Past and current employees of the Manatee County school district will soon receive notice that a $300,000 settlement is in the process of being finalized after the inadvertent release of payroll information left thousands vulnerable to tax fraud and identity theft last year.
Manatee Circuit Judge Lon Arend granted preliminary approval of the settlement on Thursday. About 7,700 affected people will receive a notice in the mail, and a final hearing will take place Sept. 13.
A lawsuit against the school board followed the incident on Jan. 26, 2017, when two payroll employees fell for a phishing scam. Someone posed as Superintendent Diana Greene and sent an email that requested district employees’ 2016 W-2 forms. The scammer soon received names, addresses, ZIP codes, social security numbers and other sensitive information, according to the civil complaint.
“The Data Disclosures occurred because Defendant failed to implement rather simplistic, adequate and reasonable cyber-security procedures and protocols, and simple common sense,” the complaint states.
More than a dozen people, the complaint said, fell victim to tax fraud and/or identity theft.
The settlement class includes all current and former district employees whose W-2 data was compromised as a result of the security breach. Each member will have the chance to file several claims, each worth $150 to $500.
Both parties in the suit came to an agreement during mediation on Jan. 3, according to court documents.
However, the school board generally denies the allegations and believes the legal claims are without merit. The settlement is to avoid “the burden, expense, risk and uncertainty of continuing to litigate,” and to stop ‘controversies’ associated with the lawsuit,” records state.
As part of the settlement, the school board agreed to extend identity theft protection to affected employees for another year. The superintendent previously contracted AllClear ID to support the employees for two years.
Those who signed up for identity theft protection on their own may be eligible for up to $150.
If the settlement isfinalized, the district will also have to train all human resources and payroll employees in cybersecurity by the end of 2018. The training will be required of all new employees for the next two years.
All class members will have the option to submit a claim form, ask to be excluded, object to the settlement or do nothing, giving up the right to sure the school board about issues raised in the case.
“No one can know what else the cyber criminals will do with the employees’ PII,” the complaint said. “However, what is known is that the District’s employees are now, and for the rest of their lives will be, at a heightened risk of further identity theft and fraud.”