Lincoln-based Ameritas has agreed to pay up to $850,000 to settle a class-action lawsuit filed by a North Carolina woman over a 2019 data breach.Â
According to the settlement preliminarily approved by a federal judge in Lincoln this week, the class includes nearly 100,000 policyholders of the insurance and financial company whose personal information may have been accessed in a phishing scheme in May 2019.Â
Ameritas denied all liability and wrongdoing.
But, after extensive negotiations with a third-party mediator, the parties reached a settlement "that is fair, reasonable, and adequate," attorneys for both sides said in a court brief in support of preliminary approval of the settlement.
Asked for comment, a spokeswoman said Ameritas doesn't typically comment on litigation.
Ameritas has agreed to provide direct monetary relief to class members — which includes everyone to whom they sent notices about the incident in August 2019 — capped at $850,000 for reimbursement of expenses.
People are also reading…
Class members can claim lost time at $20 per hour for up to eight hours, for a total of $160. And they can seek reimbursement for unreimbursed, out-of-pocket expenses up to $6,250 with accompanying documentation. The company also is offering one year of triple-bureau credit monitoring and at least $1 million in identity theft insurance.
In addition, Ameritas has agreed to implement and/or maintain a series of ongoing data security and business practice enhancements through the end of 2024.
The $850,000 cap includes the cost of credit monitoring and maintenance of data security enhancements.
It also will include attorney fees, which the plaintiff hasn't yet sought, not to exceed $255,000, and $2,500 to Cynthia Weisenberger, who filed the lawsuit.
Notices will be sent directly to Ameritas policyholders who received the August 2019 letter and a website also will be set up where people can get more information.Â
In an order this week, Senior U.S. District Judge John Gerrard pointed out that if 10 of the class members filed claims for the maximum amount allowed, the cap would be exceeded. And if only half file a claim, each will receive on average $12.
"While it's not unprecedented for class actions to receive a low claim submission rate, neither is it ideal," Gerrard said.Â
The judge scheduled a fairness hearing in August to determine whether the proposed settlement is fair, reasonable and adequate and should be given final approval.
In the lawsuit, Weisenberger's attorney, Vince Powers, said she lost $280 due to fraudulent activity on her Amazon account that wasn't refunded, her bank had to replace her credit cards four times due to fraudulent charges and two of her email accounts were compromised as a result of cybercriminals accessing Ameritas's network in 2019.
She had a dental policy through the company.
In a letter dated July 23, 2019, Ameritas notified customers that several of its employees had fallen victim to phishing scams in May and early June, which tricked them into providing their email credentials.
The company said that after it discovered the breach, it "quickly addressed the exposure by disabling the unauthorized access and deployed a mandatory enterprise-wide password reset."
Ameritas said in the letter that information that may have been exposed included names, addresses, email addresses, Social Security numbers and policy numbers.Â