By Jim Brunner

The Seattle Times

The legal claims are flying over the massive unemployment-data breach involving Washington State Auditor Pat McCarthy’s office.

A Seattle law firm on Tuesday filed a lawsuit against Accellion, the California company whose file-transfer service was breached in December, on behalf of Jason Stahl, a Seattle man who filed for unemployment last year.

The lawsuit, which seeks class-action status on behalf of more than 1 million people whose personal information was exposed, was filed in King County Superior Court by the law firm Tousley Brain Stephens.

The 19-page civil complaint accuses Accellion of negligence and of violating Washington’s Consumer Protection Act due to the breach of its file-transfer service, known as FTA, which the auditor’s office had relied on.

“Defendant was aware that FTA was an inadequately secure product, yet sold this vulnerable product to (the auditor’s office) for the transfer of Personal Information,” the lawsuit states.

As a result of the breach, Stahl and other Washington residents “have suffered actual damages, and are at imminent risk of future harm, including identity theft and fraud that would result in monetary loss.”

The personal information exposed in the breach included Social Security numbers, driver’s license and other personal identification, as well as banking and employment history. The data breach affects anyone who filed for unemployment in Washington between Jan. 1 and Dec. 10, 2020, the auditor’s office said.

Such data “is highly coveted and valuable” on black markets, where criminals sell stolen consumer information, “exposing consumers to identity theft and fraud for years to come,” the lawsuit alleges.

Accellion did not immediately respond to a request for comment on the lawsuit Wednesday morning.

The state auditor’s office, which paid $17,000 a year for Accellion’s FTA service, was not named as a defendant in the lawsuit.