Parent Files Class-Action Suit After Data Breach Exposes Nearly 1 Million Schoolchildren's Personal Information

CHICAGO (CBS) -- A mother filed a federal class-action lawsuit on her daughter's behalf Thursday, after nearly a million students nationwide had their personal information exposed in a data breach by a company used to track student academic progress.

The Indian Prairie School District 204 in Naperville was among the academic districts affected.

[scribd id=424634772 key=key-UJrrSNwG96xAvrx5ooRu mode=scroll]

The woman, identified as Kylie S., was seeking class-action status in the lawsuit filed in U.S. District Court in Chicago against Pearson Clinical Assessment. Kylie S. sued on behalf of her daughter, K.S., and on behalf of "all other similarly situated individuals."

The lawsuit said in November 2018, the data breach affected nearly 1 million students enrolled in about 13,000 schools in at least 13 states. Among the data stolen were first and last names, dates of birth, email addresses, and unique student identification numbers.

Last month, Indian Prairie School District 204 in Naperville said the information stored for 49,000 students and 2,300 teachers was exposed in the Pearson data breach.

According to Pearson, the data was from the 2001 to 2016 school years.

The suit said Pearson Clinical Assessment failed to have systems in place to protect the breach, and only took action after the FBI got involved and informed the company in March of this year.

"Even then, Pearson concealed its knowledge of the breach from students and their guardians until July 2019 when Pearson Clinical finally notified impacted schools and released a public statement," the lawsuit said. "In disclosing the Data Breach, Defendants concealed the true extent of the breach to minimize the impact on their reputations."

The suit said Pearson first claimed that the data breach was isolated to victims' first and last names, and "in some instances" dates of birth and/or email addresses – when in fact, student identification numbers were also exposed and the exposure of dates of birth and email addresses was far greater than Pearson claimed.

Pearson said it had no evidence that the data had been misused, but "tacitly acknowledged the actual and certainly imminent injuries suffered by victims of the Data Breach by offering such victims one year of complimentary credit monitoring services," the lawsuit said.

The suit claimed that because of Pearson's negligence, those who had their personal information exposed will be subjected to "a never-ending threat of identity theft, extortion, bullying and harassment." The students who were affected will now have to place fraud alerts and security freezes on their credit reports, monitor their credit reports for unusual activity, and get new student identification numbers while changing email addresses and account passwords, the suit said.

The suit also accused Pearson of failing to comply with Federal Trade Commission security requirements.

The lawsuit accused Pearson negligence, breach of express and implied contract, unjust enrichment, intrusion upon seclusion, and for Illinois plaintiffs, violations of Illinois fraud, deceptive trade, and personal information protection laws.

The suit called for "all monetary and non-monetary relief allowed by law, including injunctive relief and reasonable attorneys' fees."

Pearson bills itself as the "world's learning company" and operates in all 50 states and several dozen countries, according to the law firm Loevy & Loevy, which filed the suit.

Published reports indicated that the breach affected students in Arizona, Colorado, Connecticut, Delaware, Florida, Georgia, Illinois, Missouri, New York, North Dakota, Pennsylvania, and South Carolina, Loevy & Loevy said.