former winn-dixie employee sues over security...

Former Winn-Dixie employee sues over security breachBY CHRISTIAN CONTESTAfE WRITER

JACKSONVILLE - After filinghis 2011 tax return, former Winn-Dixie Stores Inc. employee Pat-rick Burrows was informed vialetter from Winn-Dixie that therehad been a security breach affect-ing employees' personal data.

Shortly thereafter, Burrowswas informed by the InternalRevenue Service that he was noteligible for a tax refund becausesomeone else had already filed forone using his identity.

On July 31, Burrows' attorneyfiled a class-action lawsuit againstWinn-Dixie and a third-partyvendor called Purchasing Power

LLC. The suit, which claims dam-ages of more than $5 million,states that the personal informa-tion that was breached includedWinn-Dixie employee names,addresses, birth dates, salariesand Social Security numbers.

"Information of this type is ex-tremely confidential," said Bur-rows' attorney, John Yanchunis.

BREACH: Lawsuit seeks S5 millionin damages from identity theftFROM PAGE 1

through a payroll deduction program.Employees had the option to enroll inthe program, but Burrows was not en-rolled. The suit states that in the fallof 2011, a Purchasing Power employeeinappropriately accessed the personaldata of Winn-Dixie employees.

A representative of Purchasing Powerdid not return an emailed request forcomment.

Delay in notificationThe suit, filed in the U.S. District

Court for the Southern District of Flor-ida, states that Winn-Dixie employeesshould have been notified of the breachsooner. The breach occurred in October,

tobeso

careful. There seems to be failures

on multiple levels here. It's a

huge problem for Winn-Dixie

and forPurchasingPower."

Robert WhiteShareholderGunster, YoakleV & Stewart PA®

but Winn-Di'xie did not send out letters toemployees notifying them of the breachuntil January. Purchasing Power hasstill not informed the employees aboutthe breach, said Yanchunis, a Tampa-based attorney at Morgan & Morgan PA.

Yanchunis said the IRS is now investi-gating Burrows' tax return fraud case.The money from the return, which Yan-chunis said is in the thousands, is thelargest amount of money Burrows haslost since the breach, but there havebeen other, smaller cases of identitytheft.

Winn-Dixie, based in Jacksonville,operates grocery stores in five statesthroughout the Southeast. Since thebreach occurred, the company mergedinto Jacksonville-based Bi-Lo HoldingsLLC, which is now the ninth-largestgrocery store chain in the United Stateswith 687 grocery stores in eight South-eastern states.

Although he has not yet heard of anyother identity theft cases from Winn-Dixie employees, Yanchunis expectsto certify the case as a class-actionsuit within 90 days. Burrows has sinceleft the company, but at the time of thebreach, he worked at a Winn-Dixie storein Miami. Yanchunis said the breachpotentially impacted all of the employ-ees in the state. He is not yet sure if em-ployees in other states were impacted.

A representative of Winn-Dixiedeclined to comment on the case.

Robert White, a shareholder at Gun-ster, Yoakley & Stewart_RX who specializes incorporate law and tech-nology and entrepre-neurial companies, saidsecurity breach cases arebecoming more commonas companies store morepersonal data and crimi- ^^nals become more adept Whiteat stealing it.

Companies should do their due dili-gence before signing an agreement witha third-party provider, and should con-tinue to monitor third-party providersduring the term of the agreement tohelp prevent security breaches, Whitesaid.

"Winn-Dixie was trying to do some-thing nice," said White, who has no per-sonal knowledge of the case. "You'vejust got to be so careful. There seems tobe failures on multiple levels here. It'sa huge problem for Winn-Dixie and forPurchasing Power."

cconte@bizjournals.com I @CConteJBJ 1265-2227

"It has tremendous value and cancause tremendous harm if it isbreached."

Purchasing Power, based inAtlanta, provides an employeebenefit program in which em-ployees have the option to pay fornew electronics and appliances

SEE BREACH, PAGE 27