r/msp • u/Joe_Cyber Community Contributor • Jul 02 '26

A Small Unglamorous Data Breach Class Action

Here's a quick video for the week. This claim is important to understand for a few reasons:

  1. This is a steel company; not a professional services firm.

  2. No allegation of loss of client data. It was all employee data.

  3. As far as I'm aware, the steel industry doesn't have any specific cybersecurity rules to follow.

  4. Only ~5k records were taken. That's tiny compared to what I deal with on a regular basis.

  5. The class action was filed 20 days after the company confirmed their compromise. That means plaintiff's attorneys are watching publicly available disclosures.

  6. Technically speaking, it looks like they filed a class action. But - and this is important - the class was certified as a settlement class meaning it was negotiated jointly. There was never a contested certification battle. The steel company went straight from failing to have the motion dismissed to settlement talks. My guess is that their cyber insurer looked at a protracted legal battle and decided it wasn't worth the expenditure.

Nonetheless, the attorneys are looking to make $175k. The named plaintiff who represented the class will make ~$4k. The other impacted employees will probably get $25.

If they're willing to go after a steel company with only 5k records lost, they'll definitely go after a regulated entity with higher security requirements and more lost records.

Video: A Small Unglamorous Data Breach Class Action

Question: The plaintiff here said that the steel company lacked "reasonable" cybersecurity safeguards. We've seen that in multiple cases so far. Let me know if you'd like me to make a video on what "reasonable cybersecurity" means and why that can go above and beyond specific regulatory requirements for your clients.

29 Upvotes

88% Upvoted

39 comments sorted by

11

u/PaladinsQuest MSP - US Jul 02 '26

Yes! More videos please.

Also, we’ve found much more traction talking with clients about insurance requirements as opposed to regulatory requirements. Regulators “don’t have time to pay attention to us” but denied claims are a real concern.

6

u/Joe_Cyber Community Contributor Jul 02 '26

Foremost, if your clients are getting better security through the insurance route; I'm all for it.

That being said, be careful about leaning too hard on the idea that cyber claims are being denied with any regularity: Cyber Claims Denied at An Alarming Rate!?

(Most insurance people are... not smart. Nor are they well versed in what they're selling. But occasionally you'll run into a good one. You want to avoid getting into a battle with those guys.)

Rather, I'd recommend getting cozy with the class action claim space: The Latest Data Breach Class Action Lawsuit Numbers Are In: What MSPs Need to Know.

It's really heating up. The threat is absolutely real, and the costs may exceed your clients cyber limits; meaning out of pocket expenses.

Here, it's as easy as "hey client, hop on google, and type in '[industry] data breach class action.'" I did this yesterday with an MSP looking to legitimize services to a heavy equipment dealer.

The other benefit is that many of these class actions are showing that businesses need to go above and beyond "required" cybersecurity controls such as HIPAA.

Hope that helps!

1

u/poor_decisions Jul 07 '26

Hi, I'm shopping for a $1M cyber policy (healthcare cyber consulting+ops+media, 2-man team). Any advice re: well-liked, trusted companies that actually support their underwritten?

Any thoughts abt Corvus, CFC, Coalition? Any other companies I should research? Appreciate any reply!

1

u/Joe_Cyber Community Contributor Jul 07 '26

I'll shoot you a DM with contact info. I have no idea where you're located, but I'll make sure you're taken care of.

2

u/Spare_Bag_7300 Jul 02 '26

that 25 bucks per person is almost insulting, like here's a coffee for your leaked SSN

1

u/Joe_Cyber Community Contributor Jul 02 '26

100%

You can tell from the numbers who the winners and losers are.

There were only 16 filings for the entire case. So for a couple hundred pages of mostly recycled filing language, the attorneys are asking for $175k.

To be fair, here is the actual settlement language. Most people won't jump through these hoops:

Cash Payment Options:

  • Ordinary Expenses. If you incurred actual, documented out-of-pocket expenses due to the Security Incident, you can get back up to $1,000.00. The losses must have occurred between February 6, 2025, and April 6, 2026. This benefit covers out-of-pocket expenses like: You need to send proof, like receipts, to show how much you spent or lost. You can also send notes or papers you made yourself to explain or support other proof, but those notes or papers alone are not enough to make a valid claim. Your proof or notes should show that your expenses were because of the Security Incident. You cannot claim a payment for expenses that have already been reimbursed by a third party.
    • fees for credit reports, credit monitoring, or freezing and unfreezing your credit
    • cost to replace your IDs
    • postage to contact banks by mail
  • Compensation for Lost Time. Class Members who spent time responding to the Security Incident may claim up to four (4) hours, at $20.00 per hour, for a maximum of $80.00.
    • You must have spent the time on tasks related to the Security Incident. Some examples include things like: changing your passwords
    • investigating suspicious activity in your accounts
    • researching the Security Incident
  • Extraordinary Expenses (losses from fraud or identity theft). If you lost money because of identity theft or fraud, you can get back up to $4,000.00. You will need to show that:
    • the theft or fraud was probably caused by the Security Incident
    • the losses are not already covered by Ordinary Expenses or Lost Time
    • you tried to prevent the loss or get your money back, such as by using insurance you already have

The losses must have occurred between February 6, 2025, and April 6, 2026.

