J.B. Hunt Transport Services, Inc.

Summary

Three former employees filed class action lawsuits against J.B. Hunt Transport Services, Inc. alleging a ransomware group breached an isolated portion of its technology system and accessed employee personal information including names, dates of birth, Social Security numbers, driver’s license numbers, contact details, and financial data. The hacker group claimed to possess 140,838 employee records along with millions of carrier contacts, invoices, access-permission records, mailboxes, and organizational records, demanding a $5 million ransom. The company stated its systems remained operational, that it engaged a cybersecurity firm, notified law enforcement, and revoked unauthorized access, while the suits claim negligence, breach of contract, unjust enrichment, invasion of privacy, and breach of fiduciary duty and argue affected individuals face ongoing risk of financial crimes and identity theft.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On October 23, a hacker group reported a data breach at J.B. Hunt Transport Services, Inc., claiming to have infiltrated the company's computer system and obtained access to employees' private personal information. The exposed information reportedly included names, dates of birth, Social Security numbers, driver's license numbers, contact information, financial information, and some business records. The ransomware cyber criminal group known as Whitearmor posted on its dark web leak site claiming possession of 140,838 employee records containing personally identifiable information and national identification numbers, and demanded $5 million in ransom for the data. Websites including Cyber News Live, DeXpose, and Dark Web Intelligence subsequently reported Whitearmor's claims regarding the breach of J.B. Hunt's computer network. A J.B. Hunt spokesperson acknowledged the company was investigating a cybersecurity incident involving unauthorized access to certain information within an isolated portion of its technology system. The spokesperson stated that systems remained operational and that there had been no disruption to the company's ability to serve customers. Upon learning of the incident, J.B. Hunt implemented its response protocols with the support of a leading cybersecurity firm, notified law enforcement, and promptly revoked the unauthorized access. The company indicated it was continuing to investigate the matter but did not respond to requests for comment regarding the lawsuits that followed.

Three former J.B. Hunt employees filed suit in federal court on Tuesday in the United States District Court, Western District of Arkansas, Fayetteville Division, seeking class action status. The plaintiffs are Wendy Parnell of Bentonville, Shileen Lange of Richmond, Virginia, and Aaron Hunter of Ellenwood, Georgia. Hunter's suit contends the hackers also claimed to obtain approximately 1.7 million carrier contacts, 38.2 million invoices, 187,000 access-permission records, 3,196 ranked account-takeover targets, 973 Microsoft 365 mailboxes, and records concerning 374,000 organizations, though the suit notes these figures are based on the hacker's claims and had not been verified. The various suits assert claims of negligence, implied breach of contract, unjust enrichment, invasion of privacy, and breach of fiduciary duty, and all three plaintiffs request a jury trial. Hunter's action also argues that J.B. Hunt did not promptly notify those affected by the information breach. The plaintiffs contend that J.B. Hunt had an obligation to protect and safeguard personal information of its employees and customers from unauthorized access and intrusion, arguing that sensitive data should have been encrypted or redacted and better protected. They assert the breach was preventable and that the company's computer system was vulnerable to intrusion because J.B. Hunt failed to put proper measures in place, including failure to meet security guidelines suggested by the Federal Trade Commission. Lange and Parnell are represented by the Sanford Law Firm of Little Rock, while Hunter is represented by Carney, Bates and Pulliam PLLC, also based in Little Rock. The plaintiffs argue that access to the data by outsiders makes them vulnerable to financial crimes now and for as long as they live, with Lange's suit stating that the present and continuing risk to victims will remain for their respective lifetimes.

J.B. Hunt Transport Services includes intermodal, dedicated, refrigerated, truckload, less-than-truckload, flatbed, single source, last mile, and transload operations, and celebrated its 65th year in business in August. The company has faced prior litigation related to data security, including a 2021 suit in the Western District of Arkansas by job applicants who claimed their personal information was compromised through the company's job portal; that case was dismissed without prejudice in October 2022 after the judge ruled the plaintiffs lacked standing. In 2023, J.B. Hunt sued TTEC Digital LLC, the maker of its online driver recruitment software, for breach of contract over alleged software vulnerabilities, a case that was dismissed with prejudice in August 2024 before trial. The law firms Migliaccio & Rathod LLP and Data Privacy Justice have said they are starting investigations into a possible J.B. Hunt data breach.

Sources

Sources available to members: 1 source.