Amgen hit with class action over data breach

A Pennsylvania resident says Amgen didn't protect her private information after a group of cybercriminals stole data.SAN FRANCISCO (CN) — A customer of a prescription drug giant Amgen has filed a federal class action claiming the company did not safeguard her personal data against cybercriminals.In July, a group of cybercriminals infiltrated Amgen’s computer systems and accessed many customers’ private information, including names, addresses, billing information, health conditions, diagnoses and other health-related data.Lead plaintiff Heidi Humphreys, a Pennsylvania resident, filed the class action on behalf of all customers whose information was stolen in the data breach.“The data breach was a direct, foreseeable, and even likely result of defendant’s deficient cybersecurity practices,” Humphreys says in the complaint. “The wealth of publicly available information and industry warnings regarding cyberattacks attacks makes defendant’s failures all the more egregious.”She says Amgen, by failing to implement reasonable measures to stop cybercriminals from obtaining data in its custody, disregarded her and potential class members’ rights. She believes more than 100 other customers nationwide may have had their data stolen in the July breach.“Numerous sources cite dark web pricing for stolen identity credentials,” she says. “For example, a single victim’s personal information can be sold at a price ranging from $40 to $200, and bank details have a price range of $50 to $200. Unfortunately, law enforcement has difficulty policing dark web activity due to encryption that permits sellers and purchasers to conceal their identity.”Humphreys says that when information like Social Security numbers, an identifier that cannot be easily changed, is stolen, fraud can follow a person for the rest of their life. Spear phishing, a targeted variant of phishing in which attackers use personal information to “craft highly personalized and convincing fraudulent messages,” is a common activity of criminals once they have a lot of information about one person, she says.“Unlike generic phishing attacks sent to mass audiences, spear phishing messages are tailored to the specific individual, dramatically increasing the likelihood that the recipient will be deceived,” Humphreys says in the complaint.She says fraudulent accounts were opened under her name after the breach and she received spam calls and text messages, resulting in her loss of privacy. Humphreys says she suffers from emotional distress and anxiety.Her claims include negligence and negligence per se. She seeks a court order for Amgen to update and secure its computer systems. The putative class asks for damages, restitution and disgorgement and demands a jury trial.Amgen is headquartered in Thousand Oaks, California. The class action was filed Thursday in the U.S. Central District of California.Attorneys representing the plaintiff did not immediately respond to a request for comment. Amgen declined to comment.Subscribe to our free newslettersOur weekly newsletter Closing Arguments offers the latest about ongoing trials, major litigation and rulings in courthouses around the U.S. and the world, while the monthly Under the Lights dishes the legal dirt from Hollywood, sports, Big Tech and the arts.Additional Reads