Cyber Incident Victim: Americold
Timeline
Summary
Americold agreed to a $5.25 million settlement to resolve a class action lawsuit stemming from two data security incidents that exposed personal information of employees and job applicants. One incident involved malware that allowed unauthorized access to names, Social Security numbers, driver’s license details and health data affecting nearly 130,000 individuals; the other was a separate earlier breach. The settlement fund will compensate eligible members for documented losses up to $25,000, provide $200 to those impacted by both events or $100 for one, and offer three years of credit monitoring with at least $1 million in identity theft protection. The company also committed to strengthening its security measures. The agreement has received preliminary court approval, with a final approval hearing pending.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In April 2023, Americold experienced a cybersecurity incident involving malware that allowed an unauthorized party to remove sensitive data from its network. The breach was disclosed publicly in December 2023. An investigation determined that nearly 130,000 individuals were affected, with exposed information including names, Social Security numbers, driver’s license details, and health information. A separate cyber security event was reported by Americold in 2020. The two incidents prompted a class action lawsuit filed in the U.S. District Court for the Northern District of Georgia, alleging that Americold failed to adequately safeguard the personal and protected health information of current and former employees and job applicants. Americold denied any wrongdoing or negligence but agreed to settle the lawsuit to avoid the costs and risks of continued litigation.
Under the settlement, Americold will establish a $5.25 million fund to compensate eligible class members and cover credit monitoring, documented losses, attorneys’ fees, administration costs, and service awards. Eligible class members may claim up to $25,000 for documented, unreimbursed losses related to either data incident. Individuals affected by both incidents may receive an estimated $200 payment, while those affected by only one incident may receive an estimated $100 payment. Class members also have the option to receive three years of credit monitoring, which includes at least $1 million in identity theft protection services. As part of the agreement, Americold has committed to taking reasonable measures to strengthen the security of its systems and protect affected individuals’ information. The proposed settlement received preliminary court approval but remains non‑final, with a final approval hearing scheduled for October 6 to determine whether the settlement will be approved.