Mercer University data breach leaked personal information of 93k people, lawsuits say
Two federal lawsuits filed against Mercer University last week claim the school allowed the data of more than 93,000 people to be exposed in an April data breach, court documents show.
The two suits also claim that Mercer could have easily prevented the hack and did not notify people who had their personal information stolen for roughly three months. The data leaked in the breach contained Social Security numbers, driver’s license numbers and names, according to the lawsuits.
A lawsuit filed Friday in the Northern District of Georgia by Jennifer Kilkus, a Yale professor living in Connecticut who taught courses at Mercer in 2016 and 2018, alleges that the university experienced a data breach sometime between Feb. 12 and Feb. 24.
The school learned of the breach on April 5 but did not notify people impacted until May 19, the suit said.
Kilkus is demanding a jury trial against Mercer in her class-action lawsuit, alleging the breach “was highly foreseeable, yet Mercer failed to take reasonable precautions” and that she suffered “concrete injuries.”
The other lawsuit, filed Wednesday by an anonymous “John Doe” in the Northern District of Georgia, claims the data breach led to fraudulent credit card charges, according to court documents. “John Doe” is described as a Mercer alumnus living in LaGrange, Georgia, that had data stolen.
The “John Doe” case also demands a jury trial. The attorney for that suit told the Atlanta Journal-Constitution that more plaintiffs would soon be added.
The data breach created a stir among students at Mercer when news of it broke in early May after the school’s internet suffered a three-day outage in April.
Mercer declined to comment on the lawsuits Tuesday through a spokesperson. The university did comment on the breach in a May 9 statement.
“Although the University has taken extensive measures to protect the privacy of its information, some data — Social Security numbers and driver’s license numbers — were removed from its systems without authorization,” the school said. “Mercer is notifying students, faculty, staff and parents whose personal information may have been involved.”
This story was originally published June 6, 2023 at 1:34 PM.