Georgetown University Data Breach Class Action: Student and Alumni Info Exposed

Case Overview: A class action lawsuit has been filed against Georgetown University, alleging that the university failed to protect student and alumni data, leading to a data breach.

Consumers Affected: Georgetown University students and alumni whose personal information was compromised in the data breach.

Court: U.S. District Court for the District of Columbia

Georgetown University is facing a class action lawsuit following a data breach that exposed the personal information of students and alumni. The breach occurred on October 16 and 17, 2024, and potentially affected individuals dating back to 1990.

The lawsuit, filed by Mary Margaret "Maggie" Cleary in a Washington D.C. federal court, alleges that the university failed to adequately protect sensitive data, including admissions records, academic and financial aid details, and even Social Security numbers. 

Cleary, a Georgetown graduate and current prosecutor in Virginia, filed the suit in her personal capacity, claiming that the university's negligence led to the breach and compromised her personal information and that of other students and alumni.

Data Breach Exposes Sensitive Information of Georgetown Students and Alumni

The data breach originated within Georgetown University's data management system, Ellucian, during a period of scheduled maintenance. According to an email from Chief Information Officer Doug Little, the breach made sensitive information accessible to users within the university network between 8:00 a.m. on October 16 and 8:30 a.m. on October 17.

The university identified 29 recent or current students who may have accessed this unauthorized data. While Georgetown has contacted these individuals and instructed them to delete any data they obtained, the lawsuit argues that this action is insufficient to mitigate the risk of harm to those whose information was exposed.

The exposed data includes a range of sensitive information, creating concerns about potential misuse. This includes personal identifiers such as names, Social Security numbers, dates of birth, and physical addresses, as well as academic records, admissions information, and financial aid details.

This type of data could be used for identity theft, financial fraud, or other harmful activities. The lawsuit emphasizes that this information "remains in the hands of unauthorized individuals who accessed the [data] and can exploit the [information] of the Plaintiff and the Class Members."

Lawsuit Accuses Georgetown University of Negligence, Inadequate Security Measures

The lawsuit accuses Georgetown University of negligence in handling personal information. It alleges that the university failed to implement adequate security measures to protect this sensitive data and did not comply with industry standards for software and server security. Furthermore, it claims the university failed to properly update its systems during scheduled maintenance, which contributed to the data breach.

Cleary states that she has experienced "anxiety and stress" due to the increased risk of identity theft and financial harm resulting from the breach. 

Georgetown Faces Legal Challenges Over Data Breach and Tuition Refunds

This is not the first time Georgetown University has faced legal action. The university recently settled a class action lawsuit for $1.5 million related to tuition and fee refunds for the Spring 2020 semester, when the university transitioned to remote instruction due to the COVID-19 pandemic. The lawsuit alleged that students were entitled to partial refunds because the quality of education was diminished by the shift to online learning.

In the Georgetown University data breach class action lawsuit, Cleary seeks damages, including monetary and punitive damages, to compensate for the harm caused.

The suit also demands that Georgetown establish a fund to provide financial assistance to those affected by the breach. Cleary calls for the university to enhance its data security protocols, conduct regular security audits, and offer credit monitoring services to all individuals whose personal information was compromised. Additionally, it requests that the university promptly notify individuals of any future data breaches.

Case Details

• Lawsuit: Mary M. Cleary v. Georgetown University
• Case Number: 1:24-cv-02953
• Court: U.S. District Court for the District of Columbia

Plaintiffs' Attorneys

• Christian Levis, Peter Demato, Radhika Gupta, and Anthony M. Christina (Lowey Dannenberg, P.C.)

Are you a current or former student or alumni of Georgetown University? Share your experiences and concerns about the data breach in the comments below.