Kemper and Infinity Insurance Settle Data Breach Claims for $17.6 Million

On December 14, 2020, and again on March 25, 2021, data held by Kemper Corp. and its subsidiary Infinity Insurance Co. was compromised in two separate security incidents. Attackers accessed a file system containing names, addresses, Social Security numbers, driver's license numbers, medical leave information, and workers' compensation claim data belonging to roughly 6.1 million customers and employees.

The exposure drew federal litigation almost immediately. On April 8, 2021, plaintiffs including Irma Carrera Aguallo filed suit in the Northern District of Illinois, alleging Kemper and Infinity had failed to maintain basic security controls adequate to protect the volume and sensitivity of data they collected. The case, styled Carrera Aguallo et al. v. Kemper Corporation et al. (No. 1:21-cv-01883), consolidated claims from customers across the country.

M. Anderson Berry of Arnold Law Firm joined as plaintiffs' co-counsel alongside Gary M. Klinger of Mason Lietz and Klinger LLP, attorneys from the Morgan and Morgan Complex Litigation Group, and Carl V. Malmstrom and Rachele Byrd of Wolf Haldenstein Adler Freeman and Herz LLC. The legal team negotiated a settlement valued at $17.6 million that created a class-wide relief fund.

Under the settlement terms, all affected class members received automatic access to 18 months of credit monitoring and financial account protection through Aura's Financial Shield Services. Class members could also submit claims for up to $10,000 in reimbursement for documented out-of-pocket losses traceable to the breach, plus up to three hours of lost time compensated at $18 per hour. California residents were eligible for an additional $50 payment under state Consumer Privacy Act claims.

U.S. District Judge Martha M. Pacold granted preliminary approval on October 27, 2021, finding the agreement fair, reasonable, and adequate. She entered the final approval order and judgment on March 15, 2022. The settlement required Kemper and Infinity to implement additional data-security measures as part of the injunctive relief component, a condition the court factored into its fairness assessment.