FEATURED SETTLEMENT: Digital File Transfer Company Agrees to Terms of $8.1 Million Class Action Settlement to Resolve Cyber Security Breach

Cyber Security

Jaramey Stobbe v. Acellion Inc. (USDC Case No. 5:21-cv-01353-EJD): In January 2022, Accellion Inc., a company

that provides FTP (File Transfer Protocol) services to clients, agreed to the terms of an $8.1 million settlement

arising from a data breach associated with an older version of their file transfer service that they had ceased

supporting. “Accellion FTA” was an FTP service that was used by Accellion’s clients for over 20 years that facilitated

the secure transfer of large files over the internet. Accellion developed a newer product called “Kiteworks”,

urged its customers to switch over to the new product and ceased to provide support for Accellion FTA on April 30,

2021. Despite the urging of Accellion to its customers to switch to Kiteworks, many customers continued to use the

obsolete file transfer service. In December of 2020, it was discovered that hackers exploited vulnerabilities in the

obsolete service, gaining access to customer’s personal identifiable information including names, birth dates, social

security numbers and medical information. Leading class member Jaramey Stobbe filed suit against Accellion,

alleging that defendant had acted negligently by failing to implement and maintain data security practices, to

detect potential vulnerabilities and a failure to disclose that their security practices were inadequate. Defendant

agreed to the terms of the settlement but admitted no wrong doing, agreeing to retire it’s obsolete FTP service and

to provide cyber-security training to it’s employees. Plaintiff was represented by Ahdoot & Wolfson PC.