WSU settles class action suit over 2017 hard drive theft

A King County judge on Thursday approved a settlement in a class-action lawsuit against Washington State University over a potential data breach in April 2017.

WSU and its insurers agreed to pay up to $5.26 million and provide potential victims an additional two years of free credit monitoring.

The suit stemmed from a burglary at an Olympia storage facility in which someone stole a safe containing a hard drive, which in turn contained sensitive information on nearly 1.2 million people, including names, Social Security numbers and personal health records.

The data had been collected by WSU’s Social and Economic Sciences Research Center, which has offices in Pullman and the state capital. The burglary remains unsolved, and it’s unclear if criminals have accessed any of the stolen data or if they knew they were stealing it in the first place.

Plaintiffs – many of whom were surprised to learn that WSU had their personal information – accused the university of negligence for storing the hard drive in an unsecure location.

“While Washington State University disputes the claims made in the suit, the university has concluded that continued litigation would be even more expensive and time-consuming,” WSU spokesman Phil Weiler said in an email. “As a result, WSU has entered into an agreement to provide plaintiffs with additional credit monitoring and insurance services, as well as pay for certain lost time related to the theft and documented out-of-pocket costs.”

Weiler said the bulk of the settlement payments will come from a private cybersecurity insurance policy, and some may come out of a state risk pool.

“The actual amount of the settlement will depend on how many individuals file claims,” he said.

WSU also agreed to destroy all the sensitive information it had on those who might have been affected by the data breach. Weiler said that would have no impact on the research center’s work moving forward.

The school no longer stores such information in rented self-storage units.

James Bulthuis, an attorney with Tousley Brain Stephens in Seattle, one of several firms that represented the plaintiffs, called the settlement “a great result” for those potentially affected, “but also for others whose private information WSU receives in the future.”