A class action complaint was filed against the International Brotherhood of Electrical Workers (IBEW) labor union for a data breach that occurred between March 31 and April 5, 2024. IBEW represents individuals who work in a wide variety of fields, including utilities, construction, telecommunications, broadcasting, manufacturing, railroads, and government. The security incident resulted in unauthorized access to the names and social security numbers of current and former members of IBEW.

This incident resulted from a ransomware attack led by the cybercriminal group BlackSuit, which was part of a larger attack on many other businesses in March 2024. Most recently, this group attacked CDK Global,] a major automobile software vendor, which affected car manufacturers nationwide.

IBEW notified affected individuals of the breach on or about August 5, 2024; the incident was initially discovered on July 3, 2024. The class action complaint, filed in the U.S. District Court for the Eastern District of Missouri, alleges that this “delay” caused harm to the affected individuals.

The lead plaintiff, a retired electrician from Illinois, claims that IBEW’s delay resulted in the loss by the class “of the opportunity to try and mitigate injuries in a timely matter.” Further, in the notification to the affected individuals provided by IBEW, the union disclosed that the incident “created a present, continuing and significant risk of suffering identity theft.”

The complaint further alleges that IBEW failed to follow the Federal Trade Commission’s 2016 guidelines for businesses regarding fundamental data security principles, and that the incident constituted a violation of the federal unfair trade practices act. The complaint also includes allegations that the IBEW acted negligently, breached its implied contract with its current and former members, and violated the Illinois Consumer Fraud Act.