Judge Clark County schools may have immunity in lawsuit over 2023 cybersecurity breach The Nevada Independent

pA Clark County judge said shes leaning toward granting the Clark County School Districts CCSD motion to dismiss a class action lawsuit filed on behalf of parents whose childrens data was leaked in a 2023 cyberattack but is giving attorneys representing both sides time to prepare arguments on whether the district should be granted immunity ppThe district first notified families of the breach on Oct 16 saying it became aware of the issue around Oct 5 ppThe lawsuit filed Oct 31 said the breach led to the compromise and public release of highly sensitive information belonging to the districts teachers students and graduates as well as their families It asks the district to promptly identify and notify all affected parties train personnel on how to identify and contain a cyberattack and compensate victims of the breach ppA group that identified itself as SingularityMD claimed to have leaked personal information from 200000 students including the students pictures and household contact information medical information and behavior incident reports and later shared files with a blog called DataBreachesnet that reports on cybersecurity issues including a spreadsheet with information from more than 300000 CCSD students ppIt was the second time the district reported experiencing a major cybersecurity breach in the last three years ppThe lawsuit blames the breach on the districts negligent andor reckless failure to adequately protect the personal information of students families and employees affiliated with the district It accuses the district of failing to implement adequate security procedures to protect its data such as updating software licenses and requiring multifactor authentication as part of the login process ppA Nov 13 statement from the district stated that it continues to work with the FBI to investigate the cybersecurity threat and identify those affected by the breach and additional safeguards have been implemented to further secure data for all students and staff The district said its also working with a third party to review and evaluate the data and determine which individuals may have been affected but hasnt said how many people have received such a notification ppDuring a Thursday hearing on the case an attorney representing the district Justin Homes argued that the plaintiffs have no standing because they havent received official confirmation that they or their students information was compromised and instead jumped the gun and ran to the courthouse before waiting to see if they were actually impacted ppBut an attorney for the plaintiffs April Strauss said those filing the lawsuit were among the parents that received emails from the hackers Strauss argued that if victims cant bring legal action before getting that verification it provides an incentive for not properly notifying victims that their data was compromisedppHolmes argued that under state law the school district has discretionaryfunction immunity from liability for an allegedly negligent decision The law states no action may be brought against a state agency that is based upon the exercise or performance of or the failure to exercise or perform a discretionary function whether or not the discretion involved is abusedppThe district says its data privacy and cybersecurity policies are discretionary and made based on judgments about their expense and impact on students and employees ppClark County District Court Judge Jacqueline Bluth agreed with the argument that the district may have immunity in the case and said she leaned toward granting the districts motion to dismiss She cited situations where immunity didnt apply where government entities did something intentionally or acted in a criminal nature rather than being negligent ppI could be completely wrong but I need you to show me that Im wrong Bluth said ppThe next hearing in the case is set for June 27 ppThis story was updated at 1120 am on 41224 to correct the name of the attorney for the district His name is Justin Holmesp