WSU to pay up to $4.7 million for data theft involving 1.2 million people

Washington State University learned a costly lesson after a hard drive containing the personal information of more than a million people was stolen from a self-storage locker in 2017. Now, the university is going to have to pay even more.

In a settlement that received preliminary approval in King County Superior Court on Thursday, the university agreed to pay up to $4.7 million in cash reimbursements, attorneys fees and administrative expenses. On top of that, the university will pay for two years of credit monitoring and insurance services for up to 1,193,190 people, according to the settlement agreement.

WSU spokesman Phil Weiler said the costs will come out of the university’s cyber-liability insurance policy and state insurance, not student fees or tuition.

The total amount will depend on the number of claims made. The stolen hard drive contained nearly 1.2 million people’s information, including social security numbers, addresses, contact information, career and health data, and college-admissions test scores. The data was collected over a 15-year period by the school’s Social and Economic Sciences Research Center.

The hard drive was stolen in April 2017 from Quality Self Storage in Olympia, where it was stored in an 8- by 10-foot self-storage locker. As part of the settlement, WSU has agreed to improve data security.

Some plaintiffs to the class-action suit alleged they’d experienced identity fraud as a result of the theft. But the university claims those didn’t stem from the stolen hard-drive. Weiler said there’s no indication anyone actually gained access to the data on the hard drive.

While the university disagrees with claims made in the lawsuit, Weiler said, it decided that settling the lawsuit would be less expensive and time-consuming. The settlement comes after 20 months of litigation.

The WSU Board of Regents approved up to $5.26 million for the settlement in January. Attorney James Bulthuis, with the Seattle law firm Tousley Brain Stephens, represented the plaintiffs, and anticipates the university will spend about that amount in total cost when factoring in credit monitoring.

On top of credit monitoring, WSU agreed to pay up to $3.25 million to compensate for lost time and out-of-pocket costs as a result of the incident. Those affected are eligible for up to $5,000 each if they can prove out-of-pocket costs, such as paying for credit reports, new bank cards and credit monitoring.

While WSU offered one year of free credit monitoring after the hard drive was stolen, only about 4% of people used it, said Bulthuis.

WSU agreed to pay around $800,000 in attorneys fees and expenses and about $650,000 in settlement and administrative expenses.

The court will hear arguments for and against the settlement during a hearing on Oct. 25 before issuing final approval.

Information for those affected by the data theft is available at WSUSettlement.com.

This story has been updated to include a link to WSU’s website for class members and the date for the final hearing.