FWP Faces Class Action Lawsuit Stemming From 2023 Cyberattack

Florida Water Products, LLC (FWP) finds itself at the center of a proposed class action lawsuit stemming from a cyberattack in May 2023, which may have compromised the personal data of thousands of people.

Florida Water Products Lawsuit Alleges Inadequate Security Measures Left Data Exposed

The lawsuit asserts that inadequate cybersecurity measures by the pool and spa equipment distributor were directly responsible for the breach. Compromised information may include the names and Social Security numbers of both current and former FWP employees, as well as those affiliated with the company.

According to FWP’s data breach notice letter, the incident targeted a repository of “legacy data” within its network, referring to information stored in outdated systems or formats. Subsequent investigation suggests that an unauthorized third party may have accessed FWP’s systems and obtained certain data from legacy databases.

Although specifics regarding the duration and precise dates of the cybercriminals’ access remain unclear, the breach is believed to have occurred between May 22 and May 28, 2023.

Plaintiff Alleges Inadequate Cybersecurity Left Data Vulnerable

The lawsuit contends that FWP’s failure to enforce adequate cybersecurity measures and provide sufficient training to its employees left its data vulnerable to exploitation by cybercriminals. The complaint argues that Florida Water Products notification to affected individuals was delayed and insufficient. The plaintiff, Stephen Basson, an employee of FWP affiliate Aquarius Supply, claims to have received notice from the defendant only in early December 2023, nearly seven months after the breach allegedly took place.

FWP’s notification letter, as per the filing, obscured crucial details about the breach, such as the number of affected individuals, the methods used by hackers to access the system, and the reasons for the delay in notifying victims.

The lawsuit further alleges that FWP’s tardy and inadequate notice left victims exposed to potential identity theft without proper guidance on monitoring their financial accounts or credit reports to mitigate unauthorized use of their personal information.

A request for comment by FWP about the current litigation was not received in time for publication of this article.

Not The First Or The Last

While the validity of the class action lawsuit against Florida Water Products remains uncertain and subject to legal proceedings, one thing however is certain. The pool industry is clearly not immune to cyber attack threats, as demonstrated by the increase in breaches since 2021. Most recently, Brenntag, a major chemical distributor, fell victim to a ransomware attack by the DarkSide hacker group, resulting in a staggering $4.4 million payout.