On Thursday, April 20, the American Bar Association (ABA) notified its members of a March 6 data breach that resulted in an unauthorized third party gaining access on March 17 to certain usernames and hashed and salted passwords.

The next day, Troy Law PLLC, a New York-based employment firm, filed a class action complaint against the ABA for damages resulting from the breach, alleging that the ABA “allowed widespread and systematic theft” of member information, and that its “actions did not come close to meeting the standards of commercially reasonable steps that should be taken to protect customers’ personal identifying information.”

Tiffany Troy v. American Bar Association class action complaint.