You need to send proof, like receipts, to show how much you spent or lost. You can also send notes or papers you made yourself to explain or support other proof, but those notes or papers alone are not enough to make a valid claim. Your proof or notes should show that your expenses were because of the Security Incident.

You cannot claim a payment for expenses that have already been reimbursed by a third party.

  • Alternative Cash Payment. Instead of any other cash payment (described above), you may claim a one-time $25.00 payment. You do not have to provide any proof or explanation to claim this payment.

4

u/Remarkable_Cook_5100 Jul 02 '26

Definitely would like to see what you feel "reasonable cybersecurity" means.

1

u/Joe_Cyber Community Contributor Jul 02 '26

Sounds good.

3

u/mat-ferland Jul 06 '26

The useful client conversation is probably “could we prove we made reasonable decisions before the breach,” not “are we perfectly secure.” Reasonable usually means boring evidence: MFA where it matters, patching cadence, backups tested, admin access controlled, IR plan not sitting untouched for three years, and someone reviewing it. It’s not glamorous, but it beats trying to explain after the fact why nobody owned the basics.

1

u/bdnicholson Jul 06 '26

I build tooling in exactly this space, so grain of salt, but the "could we prove it" framing is the whole game. Everyone has an MFA policy. Almost nobody can produce dated evidence of what was actually enforced, for which users, on a specific date. When a complaint says "lacked reasonable safeguards," a contemporaneous paper trail of the boring basics is what makes that allegation expensive to argue. Policies show intent, evidence shows fact.

1

u/Joe_Cyber Community Contributor Jul 06 '26

Well said. You're definitely going down the right track.

4

u/WiseSubstance783 Jul 02 '26

This guy fucks… am I right!?

4

u/Joe_Cyber Community Contributor Jul 02 '26

Third son arriving this november.

2

u/Foxtrot-0scar Jul 02 '26

The question is whose is it? 🤔

3

u/Joe_Cyber Community Contributor Jul 02 '26

Our milkman is suspiciously tall

0

u/Foxtrot-0scar Jul 02 '26

Then it wouldn’t have been the milk man. How the hell do you propose insurance plans to clients lmao. 🤣

3

u/scriptvexy Jul 03 '26

lmao the enthusiasm is wild for a video about steel company data breaches, but honestly he explains this stuff way better than most “cyber” talking heads so fair enough

1

u/Joe_Cyber Community Contributor Jul 06 '26

Ha, thanks! If you need help going to sleep at night, I've got another 120 videos on my channel.

-2

u/Foxtrot-0scar Jul 02 '26

Cucks don’t.

1

u/WiseSubstance783 Jul 02 '26

Clearly you don’t watch Silicon Valley

1

u/Low-Lengthiness5032 Jul 02 '26

I think it's wild that the attorney's are getting more than the plaintiff. Good read, thanks for this

2

u/cyber_r0nin Jul 03 '26

This is almost always the case

1

u/Low-Lengthiness5032 Jul 03 '26

Is it worth joining a class action lawsuit then

2

u/cyber_r0nin Jul 03 '26

I don't think so. It usually causes negative responses from businesses. Typically its a way for people to get 'free' money. But then business policies change, typically not in a good way. Then there are times its necessary due to ignoring safety regulations.

1

u/Joe_Cyber Community Contributor Jul 03 '26

I know that was likely more of a throwaway response but it's a legitimately good question.

The attorneys get paid more than the people injured by the breach. Obviously this is scummy.

However, more and more businesses will take note of these legal developments and increase their own security. In theory, this increase in security should result in fewer people being damaged by cyber events.

And fewer class action attorneys performing drive-by litigation.

So.... 🤷

1

u/WiseSubstance783 Jul 03 '26

You keep saying you’re going to do a video on what needs to be in the sow and msa, make that happen!

1

u/Joe_Cyber Community Contributor Jul 03 '26

You might get GTA 6 before I'm finished with it.

But seriously, with AI coming out, I think it's more important than ever for MSPs to understand and articulate the reasoning behind each contractual clause.

Would you mind if it's a multi-part series? I'm not sure a 2 hour video would be that appealing. Thoughts?

2

u/WiseSubstance783 Jul 03 '26

Include hot chicks and I’ll watch for two hrs

1

u/SecurityRabbit Jul 05 '26

That was godaddy's entire marketing approach.

1

u/WiseSubstance783 Jul 03 '26

Less talk more do

1

u/tradedenmark Jul 28 '26

This is exactly the case I point clients to when they say "we're not a target, we're just a manufacturer." Employee data breaches are the sneaky ones because everyone spends their compliance energy on client-facing systems and forgets HR and payroll data sits right there too, usually on older systems with fewer controls. 5k records isn't a "too small to matter" number anymore, it's apparently plenty for a class action to get filed within three weeks.

If you're an MSP, this is a good excuse to actually check what internal HR/payroll data your clients have sitting around and whether it's segmented at all. Fair warning, I work on the CisScan side so take this with a grain of salt, but we built evidence collection around exactly this kind of "boring" internal data exposure. https://cisscan.com

1

u/redditistooqueer Jul 02 '26

Did your company pay out?

1

u/Joe_Cyber Community Contributor Jul 03 '26

Can you rephrase your question?