Software firm tied to Washington state auditor’s office data breach sued

(The Center Square) — A lawsuit alleges a software firm tied to a data breach of the Washington state auditor’s office willingly made itself a target for cyber theft.

The 19-page class-action lawsuit filed in King County Superior Court on Tuesday alleges the file-transfer service provider used by the Washington state auditor’s office, Accellion, knowingly used outdated technology which was “nearing end-of life” and vulnerable to compromise.

It further alleges this was evidenced by the California web firm informing its customers to upgrade to its latest file-sharing program, kite works, “to add a critical layer of security.”

The data breach in question exposed an estimated 1.6 million people’s personal information on Christmas Day of 2020, according to State Auditor Pat McCarthy. That information included names, social security numbers, and bank information of thousand of jobless claim filers, McCarthy said in a statement on Tuesday.

The lawsuit also cites findings by the U.S. Government Accountability Office that stolen personal data may be held by cyber criminals for up to a year before being in cyber theft or sold to other criminal parties. That scenario, the lawsuit alleges, also sets up claimants for immeasurable impending harm.

“Defendant was aware that FTA was an inadequately secure product, yet sold this vulnerable product to (the auditor’s office) for the transfer of Personal Information,” the lawsuit states.

The class-action lawsuit names Jason Stahl, a King County jobless claimant who filed for unemployment benefits last year, as its lone plaintiff. It does not name the state auditor’s office, which paid Accellion $17,000 a year for its services, as a defendant in the lawsuit.

Stahl is being represented by Tousley Brain Stephens law firm in Seattle and is claiming damages related to the costs of credit inquiries and lowered credit scores in addition to identity theft detection and prevention services.

McCarthy said on Tuesday the state auditor’s office became aware of the data breach as far back as January 12. Her office has not clarified why the incident was not made public until Monday, February 1.

Disclaimer: This content is distributed by The Center Square