Former Sony Employees Sue, Claim Company Failed to Protect Data

Sony Pictures Entertainment has been sued by two self-described former employees who accuse the movie studio of failing to protect Social Security numbers, healthcare records, salaries and other data from computer hackers who attacked it last month.

The proposed class action lawsuit against Sony Corp’s studio was filed on Monday in federal court in Los Angeles. It alleges that the company failed to secure its computer network and protect confidential information.

“An epic nightmare, much better suited to a cinematic thriller than to real life, is unfolding in slow motion for Sony’s current and former employees,” the lawsuit said.

Sony is already reeling from the disclosures in documents released by the hackers, which have exposed internal discussions key to the company’s future to public scrutiny.

Reuters has not been able to verify the authenticity of the documents.

Data that the unidentified hackers have leaked online include home addresses, phone numbers, birth dates, Social Security numbers, salaries, healthcare records, performance evaluations and reasons for termination, the plaintiffs said.

The lawsuit seeks class action status on behalf of all former and current employees of Sony in the United States whose personally identifiable information was compromised in the breach.

Gretchen Freeman Cappio, a lawyer for the plaintiffs, said her firm had heard from dozens of employees who are upset about the release of their information.

Sony “knew or should have known that such a security breach was likely” given a 2011 hack of its PlayStation video game network and recent data breaches at retailers, the lawsuit said.

In the PlayStation case, Sony agreed to pay $15 million to settle suits that accused the company of leaving customer data vulnerable to hackers.

The plaintiffs are asking for compensation for any damages as well as credit monitoring services, identity theft insurance and other assistance.

A Sony spokesman declined to comment.

While some data breach cases have settled, Marcia Hoffman, a San Francisco-based attorney who specializes in Internet law, said that she was not aware of any cases that went to trial and resulted in a judgment for the plaintiff.

“I’m not saying it could never happen. I’m saying this is a pretty cutting edge, novel complaint,” she said.

The case is Michael Corona and Christina Mathis v. Sony Pictures Entertainment Inc, U.S. District Court for the Central District of California, No. 2:14-cv-9600.

(Reporting by David Ingram and Alison Frankel in New York, additional reporting by Jim Finkle in Boston and Lisa Richwine in Los Angeles; editing by Jeffrey Benkoe, G Crosse and Christian Plumb)