Two former UCF student leaders are suing their alma mater after learning they were among the 63,000 people whose Social Security numbers were compromised in a hack, according to court records.
The FBI’s Jacksonville office is investigating the University of Central Florida’s security breach in which an unknown party accessed private information of current and former employees dating as far back as the 1980s, including student-government leaders, athletes and others.
UCF officials will not say how the security breach occurred.
The lawsuit, which is seeking class-action status, was filed by Broward County resident Anthony Furbush, who was active in student government, and Logan Berkowitz, the former student body president who also received media attention as the owner of an Orlando bar that gave away free beer during UCF’s winless football season.
“Our clients have serious concern about the future security of their confidential information maintained by UCF, and the ongoing collateral harm of identity theft they are now at risk of for years to come,” said their Davie attorney Joshua Eggnatz in a statement. “This lawsuit is about making sure the victims of this breach …have a voice in ensuring that UCF implements proper security procedures so that this never happens again.”
The lawsuit alleges UCF failed to keep people’s personal data secure, putting them at risk for fraud and identity theft, and did not do enough to prevent its network from being attacked.
The lawsuit also accuses the university of discovering the breach as early as December.
UCF officials said they first realized the problem Jan. 8 and worked with a national cybersecurity firm to fully investigate before they publicly revealed the hack Thursday.
The lawsuit was filed Friday in U.S. District Court’s Orlando division and is seeking damages to be determined at trial.
“Plaintiffs and (others) have suffered irreparable damage and will continue to suffer irreparable damage,” the lawsuit said. “The potential extent of the total damage caused by the breach cannot be understated.
To help those whose private information has been compromised, the university set up a website that received more than 36,000 visits Thursday, a call-in center and also promised a year of free credit monitoring and identity-prevention services.
The school mailed letters Friday to notify those who might be at risk.
Officials have said there has not been evidence so far of fraud involving the hack.
But the lawsuit criticized the school’s handling of the breach, saying UCF delayed notifying victims when officials first became aware of unauthorized data access. People may also no longer be living at the addresses the school has on file, the lawsuit also said.
UCF spokespeople could not be reached for comment Saturday.
A call-in phone center has been rolled out to verify if people’s information has been compromised.
The center, which can be reached at 877-752-5527, will be open from 9 a.m. to 9 p.m., Monday through Friday.
The university also launched a website to answer questions at www.ucf.edu/datasecurity.
grusson@orlandosentinel.com or 407-420-5470
