The City of Oakland, located in California, has decided to resolve a lawsuit due to a ransomware attack and data security breach that impacted over 13,000 present and past employees. The City discovered the attack in February 2023, and sent breach notification letters to the impacted employees at the beginning of March 2023.
The Play ransomware group professed to be behind the cyberattack that compelled the city to deactivate its IT systems and announce a state of emergency. The ransomware group published the stolen information on its data leak site after the city declined to pay the ransom. The exposed information included the personal data of people hired by the city from July 2010 to January 2022. The ransomware group was able to get access to the system because of employees who fell for the phishing emails.
The city is currently facing several lawsuits associated with the breach. Allegedly, the city was negligent when it did not implement proper safety measures to secure its system and data. The city claims that it did not commit any wrongdoing; nevertheless, it consented to resolve the lawsuit to stop additional legal expenditures and steer clear of the risks and concerns related to any lawsuit or HIPAA violation. The city had provided free credit monitoring and identity theft protection services to the impacted persons; nonetheless, those services were also provided to all class members eligible to receive three years of three-bureau credit monitoring services.
The settlement likewise consists of payment for out-of-pocket expenditures and lost income resulting from the breach. Claims may be filed for compensation of ordinary losses, which include credit reports and credit monitoring expenses as much as $350 per individual. Claims for approximately three hours of lost time valued at $25 per hour may also be filed. Claims could also be filed for extraordinary expenses around $10,000 per claimant, including recorded losses to identity theft and fraud. Persons who worked in law enforcement will get a $175 cash payment, irrespective of whether they sustained any losses.
The court has released its preliminary approval of the settlement. The schedule of the final fairness hearing is June 3, 2025.