Erie Insurance sued over claims that customer data was exposed in 'ransomware' attack

Erie Insurance is grappling with more than just a network outage — now it's facing a federal class-action lawsuit.

The civil complaint, filed June 15 in federal court in Erie, claims the company failed to prevent what the plaintiff contends was a ransomware attack that compromised sensitive customer data.

The lawsuit comes after Erie Insurance confirmed a major network outage on June 8 that has affected all systems and left customers locked out of their online accounts.

The company, which serves customers in 12 states and Washington, D.C., has not confirmed whether the outage was the result of a ransomware attack or whether any data was stolen.

The lawsuit claims that "on approximately June 7, 2025, a ransomware group accessed Defendant’s information network," referring to Erie Insurance.

The suit provides no evidence that a ransomware attack occurred. The suit refers to a statement Erie Insurance issued on June 7, in which the company said it is "currently experiencing a network outage that is affecting all systems." The statement gave no cause for the outage.

On June 11, in a filing with the Security and Exchange Commission, Erie Insurance described the event as an "information security event" and that they are working with law enforcement.

The lawsuit claims Erie Insurance failed to implement basic cybersecurity measures, leaving personal data — like Social Security numbers, financial details and other sensitive information — vulnerable to hackers.

“Plaintiff is now at a significantly increased and certainly impending risk of fraud, identity theft, misappropriation of health insurance benefits, intrusion of his health privacy and similar forms of criminal mischief and such risk may last for the rest of his life,” the lawsuit read.  

The lawsuit, which was filed by Illinois resident and Erie Insurance customer Neal Plascencia, is seeking a court order to make it a class action. Plascencia is seeking damages on behalf of a nationwide class of affected individuals.

"We are not changing who we are": Erie Insurance marks 100 years

The lawsuit is also seeking a court order requiring Erie Insurance to strengthen its cybersecurity practices; provide lifetime identity theft protection to victims; and fully disclose the scope of the outage.

Plascencia is being represented by Edelson Lechtzin LLP, a class-action law firm based in Newtown, Pennsylvania.

Erie Insurance did not immediately respond to the Erie Times-News for comment on the lawsuit. Erie Insurance will get a chance to respond to the lawsuit in court. A response is typically due 21 days after a defendant is served with a lawsuit. The case is assigned to U.S. District Judge Susan Paradise Baxter.

Lawsuit claims Erie Insurance was negligent, failed to safeguard

Among its claims, the lawsuit argues that Erie Insurance had a legal duty to safeguard customer and employee data ― and failed to do so out of negligence.

In addition, the lawsuit cited violations of the Federal Trade Commission Act. The plaintiff argues that Erie’s failure to follow FTC-recommended data protection practices — such as encryption, access controls and timely breach notification — constitutes an unfair and unlawful business practice. 

The lawsuit also claims Erie breached its fiduciary duty and includes a claim of unjust enrichment, asserting that Erie Insurance profited by cutting corners on data security while continuing to collect premiums from customers who expected their information would be protected.

Plaintiff seeks monetary damages

The lawsuit seeks a range of financial remedies, including actual, compensatory and statutory damages, as well as punitive damages to hold Erie Insurance accountable.  

While the exact amount will be determined at trial, the complaint also calls for restitution and disgorgement of profits Erie may have gained by underinvesting in cybersecurity.

Additionally, the plaintiffs are asking the court to require Erie to cover the cost of at least three years of credit monitoring services for all affected individuals.

Erie Insurance continues investigation of outage

Erie Insurance hasn’t fully recovered from the network outage but is making “strong and steady progress,” according to a June 14 statement from company spokesman Matthew Cummings.

“Our teams — working alongside leading cybersecurity experts — continue working around the clock to restore access for customers, agents and employees,” Cummings said. “We’re confident in our actions but this work is complex and takes time.”

The company has notified and is working with law enforcement, according to the company filing with the SEC on June 11.  

“The company continues to take protective measures and is conducting forensic analysis with the assistance of leading third-party cybersecurity experts to gain a full understanding of this event,” the filing read.

Erie Insurance, which is marking its 100th anniversary this year, has more than 7 million insurance policies in force.

Policyholders who need to initiate a claim can contact their local agent or ERIE’s First Notice of Loss team at 800-367-3743. Customer Care is also available at 800-458-0811.

A.J. Rao can be reached at arao@gannett.com. Follow him on X @ETNRao.

This article originally appeared on Erie Times-News: Erie Insurance sued over claims that customer data was exposed in 'ransomware' attack