February 3, 2023 - Warrior Met Coal, Inc. has been hit with a proposed class action that claims negligent cybersecurity directly resulted in a July 2023 data breach.

The 56-page Warrior Met Coal data breach lawsuit says the cyberattack experienced by the Alabama-based metallurgical coal producer compromised the private information of approximately 19,000 current and former employees. Per the suit, the exposed data included names, dates of birth, Social Security numbers and medical information.

According to a December 2023 notice letter sent to victims, Warrior Met Coal’s computer systems were accessed via malware by an unauthorized third party on July 29 of last year. A subsequent investigation determined the threat actor had acquired certain files containing personal data, the notice shares, adding that the company has since “recovered the files.”

The suit contends that negligence on Warrior Met Coal’s part is to blame for the data breach, and alleges that the corporation’s network was inadequately secured, with the information stored therein left in a “condition vulnerable to cyberattacks.” The case adds that the defendant could have prevented the incident entirely had it properly encrypted its servers and the sensitive data in its care.

In addition, Warrior Met Coal’s notification of data breach victims was untimely and lacked important information, the complaint asserts. Per the filing, the notice letter failed to explain how cybercriminals gained access to the network, why the company waited more than four months after detecting the incident to notify victims, and what steps are being taken to ensure stored data is protected in the future.

The plaintiff, an Alabama resident who worked for Warrior Met Coal until 2019, says he was notified by the company on December 12, 2023 that his personal data had been exposed in the breach. Like other victims, the man now faces an ongoing risk of identity theft, fraud and other illegal schemes as a result of the defendant’s negligence, the case alleges.

The lawsuit looks to represent anyone in the United States whose private information was impacted as a result of the data breach announced by Warrior Met Coal in December 2023.