Our Lady of the Lake University settles 2022 data breach lawsuit

SAN ANTONIO – After nearly 42,000 employees and students were affected by a data breach in 2022, Our Lady of the Lake University (OLLU) has decided to settle a proposed class action lawsuit.

A certification and final approval hearing is scheduled for Nov. 15, after preliminary approval was given in July.

According to a statement from the university on the city’s West Side, the personal data that was hacked included names, dates of birth, Social Security numbers, addresses, driver’s license numbers, passport numbers, medical expenses and debit/credit card information.

The terms of the settlement agreement mean that those affected by the data breach will be reimbursed for their ordinary out-of-pocket expenses, including losses such as banking fees due to identity theft, up to $400 per person.

For extraordinary out-of-pocket expenses, group members must provide documentation that they have made reasonable efforts to prevent the losses, such as identity theft insurance. This will be limited to $2,500 each, according to the agreement.

Members of the class can submit a claim to accept two years of credit monitoring and theft recovery services.

The agreement states they can receive up to three hours of lost time for $25 per hour.

In addition, the university agreed to pay administrative and attorney fees for the settlement, totaling approximately $216,000.

OLLU made the announcement publicly in March last year, apologizing for the incident and saying they were “not aware of any reports of identity fraud or improper use of any information as a result of this incident.”

A Texas student, Ana Vasquez, who applied to the university but never enrolled in 2019, sued the university in April 2023 on behalf of herself, current and former students, those who applied to the university, and OLLU- employees.

She said she suffered injuries, citing $295 in fraudulent credit card charges, lost time limiting the risk of identity theft and invasion of privacy.

In May 2023, another complaint of a similar nature was filed by Jose Gonzalez, and the lawsuits were combined.

These claimants will each receive $5,000 in service awards.

In the lawsuit, the plaintiffs said: “The current and ongoing risk to the victims of the data breach will continue throughout their lives.”