“According to the article, a hacker group called ‘NullBulge’ gained access to over 1 terabyte of sensitive data from Disney after infiltrating the company’s internal Slack channels. Now, a new report by the Wall Street Journal, which actually viewed the leaked files, uncovered more about the sensitive nature of the data in the stolen files, including personal data of Disney staff members.”

💡 This confirms the breach exposed a massive volume of sensitive employee data, not just minor information.

“The leak consists of more than 44 million messages found in Disney’s Slack workplace channels. This also includes around 18,800 spreadsheet files and 13,000 PDFs. The data leaked by the hackers was limited to files Disney employees posted in a Disney Slack channel, with both private and public channels affected.”

💡 The sheer volume of compromised files demonstrates systemic security failures across Disney’s communications infrastructure.

“According to internal spreadsheets found in the leaked data, ‘Disney+’ alone made more than $2.4 billion in revenue in the second quarter of 2024.”

💡 This proves Disney had substantial financial resources to invest in proper data security but chose not to prioritize it.

“Representative Plaintiff(s) and Class Members have yet to receive a letter from Defendant, stating that their PHI/PII and/or financial information has been involved in the Data Breach. Representative Plaintiff(s) and Class Members became aware of the Data Breach through articles.”

💡 Victims learned about the breach from media reports rather than direct notification from Disney, violating legal obligations.

“Defendants disregarded the rights of Representative Plaintiff(s) and Class Members by intentionally, willfully, recklessly, or negligently failing to take and implement adequate and reasonable measures to ensure that Representative Plaintiff(s)’ and Class Members’ PHI/PII was safeguarded, failing to take available steps to prevent an unauthorized disclosure of data, and failing to follow applicable, required and appropriate protocols, policies and procedures regarding the encryption of data, even for internal use.”

💡 The complaint alleges Disney’s failures were not accidental but represented willful disregard for data protection duties.

“Defendants’ negligence in safeguarding Representative Plaintiff(s)’ and Class Members’ PHI/PII is exacerbated by repeated warnings and alerts directed to protecting and securing sensitive data, as evidenced by the trending data breach attacks in recent years.”

💡 Disney had clear notice of rising cyber threats across industries but failed to take adequate protective measures.

“Defendants could have prevented the Data Breach, which began as early as July 2024 by properly securing and encrypting and/or more securely encrypting their servers generally, as well as Representative Plaintiff(s)’ and Class Members’ PHI/PII.”

💡 Security experts confirm the breach was preventable with industry-standard encryption and security protocols.

“A study by Experian found that the average total cost of medical identity theft is ‘about $20,000’ per incident, and that a majority of victims of medical identity theft were forced to pay out-of-pocket costs for healthcare they did not receive in order to restore coverage. Almost half of medical identity theft victims lose its healthcare coverage as a result of the incident, while nearly one-third saw its insurance premiums rise, and forty percent were never able to resolve its identity theft at all.”

💡 This demonstrates the severe and often permanent financial and medical consequences victims face from compromised health data.

“There may be a time lag between when harm occurs versus when it is discovered, and also between when PHI/PII and/or financial information is stolen and when it is used. According to the U.S. Government Accountability Office (GAO), which conducted a study regarding data breaches: ‘[L]aw enforcement officials told us that in some cases, stolen data may be held for up to a year or more before being used to commit identity theft. Further, once stolen data have been sold or posted on the Web, fraudulent use of that information may continue for years.'”

💡 Victims face lifetime risk of identity theft since stolen data can be exploited years after the initial breach.

“By the acts described above, Defendants violated the CRA by allowing unauthorized access to customers’ personal medical information and then failing to inform them when the unauthorized use occurred for weeks or months, and in the case of Plaintiff, for 159 days, thereby failing in their duty to inform their customers of unauthorized access expeditiously and without delay.”

💡 Disney violated California’s Customer Records Act by waiting over five months to notify at least one victim of the breach.

“As defined in the CMIA, California Civil Code §56.05(j), Defendants disclosed ‘medical information’ to unauthorized persons without obtaining consent, in violation of §56.10(a). Defendants’ misconduct, including failure to adequately detect, protect, and prevent unauthorized disclosure, directly resulted in the unauthorized disclosure of Representative Plaintiff’s and Class Members’ PHI/PII to unauthorized persons.”

💡 The breach violated California’s strict medical privacy laws by exposing protected health information without consent.

“Defendants have clearly established a policy of accepting a certain amount of collateral damage, as represented by the damages to Representative Plaintiff and Class Members herein alleged, as incidental to their business operations, rather than accept the alternative costs of full compliance with fair, lawful, and honest business practices ordinarily borne by responsible competitors of Defendants.”

💡 This alleges Disney made a calculated business decision to accept breach risk rather than invest in proper security.

“Most of the reported data breaches are a result of lax security and the failure to create or enforce appropriate security policies, rules, and procedures. Appropriate information security controls, including encryption, must be implemented and enforced in a rigorous and disciplined manner so that a data breach never occurs.”

💡 Security experts confirm that breaches like Disney’s result from failure to implement standard protective measures, not sophisticated attacks alone.

“Numerous sources cite dark web pricing for stolen identity credentials. For example, personal information can be sold at a price ranging from $40 to $200, and bank details have a price range of $50 to $200. Experian reports that a stolen credit or debit card number can sell for $5 to $110 on the dark web. Criminals can also purchase access to entire company data breaches from $999 to $4,995.”

💡 This shows the monetary value of stolen personal data and confirms cybercriminals will profit from exploiting Disney breach victims.

“Since Defendants’ profits, benefits, and other compensation were obtained by improper means, Defendants are not legally or equitably entitled to retain any of the benefits, compensation or profits they realized from these transactions.”

💡 By failing to invest in proper security, Disney reaped financial benefits at the expense of employees and guests who were harmed.