Former employees sue J.B. Hunt in claimed data breech | Northwest Arkansas Democrat

Three former J.B. Hunt employees sued the company in federal court this week claiming a data breach put the personal information of thousands of workers at risk.

The suits by Wendy Parnell of Bentonville, Shileen Lange of Richmond, Va., and Aaron Hunter of Ellenwood, Ga., seek class action status. They were filed Tuesday in the United States District Court, Western District of Arkansas, Fayetteville Division.

According to court documents, on Oct. 23 a data breach at J.B. Hunt was reported by a hacker group who claimed it infiltrated the company's computer system and obtained access to employees' private, personal information or PPI. That information included names, dates of birth, Social Security numbers, driver's license numbers, information, and financial information as well as some business records.

All the suits contend the ransomware cyber criminal group known as "Whitearmor" posted on its dark web leak site claiming that it had "140,838 employee records" that contained PPI and national identification numbers. The group demanded $5 million in ransom for the information.

"We are investigating a cybersecurity incident involving unauthorized access to certain information within an isolated portion of J.B. Hunt’s technology system," J.B. Hunt said Thursday. "Our systems remain operational, and there has been no disruption to our ability to serve customers. Upon learning of the incident, we quickly implemented our response protocols with the support of a leading cybersecurity firm, notified law enforcement, and promptly revoked the unauthorized access. We take this matter seriously, and we are continuing to investigate."

In recent days, websites including Cyber News Live, DeXpose and Dark Web Intelligence reported Whitearmor's claims it had breached J.B. Hunt's computer network.

Hunter's suit contends the hackers also claimed to obtain "approximately 1.7 million carrier contacts, 38.2 million invoices, 187,000 access-permission records, 3,196 ranked account-takeover targets, 973 Microsoft 365 mailboxes, and records concerning 374,000 organizations." The suit notes these figures are based on the hacker's claims and had not been verified.

Hunter's action also argues J.B. Hunt did not promptly notify those affected by the information breach.

The various suits' claims against J.B. Hunt include negligence, implied breach of contract, unjust enrichment, invasion of privacy, and breach of fiduciary duty. All three ask for a jury trial.

The suits contend that J.B. Hunt had an obligation to protect and safeguard personal information of its employees and its customers from unauthorized access and intrusion. They argue sensitive data should have been encrypted or redacted and better protected by J.B. Hunt and the company was negligent by not doing so.

They argue the breach was preventable and that J.B. Hunt's computer system was vulnerable to intrusion and the company didn't put the proper measures in place to keep the PPI information safe, including failure to meet security guidelines suggested by the Federal Trade Commission.

All the plaintiffs contend access to the data by outsiders make them vulnerable to financial crimes now and for as long as they live.

"Hackers targeted and obtained the Private Information because of its value in exploiting and stealing the identities of Class Members and to conduct financial crimes against Class Members. The present and continuing risk to victims of the Data Breach will remain for their respective lifetimes," Lange's suit reads in part.

Lange and Parnell are represented by the Sanford Law Firm, based in Little Rock and Hunter is represented by Carney, Bates and Pulliam PLLC, also based in Little Rock.

The law firm of Migliaccio & Rathod LLP, with offices in Washington, D.C. and San Francisco, Calif. said on Monday it's investigating a possible J.B. Hunt data breach, impacting an unknown number of individuals and their personal information, according to its website.

J.B. Hunt Transport Services includes intermodal, dedicated, refrigerated, truckload, less-than-truckload, flatbed, single source, last mile and transload operations. It celebrated its 65th year in business in August.

Earlier this month the company reported third quarter net income of $172.4 million or $1.82 per for the quarter ended Sept. 30, up 2% from a year ago. Revenue for the quarter, including fuel surcharges, stood at $3.68 billion, up 20% from a year ago. The results just beat analysts' estimates.

An earlier version of this story was updated to include a statement from J.B. Hunt.