BOCA RATON, FL (BocaNewsNow.com) (Copyright © 2025 MetroDesk Media, LLC) — An apparent data beach at St. Andrew’s School in Boca Raton is leading to a major lawsuit just filed in Palm Beach County Circuit Court. Attorneys are seeking class action status in the suit against the school over the breach that occurred in 2024. It was apparently just announced by St. Andrew’s in a letter to alleged victims earlier this month.
BocaNewsNow.com is publishing the entire complaint, below. Here is are key excerpts:
“This class action arises out of Saint Andrew’s School’s failures to properly secure, safeguard, encrypt, and/or timely and adequately destroy Plaintiff” and Class Members’ sensitive personal identifiable information that it had acquired and stored for its business purposes. Defendant’s data security failures allowed a targeted cyberattack in December 2024 to compromise Defendant’s network (the “Data Breach”) that contained personally identifiable information (“PII”) (collectively, “the Private Information”) of Plaintiffs and other individuals (“the Class”). This class action arises out of a 2024 data breach (“Data Breach”) of documents and information stored on the computer network of Saint Andrew’s School, a private school for grades K-12 in Florida. Defendant launched an investigation into the Data Breach and confirmed that an unauthorized actor accessed its system on December 27, 2024, and may have copied and exfiltrated certain files containing Plaintiff and Class Members’ Private Information.
Despite learning of the Data Breach on or about December 28, 2024, and determining that Private Information was involved in the breach on December 27, 2024, Defendant did not begin sending notices of the Data Breach (the “Notice of Data Breach Letter”) until July 8, 2025. On its computer network, Saint Andrew’s School holds and stores certain highly sensitive personally identifiable information (“PI!’ or “Private Information”) of the Plaintiff and the putative Class Members, who are individuals enrolled in employment insurance benefits administered by Saint Andrew’s School, i.e., individuals who provided their highly sensitive and private information in exchange for employment and/or business services. Saint Andrew’s School also admits that “an unknown, unauthorized third party gained access to our computer systems between December 27, 2024, and December 29, 2024′ and that its investigation also revealed “the third party may have accessed and acquired certain files within [its] network.”
The Plaintiffs seek in excess of $50,000 which is the statutory minimum for filing in Palm Beach County Circuit Court. St. Andrew’s School has not responded to the suit through a public filing processed by the Palm Beach County Clerk’s office.
Read the complete complaint here.
