Lansing Community College faces lawsuits over data breach
LANSING — Lansing Community College is being sued over a data breach that may have exposed the names and Social Security numbers of hundreds of thousands of students and employees, including those who haven't attended or worked there for decades.
The college is facing at least four lawsuits filed in federal court this week, according to court records.
The lawsuits, filed in U.S. District Court for the Western District, claim the college did not encrypt Social Security numbers, retained personal data on former students and staff for too long and did not follow best practices for data security.
"There has been no assurance offered by LCC that all personal data or copies of data have been recovered or destroyed, or that defendant has adequately enhanced its data security practices sufficient to avoid a similar breach of its network in the future," according to one of the lawsuits, filed on behalf of Ayden Heinig, Ashton Chapin, Kyashya Richardson and Gabriel Banish. Their affiliation with the school was not outlined in the lawsuit.
Three of the lawsuits were filed on behalf of Daquarious Alexander, Sameer Shah and Ivory Whitby. Whitby, according to the lawsuit, last attended the school in 1994.
The lawsuits seek class-action status, which the court could grant if it believes there are more than $5 million in damages and more than 100 people affected.
Lansing Community College said it has "no evidence of any identity theft or fraud in connection with this incident." Spokeswoman Marilyn Twine has declined to confirm how many people were affected by the breach, although she attested to Maine regulators that 757,823 people were affected in the breach, including 18 Maine residents.
She would also not say how many letters the school sent notifying people who may have been impacted by the breach. She declined to make President Steve Robinson or other college officials available to answer questions about the breach.
On Thursday, Twine said in an email that "Lansing Community College is unable to comment on any pending litigation."
The school, in a letter to its community, said an investigation of "suspicious activity on its computer network" was completed on May 24, and found that between Dec. 25, 2022, and March 15, 2023, "an unauthorized actor may have had access to certain systems."
The college shut down for several days in March after discovering the breach.
The college has not said what years were impacted by the data breach, but the State Journal has spoken with people who said they last attended the college more than 30 years ago and have gotten letters saying their data may have been exposed.
It's not clear why the school waited more than a month after the investigation was completed to notify the public.
The college is offering a year of credit monitoring service to people who had data potentially exposed and who sign up for the program.
Michigan's Attorney General's office said having Social Security numbers compromised is the "worst-case scenario" in a data breach.
Three of the lawsuits were filed by Chicago-based Milberg Coleman Bryson Phillips Grossman. The firm was joined by Siri & Glimstad LLC of New York and Federman & Sherwood of Oklahoma City some of the litigation. The fourth lawsuit was brought by The Miller Law Firm of Rochester, Michigan and Shub & Johns LLC of Conshohocken, Pennsylvania.
Contact Mike Ellis at mellis@lsj.com or 517-267-0415
This article originally appeared on Lansing State Journal: Lansing Community College faces lawsuits over data breach
