The Department of Veterans Affairs faces two class-action lawsuits related to the theft of information on 26.5 million veterans that occurred in May, 2006. The Vietnam Veterans of America (VVA) and four other veterans groups have filed a class-action lawsuit against the VA seeking $1,000 in damages for each veteran who can show that he or she has been harmed by the data theft.
Paul Hackett, a Marine reservist from Cincinnati, Ohio, who served in Iraq, and Matthew Page, from Boone County, Ky., filed a class-action lawsuit against the VA in the U.S. District Court for the Eastern District of Kentucky. It, too, seeks $1,000 in damages for any veteran damaged by the data theft.
The VA confirmed that the stolen database also contains records and private information on 10,000 to 20,000 members of the National Guard and Reserves called to active duty and for 25,000 to 30,000 Navy personnel who completed their first enlistment before 1991.
The VVA suit, filed in the U.S. District Court for the District of Columbia, asks the court to prevent the VA from altering any of its data storage systems until a court-appointed panel of experts determines how to prevent future security breaches. The National Gulf War Resource Center, Radiated Veterans of America, Citizen Soldier, and Veterans for Peace joined VVA in its suit.
The lawsuit requests that the VA take steps to head off possible identity theft by establishing an identity- and credit-monitoring program that would cover potentially all of the veterans whose information was stolen. The data was stored on a removable device attached to a laptop PC reported stolen from a VA data analyst’s home May 3.
In addition to Social Security numbers, the VA said the stolen database also contains medical diagnostic codes and medical disability ratings, which the Consumer Coalition for Health Privacy views as a potential violation of the privacy provisions of HIPAA.
The lawsuit is open to any veteran that can prove he or she has been harmed by the data theft.