Facts

San Francisco Employees' Retirement System (SFERS) oversees and administers a retirement plan for approximately 74,000 active and retired employees of the City and County of San Francisco. Since 2016, SFERS has contracted with 10UP, a digital strategy and software engineering company, to provide SFERS members with online access to their account information. As such, 10UP receives and obtains nonredacted personal identifiable information (PII) of SFERS members, including names, home addresses, dates of birth, designated beneficiary information, 1099-R tax form information, bank account routing numbers, and member website usernames and passwords. On February 24, 2020, 10UP was the target of a massive data breach in which approximately 74,000 SFRERS members were subjected to an unauthorized disclosure of their PII. On March 21, 2020, 10UP reported the Data Breach to SFERS. On September 11, 2020, three San Francisco retirees and SFERS members, Richard Daniele, Richard Goss and Steve Landi, individually and on behalf of a class of similarly situated persons, brought a class action against 10Up Inc., alleging negligence and violations of California's Unfair Competition Law and California Consumer Privacy Act. The class included all SFERS members and former members residing in California whose PII was accessed or otherwise compromised in the Data Breach, according to the Notice of Data Breach provided by SFERS on February 24, 2020.

PLAINTIFFS' CONTENTIONS: Plaintiffs contended that defendant violated its duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the personal identifying information and that defendant breached its standard of care by failing to implement reasonable security procedures to adequately protect plaintiffs' and class members PII from data breaches. Moreover, plaintiffs alleged that defendant knew or reasonably should have known of the importance of safeguarding its user's PII and of the foreseeable consequences that would occur if its data security system was breached, including the significant costs, damages, and harm that would be imposed on plaintiffs. Finally, plaintiffs maintained that the data breach subjected them to unauthorized access and exfiltration, theft, or disclosures of their PII to outside parties and caused them to suffer ongoing economic damages and other actual damages since users faced an increased risk of identity theft and concomitant expenses associated with mitigating the risk to their data.

DEFENDANT'S CONTENTIONS: Defendant denied all contentions.

Result

The parties reached an agreement wherein the defendant admitted no wrongdoing or liability but agreed to pay $60 to class members who submit a claim and to provide no-cost enrollment in twelve months of credit monitoring services. The agreement also provides for reimbursement of extraordinary loss suffered by any members of actual identity theft.