On June 30, 2021, Washington Law Center learned that dozens of our injured worker clients were potentially affected by a data breach reportedly suffered as the result of a ransomware attack perpetrated against Pacific Market Research, a data collection firm hired by the Department of Labor & Industries.
Huge Data Breach Impacts Injured Workers with Washington L&I Claims
We believe that in total, many hundreds or thousands of injured workers may have been impacted by the cyber-attack against Pacific Market Research. The information supplied to us by the Department’s management team is that they were attacked sometime in late May 2021 and reported a potential breach of injured worker claim file information to the Department in early June. We have been given no information why it has taken the Department as long as it has to report this breach of sensitive information.
About The Pacific Market Research Data Breach
The Department of Labor and Industries has indicated to Washington Law Center that it supplied Pacific Market Research with the name, address, phone number, birth date, employer and Labor & Industries (workers’ compensation) claim file number of each affected individual.
The Department has indicated to our firm that the impacted individuals had active, recently filed industrial injury, or occupational disease claims during the period of March 1, 2019, through August 31, 2019. The Department has indicated to us that it is unable to confirm or deny the extent to which any individual’s data has been obtained by the unauthorized hackers.
The Law Protecting Injured Workers’ Records
RCW 51.28.070 provides that an injured worker’s claim files and records are to be maintained as confidential. Only public employees in the performance of official duties, parties to the workers’ compensation claim, and agents (experts and consultants) responsible for assisting the parties or government in a particular stage of the “proceedings” (legal process) may have access to “information contained in the claim files and records of injured workers.” A common-sense reading of this statute indicates that the information disclosed by the Department to Pacific Market Research was not for the purpose of assisting in legal proceedings involving each impacted injured worker. Therefore, the Department’s disclosure appears to be a “per se” violation of each injured worker’s statutory entitlement to confidentiality.
Our Thoughts On The Department of Labor & Industries’ Responsibilities
Ultimately, Washington Law Center believes that the Department of Labor & Industries was negligent in providing confidential claim file information to a company that was demonstrably unable to protect itself against a foreseeable ransomware attack. We believe that the Department took inadequate steps to ensure that workers’ compensation claim file information remained inviolately confidential. The employees of Pacific Market Research are not “public employees in the performance of their official duties.” The Department did not ask the injured workers if they could disclose their confidential information before doing so. We were never asked on behalf of our affected clients to waive their statutory rights and place their claim file information at risk. We believe the Department has breached its fiduciary and other duties of care owed toward the injured workers of this state.
Consequences Of Companies’ Failure To Defend Against Cyber-Attacks
RCW 51.28.070 provides that the Department clearly had a duty to keep the information in each injured workers’ claim file confidential. It wantonly breached this duty when it transmitted that information to Pacific Market Research, knowing that Pacific Market Research would then electronically store and use that information for purposes other than legal process.
On information and belief, the Department took inadequate steps to ensure that injured worker data would be confined to secure, offline systems and databases where they would not be subject to ransomware attacks. The Department failed to achieve the informed consent of the injured workers whose claim file data was placed at risk. But for its violation of RCW 51.28.070, no harm would have come to our state’s injured workers via the attack committed upon Pacific Market Research.
Undo Emotional Distress For Victims
Our injured workers have been severely damaged. The Department has negligently inflicted emotional distress on all injured workers, especially those whose data was held and stored by Pacific Market Research. The specific data that was improperly disclosed to Pacific Market Research is sufficient to ascertain that each named individual was recently injured at work and then claimed that recent industrial injury to the Department of Labor & Industries.
That is information that injured workers are generally advised to keep strictly confidential because, as the state very well knows, prospective future employers and their risk managers dislike hiring injured workers with a history of filing workers’ compensation claims. Employers fear that if they hire somebody who is risk-prone, or in their common suspicion “claim-prone,” they will eventually bear a disproportionate share of workers compensation claim liabilities which could otherwise be avoided.
