Two lawsuits allege Clark County was negligent in 2023 data breach

Two Clark County residents filed class-action lawsuits last week against the county, alleging the county did not properly protect residents’ information that was leaked during an October 2023 data breach.

A Seattle-based law firm filed a suit June 16 on behalf of James Reese of Battle Ground in Clark County Superior Court. A Sacramento, Calif.-based firm filed a similar suit June 17 on behalf of Jessica Hardwick, a Vancouver resident.

The suits allege negligence, breach of implied contract and unjust enrichment. In addition to unspecified damages, the lawsuits also ask a judge to order the county to pay for 10 years of credit monitoring services for those affected.

Last month, the county began notifying residents who’d been impacted by the data breach between Oct. 16 and Oct. 21, 2023. A mailed letter said an “unknown actor” gained access to the county’s network and stole data stored on some systems, including residents’ names, Social Security numbers, dates of birth, financial account information and health insurance information.

The county conducted an investigation to determine who was affected and what information had been stolen. Both Reese and Hardwick said in their suits they received a mailed letter dated May 29 saying the county determined their information may have been accessed during the breach. The letter also said the county is offering to pay for 12 months of credit monitoring services.

“Clark County takes this event and the security of the information in our care very seriously,” the letter states. “Upon detecting the event, we moved quickly to respond, securely restore our systems, assess the security of our network and investigate the event. Clark County also reported the event to law enforcement and is notifying state regulators, as required. As part of our ongoing commitment to information security, Clark County reviewed our policies, procedures, security tools and employee training programs to reduce the risk of a similar event occurring in the future.”

The county declined Monday to comment on the suits to The Columbian.

The lawsuits allege the county stored people’s information in a reckless manner that left it vulnerable to hackers. Hardwick detailed in her suit charges to her bank account that she said were fraudulent that had happened since the data breach.

“To date, (the county) has done little to provide plaintiff and class members with relief for the damages they have suffered because of the data breach, including, but not limited to, the costs and loss of time they incurred because of the data breach,” the suit states. “(The county) has only offered inadequate identity monitoring services, despite plaintiff and class members being at risk of identity theft and fraud for the remainder of their lifetimes.”

Becca Robbins: 360-735-4522; [email protected]; @brobbinsuo