Philadelphia labor and employment firm Spear Wilderman was sued Wednesday in a class action suit that alleges it waited more than a year and a half after a May 2021 data breach to inform clients that their personal identifiable information and health data was compromised.

The suit, filed in the Philadelphia Court of Common Pleas by Philadelphia resident Steven Hassell, claims that the firm “[failed] to implement and follow basic security procedures,” in addition to failing to inform “thousands” of individuals whose data may have been exposed in the security breach in a timely manner.