The Washington Legislature has specifically found that whenever an injured worker suffers an industrial accident or occupational disease that results in permanent disability, that occurrence can often become a “substantial obstacle” to future employment. See, e.g., RCW 51.32.095(4). In fact, the Department spends millions of dollars every year providing injured workers with very expensive and targeted vocational assistance, including “preferred worker” subsidies meant to entice otherwise dubious, prospective new employers to hire previously injured workers. The subsidies available not only release the prospective future employer from liability for additional on-the-job injury claims during a limited period of time, but also the Department will literally reimburse the new employer a substantial amount of the injured worker’s hourly wages if the new employer keeps the previously-injured worker employed for a sufficient length of time.
These massive financial incentives are only authorized by the Legislature and paid by the Department, and employers are legally forbidden from asking a prospective new hire about their L&I claim filing history during the application process, precisely because whenever such a history becomes known or perceptible, it is less likely that a job offer will then be extended. The Legislature literally bribes employers to disregard their natural inhibitions.
Injured Workers Unfairly Recieve The Brunt Of A Data Breach
Injured workers whose L&I claim file information has been breached may also now be at heightened risks of identity theft, conversion of property and other crimes of opportunity carried out against those who are often perceived as being less able to defend themselves.
Plus, as every attorney very well knows, there’s an entire industry of individuals who offer high-interest loans to people who have legal claims pending. Even when no actual crime is being committed, injured individuals are often targeted by the unscrupulous for every form of exploitation. The injured workers whose claim file information has been breached in the Department’s Pacific Market Research scandal now need to remain even more vigilant.
Accountability Needed At The Department of Labor & Industries
Washington Law Center is hereby calling for Governor Inslee to immediately fire Director Joel Sacks for failing to safeguard injured worker claim file information, but please consider this is just the latest scandal involving this political appointee.
- Under Joel Sacks tenure, certain large employers have been given preferential claims management treatment (“dedicated claims management”) that has the effect and/or impression of the Department taking sides against injured workers and providing unequal protection to both injured workers and small business employers alike. Jeff Bezos seems happy, though.
- Under Joel Sacks, excessive use of IME examinations (generally understood by those who represent injured workers to be anti-worker, anti-treating physician exams) became so-well recognized that the legislature finally had to act to limit the Department’s deplorable practices in that regard.
- Under Joel Sacks tenure, the Office Careers scandal was an open secret for years in which the Department paid for bogus injured worker retraining in order to claim that disabled workers could work (and therefore weren’t entitled to a state pension) when they couldn’t.
- Under Joel Sacks tenure, vocational experts routinely, and without consequence, disregard the mandate of WAC 296-19A-010 to consider the effects of an injured worker’s age on their employability. Our more elderly injured workers have been abused as a result.
- Under Joel Sacks tenure, the physician network mandated by the Department has become so dysfunctional and restrictive that many of our state’s injured workers cannot even find a physician to treat them (yet they are not allowed to see out-of-network providers).
- Under Joel Sacks tenure, the Department constantly and incompetently ignores reason and logic and thereby drives massive state expenditures on anti-worker litigation efforts funded by taxpayer dollars.
Either Governor Jay Inslee should immediately fire Director Joel Sacks or Governor Inslee himself should resign.
Was I Impacted By The L&I Claims Information Data Breach?
In the meantime, if you are one of the many unfortunate Washington injured workers being notified that your private L&I claim file information was potentially breached in the recent cyber-attack against Pacific Market Research, you may consider filing a lawsuit against the Department of Labor & Industries for your damages related to the Department’s negligence; public disclosure of private facts; outrage; negligent infliction of emotional distress; and any other potentially-applicable cause of action that may exist under the facts of your case and the law of our state. However, please keep in mind that a formal tort claim notice against the state must first be filed with the Department of Enterprise Services at least 60 days prior to when you file suit. A class action lawsuit is already planned.
If you have questions about your Industrial Insurance Act rights generally, or you wish to join a class action suit against the Department of Labor & Industries and other responsible bad actors, please call Washington Law Center for a free consultation today.
