Georgia university leaders waited three months to disclose data breach, lawsuits claim
A data breach at Mercer University last April exposed the personal information of more than 93,000 people and leaders at the Macon, Georgia, school waited an inordinately long time before notifying affected parties, according to two lawsuits filed last week.
Two lawsuits filed in the Northern District of Georgia claim Mercer leaders failed to prevent the cyberattack when they could have done so and that they waited roughly three months before notifying affected parties, the Atlanta-Journal Constitution reported.
One lawsuit was filed Friday by Jennifer Kilkus, a Yale professor who taught at Mercer in 2016 and 2018. According to her suit, the university’s data breach occurred between Feb. 12 and Feb. 24, but the university didn’t disclose the breach until May 19.
A second anonymous lawsuit, which claims the data breach led to fraudulent credit card charges, demands a jury trial.
The lawsuits follow a three-day outage of services last April. A group called “Akira” claimed responsibility for the attack, which exposed Social Security numbers and driver’s license data, among other personal information.
