Arthur J. Gallagher & Co. (AJG) has agreed to settle a class-action lawsuit for $21 mn following a 2020 data breach that compromised personal information. Approximately one-third of the settlement fund is designated for attorney fees, pending final court approval.
The class action was proposed in 2021 and filed in 2022 on behalf of consumers whose personal identifiable information was exposed during a June 2020 cyberattack.
The breach compromised Social Security numbers, tax identification numbers, driver’s licenses, and other sensitive data.
The data breach, occurring between June 3 and September 26, 2020, exposed personal identifiable information (PII) such as Social Security numbers, tax identification numbers, driver’s license details, financial account information, and medical records.
AJG discovered the breach in September 2020, leading the company to take its systems offline, initiate response protocols, and hire a third-party cybersecurity firm to investigate. However, the lawsuit alleged that AJG failed to protect customer data and delayed notifying victims for nearly a year.
Under the settlement terms, class members are eligible for compensation up to $6,000 for documented losses related to the breach, including unreimbursed fraud, identity theft, professional fees, and credit expenses.
Alternatively, affected individuals can opt for three years of financial account monitoring services or a pro-rata cash payment. California residents are entitled to an additional payment of up to $100 under the California Consumer Privacy Act.
Class members also have the option to receive three years of financial account monitoring or a pro-rata cash payment.
Court filings indicate that over 3 mn individuals are eligible for compensation. If all participate, the payout would be approximately $6.01 per person, which is higher than most class action settlements.
A final approval hearing is scheduled for February 27.
