Disney Class Action: Employee Data Exposed in Alleged Breach

Walt Disney Co. is facing legal action from its employees after hackers allegedly breached the company’s systems, compromising the sensitive personal information of Disney Cruise Line workers. 

The proposed class action lawsuit, filed by Scott Margel, accuses Disney of negligence and failing to protect its workers' private data, as well as violating privacy laws by not properly notifying those affected by the breach, LA Times reports.

According to the lawsuit, the data breach, which happened earlier this year, exposed passport numbers, visa details, birthplaces, and physical addresses of employees, along with some customer information.

Disney Sued Over Data Breach That Exposed Employee Information

The lawsuit claims that the hackers released a vast amount of sensitive data, including 18,800 spreadsheets, 13,000 PDFs, and 44 million internal messages sent via Disney’s workplace communication platform, Slack.

The compromised data reportedly includes highly confidential employee information, and at least one spreadsheet listed the names, addresses, and phone numbers of Disney Cruise Line passengers. The exact number of affected individuals is still unclear, but the lawsuit estimates that thousands of employees were impacted.

Margel says in the lawsuit that there has been a lack of communication from Disney about the breach, and says workers have been left “in the dark” about the full scope of the leak and what actions are being taken to secure their data moving forward.

Hackers Leak Disney Data in Protest of Company's AI Practices

The hacking group, NullBulge, which has taken responsibility for the breach, said it leaked roughly 1.2 terabytes of Disney data in response to the company’s use of artificial intelligence.

The group of “hacktivists” accused Disney of mistreating artists and using AI in ways that harm workers. NullBulge told CNN that its actions were meant as a protest against Disney's approach to AI and what they described as the company's “blatant disregard for the consumer.”

According to the hackers, they gained access to Disney’s systems via an employee with Slack credentials. Rather than making demands for ransom, the hackers chose to leak the data outright, believing that Disney would not negotiate. “If we said ‘Hello Disney, we have all your Slack data,’ they would instantly lock down and try to take us out. In a duel, you better fire first,” they said in the email to CNN.

The data breach took place after the heated debates about AI during the Screen Actors Guild and Writers Guild of America strikes. Both industries have expressed concerns about AI’s impact on creative jobs, fearing that AI-generated scripts and computer-generated imagery could replace writers and actors.

Data Breaches Plague Companies Across Various Industries

Disney is not alone in facing legal challenges related to data breaches. KemperSports, a golf course and hospitality management company, is accused of failing to secure customer data in a breach that exposed Social Security numbers and other personal information of tens of thousands of individuals.

Additionally, healthcare companies like Hospital Sisters Health System, along with tech giants such as Toshiba and HealthEquity, have also faced lawsuits for failing to protect sensitive patient and customer data. In a high-profile case, genetic testing company 23andMe agreed to a $30 million settlement after hackers stole customer information in a massive data breach.

In his lawsuit against Disney, Margel is calling on the courts to make the company reinforce its security system. He is also seeking damages and a jury trial.

Have you been affected by the Disney data breach or other recent data breaches? Share your experiences and concerns in the comments below.