Residents file lawsuits claiming Clark County mishandled private information in data breach

Two Clark County residents filed class-action lawsuits against the county last week, citing improper protection of residents’ information in a data breach dating back to October 2023.

A lawsuit was filed by a Seattle-based law firm on behalf of James Reese on June 16. Additionally, a California-based firm filed a similar suit on June 17 on behalf of Jessica Hardwick.

Clark County data breach

Both suits allege breach of implied contract, negligence, and unjust enrichment. The lawsuits also call for a judge to order Clark County to pay for 10 years of credit monitoring services for those affected, according to The Post-Record.

Clark County notified residents who had been impacted by the data breach in a mailed letter in May. The letter stated that an “unknown actor” accessed the county’s network and stole stored data, including residents’ names, Social Security numbers, dates of birth, and both financial account and health insurance information.

“Clark County takes this event and the security of the information in our care very seriously,” the letter stated. “Upon detecting the event, we moved quickly to respond, securely restore our systems, assess the security of our network, and investigate the event.”

An investigation was conducted by Clark County to determine who was affected and the specific information that was stolen. Reese and Hardwick mentioned in their lawsuits that the letter they received claimed their information may have been accessed in the breach.

“Clark County also reported the event to law enforcement and is notifying state regulators, as required,” the letter stated. “As part of our ongoing commitment to information security, Clark County reviewed our policies, procedures, security tools, and employee training programs to reduce the risk of a similar event occurring in the future.”

Both lawsuits allege that Clark County recklessly stored residents’ information, which was vulnerable to hackers. In Hardwick’s lawsuit, she noted that fraudulent charges to her bank account were recognized after the data breach.

“(The county) has only offered inadequate identity monitoring services, despite plaintiff and class members being at risk of identity theft and fraud for the remainder of their lifetimes,” the suit stated.

Follow Jason Sutich on X. Send news tips here.