MFLEX Data Breach: Class Action Lawsuit Over Yearlong Security Lapse

MFLEX, one of the largest global flexible circuit manufacturers and assemblers in the world, is being accused of negligently managing the personal and private information of its current and former employees, along with their beneficiaries, after a yearlong data breach exposed their data to third parties and put their information into “the hands of data thieves,” a new lawsuit claims. 

The breach has caused those affected “fear, anxiety, and stress,” which has been compounded by the fact MFLEX hasn’t shared key details about the breach, the lawsuit argues.

A legal duty to protect

The proposed class action lawsuit was filed against Multi-Fineline Electronix, Inc. by New Jersey local Joseph Biondi, who claims that MFLEX stored data in a “reckless manner” and was responsible for the breach given its inadequate cyber-security procedures. 

He said despite not being familiar with the company, he was sent a letter from MFLEX in February 2024 saying his data had been accessed by a third party, more than a year after the actual breach occurred from December 2022 to January 2023. 

The letter didn’t give any vital information about how the cyberattack happened or what was being done to stop future attacks, the lawsuit claims. Biondi argues that MFLEX has a legal duty to protect employees’ private information, and the breach could be blamed on the company’s “failure to take adequate cybersecurity measures to secure confidential data, which it stored unencrypted in its computer systems.”

Data on the darkweb

Biondi, and others affected by the breach, had their names, dates of birth, Social Security numbers, driver’s license or state identification numbers, financial account numbers and access details, health care data and much more accessed during the breach, the lawsuit says, and some of that information has ended up on the dark web.

Biondi was alerted by data analytics company Experian that his data was being disseminated and sold on the dark web, the lawsuit claims, which puts him at risk of identity theft. Because of that, Biondi, along with others affected by the breach, have incurred out of pocket costs for services such as credit monitoring and reports, and credit freezes. 

“Plaintiff and Class Members now face years of constant surveillance of their financial and personal records, monitoring, and loss of rights.”

What to do if your data is compromised

In an increasingly online world, protecting your data can seem like an overwhelming task. While it’s hard to avoid sharing data with employers or health providers, only share what’s absolutely necessary and let organizations know you want your data protected by checking all privacy rules and settings. 

If your data is compromised on the dark web, Experian recommends:

1. Changing your passwords
2. Adding multi factor authentication to your accounts
3. Trying to add SIM-swapping protection to your phone
4. Reporting the theft of your personal information and accounts
5. Freezing your credit
6. Staying proactive

The biggest factor in increasing data protection would be new legislation, so if the issue is important to you, call your senator and let them know. If you think a company has mishandled your personal data, you can file a complaint with the Federal Trade Commission. 

Biondi is suing MFLEX for negligence and unjust enrichment, and is asking for damages and injunctive relief, including improvements to MFLEX’s data security systems, future annual audits, and adequate credit monitoring services funded by the company. 

The plaintiffs and proposed class are represented by John J. Nelson of Milberg Coleman Bryson Phillips Grossman PLLC.

The MFLEX data breach class action lawsuit is Biondi v. Multi-Fineline Electronix Inc., Case No. 8:24-cv-00400, in the U.S. District Court for the Central District of California.