims is unknown, the suit said, but “Plaintiff has reason to believe that the number of impacted individuals is very large.”

On July 26, Fort Lauderdale attorney Seth M. Lehrman of the firm Edwards Pottinger LLC filed a suit in U.S. District Court in Fort Lauderdale on behalf of plaintiffs Robert Bohannon of Granger, Ind., and Holly Buckingham of Woodbine, Md.

The suit did not claim that identity thieves had impersonated Bohannon or Buckingham, or that they had suffered financial damages beyond the fact that “Buckingham has spent at least two business days expending effort to ensure her Personal Information is not used by the hackers and that her identity is not stolen.”

Bohannon and Buckingham were “injured,” the suit stated, because ComplyRight “failed to adequately safeguard” their personal information.

Likewise, Winstead and other members of the class suffered “injuries and damages” because they are now at increased risk of identity theft and fraud and because of expenses and the value of their time spent mitigating the increased risk of fraud.

None of the attorneys responded to emails from the Sun Sentinel seeking comment about the suit. ComplyRight also did not respond to requests to discuss this story, or the initial report about its data breach notifications.

ComplyRight provides human resources services for small businesses.