Progress Software Hit With Class Action Over MOVEit Data Breach

Progress Software Corp. failed in its duty to protect sensitive information in connection with a data breach of the MOVEit cloud-hosting and file-transfer services it provides to government agencies and private companies, a new proposed federal class action said.

The MOVEit attack, allegedly carried out by a criminal hacking group known as Clop, has resulted in the theft of data from dozens of organizations and government agencies in the US and Europe. Notable victims include oil giant Shell PLC and British Airways, along with banks, manufacturing firms, and universities.

Shavonne Diggs, Brady Bradberry, and Christina Bradberry alleged in the newly filed lawsuit that Progress failed to implement adequate security measures, monitor its network, properly train its employees, or provide timely notice of the incident.

Information exposed in the breach included names, addresses, Social Security numbers, birthdates, demographic information, driver’s license numbers, and other personally identifiable information and financial information, according to a complaint filed Tuesday in the US District Court for the District of Massachusetts.

Progress had not yet sent direct notice to those who were affected by the breach, which may have begun in 2021 and was only discovered in May 2023, it said.

The named plaintiffs were residents of Louisiana who received notice of the breach from the state Department of Motor Vehicles, a customer of Progress and a user of the company’s secure file-transfer services, it said.

The plaintiffs are now at increased risk of identity theft and fraud, and will likely incur out-of-pocket expenses and lost time responding to the incident, the complaint said.

The lawsuit brings claims of negligence, breach of third-party beneficiary contract, unjust enrichment, and declaratory judgment.

The plaintiffs are seeking actual damages, statutory damages, equitable relief, restitution, disgorgement, attorneys’ fees and costs, lifetime credit-monitoring services, and injunctive relief.

Siri & Glimstad LLP represents the plaintiffs and the proposed class.

The case is Diggs v. Progress Software Corp., D. Mass., No. 1:23-cv-11370, case filed 6/20/23.