ORLANDO, Fla. – A former University of Central Florida student body president and member of UCF's Board of Trustees filed a class action lawsuit against the university Friday after being victimized in UCF's massive Social Security number hack.
VIDEO: Morgan & Morgan investigate UCF data breach
The lawsuit was filed in federal court, in the Orlando division, one day after UCF admitted 63,000 Social Security numbers of current and former students and staff were stolen.
Plaintiff Logan Berkowtiz alleges UCF failed to provide public notice of the breach until Feb. 4, despite "UCF having knowledge of the breach as early as December 2015."
The lawsuit states "UCF owed a duty to Plaintiffs and the Class to notify them about the breach within a reasonable amount of time under the circumstances, which it failed to do, exposing the Class to additional harm."
The lawsuit seeks an order finding UCF "breached its duty" on several issues, including failing to "timely notify Plaintiffs and the Class about the breach" and failing to "safeguard and protect" personal information of the victims.
The nature of the personal information stolen makes victims "susceptible to abuse, theft and exploitation, and requires the utmost protection in its storage and handling."
The victims are also asking Judge Gregory A. Presnell for an order requiring UCF "to adequately safeguard" their personal information, an order enjoining UCF "from engaging in similar unfair, unlawful and deceptive misconduct in the future," and for "damages to be determined at trial."
UCF has offered victims of the breach free credit monitoring and identity-protection services for one year. News 6 talked to students on Saturday who felt that one year wasn't long enough.
The class is being represented by UCF alumni Joshua Eggnatz and Michael Pascucci of Eggnatz, Lopatin & Pascucci, LLP, "a consumer class action law firm," according to its website.
The lawsuit also alleges UCF violated the Family Educational Rights and Privacy Act, a federal student privacy law known as FERPA. Florida statutes mandate that all universities "shall comply with the FERPA with respect to the education records of students."
Florida statutes authorize legal action against a university that "refuses to comply" with the state statute adopting FERPA, specifically stating a student "may be awarded attorney's fees and court costs."
UCF interprets FERPA broadly, successfully arguing in an unrelated lawsuit brought by student journalists that FERPA shields the names of elected student government officials who "opt out" of disclosure of their education records -- even when the records are not personal, such as membership on a budget committee allocating $20 million.
Judge Kerry Evander of the 5th DCA ruled in UCF's favor Friday, but noted there are "valid public policy arguments as to why the type of records and information requested in this case should be subject to public disclosure," adding that "those arguments are more properly addressed to the appropriate legislative bodies." Chief Judge Alan C. Lawson and James A. Edwards joined his opinion.
UCF confirmed many victims of the data breach were from UCF Student Government Association payroll records. News 6 is working to find out what impact, if any, the new precedent set by the 5th DCA Friday -- apparently finding SGA records are FERPA education records -- may have on the class action lawsuit. The 5th DCA order is not final, as there is still time for rehearing, making its potential impact more unclear.
Universities can also lose federal funding for failing to comply with FERPA. It's unclear if the Department of Education is investigating UCF's failure to protect social security numbers of its students.
More lawsuits on UCF's data breach may be coming. Morgan and Morgan confirmed to News 6 one of its attorneys is working today on drafting a complaint against UCF on this issue. It's not the first time the firm has seen a data breach at a university.
"We have a data breach case against a southern university set for mediation in Rome Georgia on Wednesday," said attorney John Yanchunis of Morgan and Morgan.
Eggnatz released a statement to News 6 saying while he appreciates UCF's acknowledgment of the breach and investigation of the weaknesses in its security, his clients have serious concerns about the future of their confidential information and risks for years to come.
"The UCF community has a right to know how this happened, what UCF will do to make sure that this cannot happen again, and to make sure that UCF provides adequate and fair compensation to those whose sensitive information and privacy rights were compromised,” Eggnatz said.
News 6 is working to get reaction from lawyers from UCF. Check back for updates.