Let us read it for you. Listen now.
Your browser does not support the audio element.
Three former J.B. Hunt employees sued the company in federal court this week claiming a data breach put the personal information of thousands of workers at risk.The suits by Wendy Parnell of Bentonville, Shileen Lange of Richmond, Va., and Aaron Hunter of Ellenwood, Ga., seek class action status. They were filed Tuesday in the United States District Court, Western District of Arkansas, Fayetteville Division.According to court documents, on Oct. 23 a data breach at J.B. Hunt was reported by a hacker group who claimed it infiltrated the company’s computer system and obtained access to employees’ private, personal information or PPI. That information included names, dates of birth, Social Security numbers, driver’s license numbers, contact information, and financial information as well as some business records.All the suits contend the ransomware cyber criminal group known as “Whitearmor” posted on its dark web leak site claiming that it had “140,838 employee records” that contained PPI and national identification numbers. The group demanded $5 million in ransom for the information.“We are investigating a cybersecurity incident involving unauthorized access to certain information within an isolated portion of J.B. Hunt’s technology system,” a J.B. Hunt spokesperson said in response to emailed questions. “Our systems remain operational, and there has been no disruption to our ability to serve customers. Upon learning of the incident, we quickly implemented our response protocols with the support of a leading cybersecurity firm, notified law enforcement, and promptly revoked the unauthorized access. We take this matter seriously, and we are continuing to investigate.”The company did not respond to requests for comment regarding the lawsuits.In recent days, websites including Cyber News Live, DeXpose and Dark Web Intelligence reported Whitearmor’s claims it had breached J.B. Hunt’s computer network.Hunter’s suit contends the hackers also claimed to obtain “approximately 1.7 million carrier contacts, 38.2 million invoices, 187,000 access-permission records, 3,196 ranked account-takeover targets, 973 Microsoft 365 mailboxes, and records concerning 374,000 organizations.” The suit notes these figures are based on the hacker’s claims and had not been verified.Hunter’s action also argues J.B. Hunt did not promptly notify those affected by the information breach.The various suits’ claims against J.B. Hunt include negligence, implied breach of contract, unjust enrichment, invasion of privacy, and breach of fiduciary duty. All three ask for a jury trial.Howard Brill, a professor at the University of Arkansas School of Law, said the case would hinge on if J.B. Hunt employed and implemented proper safeguards to protect its records from cyberattacks.He said typically, at an early stage in the lawsuit, the federal judge has a hearing on whether to certify the lawsuit as a valid class action.Brill added while the plaintiffs would likely wish to get the case before a jury, most class action lawsuits typically end up with the dismissal of the claim or a settlement.The suits contend that J.B. Hunt had an obligation to protect and safeguard personal information of its employees and its customers from unauthorized access and intrusion. They argue sensitive data should have been encrypted or redacted and better protected by J.B. Hunt and the company was negligent by not doing so.They argue the breach was preventable and that J.B. Hunt’s computer system was vulnerable to intrusion and the company didn’t put the proper measures in place to keep the PPI information safe, including failure to meet security guidelines suggested by the Federal Trade Commission.All the plaintiffs contend access to the data by outsiders makes them vulnerable to financial crimes now and for as long as they live.“Hackers targeted and obtained the Private Information because of its value in exploiting and stealing the identities of Class Members and to conduct financial crimes against Class Members. The present and continuing risk to victims of the Data Breach will remain for their respective lifetimes,” Lange’s suit reads in part.Lange and Parnell are represented by the Sanford Law Firm, based in Little Rock, and Hunter is represented by Carney, Bates and Pulliam PLLC, also based in Little Rock.The law firm of Migliaccio & Rathod LLP, with offices in Washington, D.C. and San Francisco, Calif., and Data Privacy Justice, which connects possible plaintiffs with attorneys, have both said they are starting investigations into a possible J.B. Hunt data breach, according to their websites.J.B. Hunt Transport Services includes intermodal, dedicated, refrigerated, truckload, less-than-truckload, flatbed, single source, last mile and transload operations. It celebrated its 65th year in business in August.In 2021, J.B. Hunt was sued in the Western District of Arkansas by a group of job applicants who claimed their personal information was compromised when they used the company’s job portal. The suit was dismissed without prejudice in October 2022. The judge ruled the plaintiffs lacked standing to sue since they had not shown they suffered any injuries or potential injuries as a result of J.B. Hunt’s system.In 2023, J.B. Hunt sued TTEC Digital LLC, the maker of its online driver recruitment software, for breach of contract in federal court, contending that the software had vulnerabilities that could compromise the system. In August 2024, before the issue went to trial, both companies asked for the case to be dismissed with prejudice to refiling, with each company bearing their own legal expenses.According to the 2025 Federal Bureau of Investigation Internet Crime Report, losses due to internet crime stood at $28.88 billion, up 26% from $16.6 billion the year before. In 2025, there were a little more than 1 million complaints; of those, 3,963 were data breaches valued at $435.2 million. The FBI defines a data breach as the use of a computer intrusion to acquire confidential or secure information. It doesn’t include personally owned computers, systems, devices, or personal accounts such as social media or financial accounts.There have been reports of several recent hacker attacks in Arkansas.Interlock Ransomware claimed this year that it accessed the city of Fort Smith’s computer system. Fort Smith officials said they identified a “cybersecurity event” on Aug. 16, but declined to provide details. At risk was the personal and financial information of more than 1,000 city employees and more than 36,000 Fort Smith residents and businesses that had city water and sewer service.In 2025, an attack on the computer system at the Pulaski County clerk’s office forced officials to shut down the system necessary to issue marriage licenses, process voter registration applications and receive real estate-related documents.It took until April 2025 to restore the computer system from an attack that started in January.No personal data from the clerk’s office was compromised, said Pulaski County Circuit and County Clerk Terri Hollingsworth.The county said it adopted security measures, including an anti-phishing system, staff training on spotting suspicious-looking emails and changing email addresses from “.com” to “.gov.”In 2024, a class-action lawsuit with the potential to include more than 350,000 plaintiffs was filed in Johnson County against Arisa Health Inc., Arkansas’ largest behavioral health provider, over the data theft from a hacking attack. The Springdale-based nonprofit disclosed that hackers had accessed or tried to access personal information of Arisa clients for a period of about 18 days in March 2024. Arisa denied any wrongdoing but settled the claim for $1.9 million.A 2022 cyber-attack on the 21,000-student Little Rock School District’s data networks cost the school system almost $692,000. That figure included a ransom along with consulting and threat detection software costs.Crawford County government officials shut down their computers in 2021 after a malware attack was discovered during the Christmas holidays.
John Magsam
jmagsam@nwaonline.com
John Magsam is the Northwest Arkansas bureau chief. He works on the business desk and covers the state’s casino, brewery and firearms industries. John also has some editing duties. He started his newspaper career at the Chillicothe Constitution Tribune in Chillicothe, Mo. in 1993 and has worked at the Arkansas Democrat-Gazette since 1999. John is a graduate of Arkansas Tech University in Russellville.
——————————————————–
Click Here For The Original Source.
