Rumpke Settles Employee Data Breach Lawsuit After 2024 Ransomware Attack Waste management company Rumpke has agreed to a $750,000 settlement in a class-action lawsuit filed by employees over a ransomware attack that exposed terabytes of sensitive data. The breach, which occurred in October 2024, compromised the personal information of nearly 17,000 current and former employees, including Social Security numbers and other identifying details. According to the mid-November settlement agreement in Hamilton County Common Pleas Court, the attack resulted in the theft of over 3 terabytes of data. While Rumpke denies any wrongdoing, the company acknowledged the breach and stated that its investigation found no evidence of customer payment data being affected or misuse of the stolen employee information. Eligible employees will receive up to $5,000 in reimbursement for breach-related losses, a cash payment of up to $475, and one year of identity theft and credit monitoring. Notifications will be sent by mail, with final approval of the settlement expected at an April 16 hearing, pending no objections. The lawsuit alleged that Rumpke failed to implement adequate cybersecurity measures and only detected the attack after ransom demands were made. This incident follows a string of recent cyberattacks on local governments and healthcare providers, including the City of Middletown and Kettering Health, which disrupted services and led to follow-on scams. The FBI reported that cybercriminals stole a record $16.6 billion from Americans in 2024, underscoring the growing threat of ransomware and data breaches.

On December 10, 2024, the Vermont Office of the Attorney General reported a data breach at Rumpke Consolidated Companies. The breach, which began on July 20, 2024, involved unauthorized access to employee information through a compromised user account. The affected information includes personal data such as names, addresses, dates of birth, Social Security numbers, and health insurance data.