Mercer University agrees to settle lawsuit over hack that affected students, staff
Mercer University has agreed to settle a lawsuit with former students and an instructor after people in the campus community were victims of a hack that exposed personal information, according to court records filed Thursday.
Multiple lawsuits filed in federal court alleged that a data breach from Feb. 12, 2023, to Feb. 24, 2023, allowed people to get access to more than 93,000 Mercer University’s student and employee’s names, social security numbers and driver’s license numbers. Students and employees had learned of the breach in April but were notified of the breach by the university on May 19.
The university recently agreed to resolve the lawsuit by paying damages to those affected by the breach. It’s unclear how many were affected, but the class-action lawsuit settlement would allow those harmed to seek payback from Mercer.
The separate lawsuits were merged into one last month, according to court records. Students Ping Wang, Ana Lehnes, Emily Ramos and a John Doe who was described as an alumnus were among the plaintiffs. One instructor, Jennifer Kilkus, also was a plaintiff.
Although Wang, Lehnes, Ramos, Kilkus and the anonymous alumnus are named in this lawsuit, the class-action settlement could allow more affected students or university staff to come forward.
The settlement, which all parties agreed to, includes:
- $450 for out-of-pocket losses and lost time spent responding to the incident
- $5,500 for extraordinary out-of-pocket losses from identity theft and fraud relating to the breach
- Two years of three-bureau credit monitoring services with Equifax, Experian or Transunion and identity theft insurance.
The monitoring will include dark web scanning that would immediately notify users if the use of someone’s personal information was detected, the agreement states.
High cost for more data security
Mercer University also agreed to pay an estimated $800,000 to implement data security-related measures to protect students’ and employees’ information from being leaked again. The university also will pay administrative costs, as well as attorney’s fees, and expenses up to $300,000.
The people suing Mercer and the university all got Epiq, a class-action settlement administrator, to serve as their claims administrator, the agreement states. With Epiq, a settlement website would be created and would contain notice forms, claim forms and other information that would assist affected students and instructors in understanding the conditions of the settlement.
Although everyone involved has agreed to settle, a federal judge will have to confirm settlement conditions and close the case at a future court hearing.
