On April 29, 2024, millions of inboxes lit up with alarming news: a data breach of colossal scope had potentially exposed some of the most private details of about 1.1 million individuals, all linked to the professional services firm Berry, Dunn, McNeil & Parker, LLC (hereafter “BerryDunn”). The law firm representing the victims, in a newly filed class action complaint, said BerryDunn waited nearly seven months—since September 2023—to notify those impacted. Within that timeframe, cybercriminals had allegedly gained access to names, Social Security numbers, health insurance policy details, dates of birth, and addresses.

At face value, the BerryDunn breach is an all-too-common occurrence in today’s data-driven world: a prominent company, entrusted with highly sensitive and personally identifiable information (PII), is hacked and only discloses the damage well after the fact. Yet upon closer examination, the allegations in the complaint are far more disturbing. They depict not merely a single act of negligence but also expose systemic vulnerabilities in the way data security is handled across industries under what’s commonly called “neoliberal capitalism.”

Neoliberal capitalism is exactly what it sounds like. Neoliberal meaning complete deregulation of markets, and capitalism meaning our capitalistic economic system. Basically the libertarian’s wet dream.

This article investigates the revelations contained within the lawsuit. We’ll explore each documented claim while placing the allegations against BerryDunn within a broader narrative of corporate greed, deregulation, and profit maximization. By examining the structural issues in data governance, we can more clearly understand why breaches continue to thrive—and who shoulders the burden when they do. Most importantly, this exploration illuminates what it means for impacted communities, including the real people who may have their identities stolen, and what it signals about the disheartening state of corporate accountability in the digital age.

Below is a long-form investigative narrative that unpacks each dimension of these allegations. We’ll delve into the major points of the lawsuit, discuss the suspected corporate misconduct in detail, and highlight how these behaviors echo a deeper crisis in what many label late-stage capitalism—an era marked by deregulation, massive wealth disparities, and questionable corporate ethics.

---

Corporate Intent Exposed

The court complaint lays out the specifics of how BerryDunn allegedly mishandled the personal information of more than a million individuals. According to the filing, the impetus for the class action was a cybersecurity incursion discovered in September 2023. By BerryDunn’s own admission, an “unauthorized actor” gained access to internal files that may have contained, in the complaint’s words, “names, addresses, Social Security numbers, dates of birth, and individual health insurance policy numbers.”

A Seven-Month Gap and Egregious Delays

One of the most damning claims in the complaint is the lengthy lag between the discovery of the data breach in September 2023 and the official notifications sent to those whose data was compromised—nearly seven months later in April 2024. The significance of that gap cannot be overstated.

Victims could have faced numerous forms of identity theft and other types of fraud during that time, all without having any idea their data was at risk. The complaint criticizes BerryDunn for failing to disclose the vulnerability in a timely manner, arguing that had individuals known sooner, they could have monitored their financial statements, put fraud alerts on their credit files, or even changed health insurance information or replaced Social Security numbers if necessary (though such a replacement is notoriously difficult).

The Nature of the Stolen Data

A data breach of credit card numbers alone is serious enough, but here, hackers allegedly accessed an even more dangerous combination: Social Security numbers plus a composite of full names, birthdates, addresses, and health insurance details. In the realm of corporate corruption, especially in data security, such comprehensive PII forms a “dream kit” for identity thieves.

The risk goes beyond unauthorized credit card charges. The complaint outlines how stolen Social Security numbers can be used to commit unemployment fraud, mortgage fraud, tax fraud, or even to illegally obtain sensitive benefits and government documents. The presence of health insurance policy numbers also raises concern about potential medical identity theft—where criminals impersonate victims to receive medical treatments, leaving patients saddled with incorrect health records and burdensome bills.

The Alleged Security Failures

Through its lawyers, the Plaintiff contends that BerryDunn fell short of “industry-standard” data security practices and that the firm should have been aware of the particular attractiveness of PII to cybercriminals. The complaint cites the Federal Trade Commission (FTC) guidelines, which require firms to adequately safeguard consumer data.

In short, BerryDunn is accused of storing massive amounts of highly sensitive personal and health information without sufficient protocols to detect intrusions early or thwart unauthorized access in the first place. According to the complaint, if robust cybersecurity systems were in place, they could have sealed known vulnerabilities before the data exfiltration occurred.

The Profit Motive in Data Storage

Why would any large professional services firm fail to prioritize data security when the cost of a breach is both financial and reputational? Critics point to the standard tropes of late-stage capitalism: cost-cutting pressures, profit maximization, and a system that encourages externalizing risks onto consumers rather than confronting them directly. The complaint underscores that by not investing in the best available security measures, BerryDunn may have saved on overhead in the short term, though ironically, the class action suit could now cost them significantly more in the long run.

The class action complaint serves as an important reminder that these allegations do not stand in isolation. They reflect the repeated pattern of major organizations waiting until the last possible moment to reveal extensive wrongdoing or negligence, often after the damage is already done.

---

The Corporations Get Away With It

Data breaches have become a distressing trend. Unfortunately, in many such cases, the corporations implicated manage to escape the brunt of serious consequences. As the complaint underscores, BerryDunn allegedly used a “vendor discovered suspicious network activity” approach as a means to downplay its own failings. Such language can diffuse responsibility by pointing to contractors or outside partners.

Minimizing the Damage

When data breaches occur, a key corporate strategy often involves careful phrasing designed to minimize the scale of a breach. Phrases like “unauthorized access,” “suspicious network activity,” or “limited infiltration” are used in place of stronger language that might convey the severity of the compromise. The complaint against BerryDunn suggests that such rhetoric masks deeper failings.

The lawsuit claims that once BerryDunn realized the scope—particularly the theft of Social Security numbers and dates of birth—they still waited, presumably on the advice of legal and crisis management teams, to finalize their statements. There is also the strong insinuation that BerryDunn wanted to thoroughly investigate the breach first, seeking to control the narrative or prepare for potential legal blowback, rather than focusing primarily on early warnings to at-risk individuals.

Regulatory Loopholes

The complaint suggests the existence of regulatory loopholes that major firms can exploit. For instance, several states have data breach notification laws requiring companies to inform residents “without unreasonable delay.” But how “unreasonable delay” is interpreted can vary. In some jurisdictions, a timeframe of up to 45 days is considered standard. However, the class action complaint states that BerryDunn essentially delayed for about seven months, which goes well beyond what most would consider “reasonable.”

The fact that these lines are gray rather than strictly defined in many regulatory frameworks leaves an opening for companies to interpret the law in ways that minimize their immediate liability and buy them time to attempt to manage any reputational fallout. The complaint frames BerryDunn’s actions as a prime example of such exploitation.

Subtle Forms of Regulatory Capture

The alleged BerryDunn fiasco also hints at a broader phenomenon: the “revolving door” between industries and their would-be regulators. In some industries, powerful companies are often staffed by the very individuals who once worked in government enforcement agencies—or anticipate working for them in the future. This dynamic can water down the rigor of investigations and lead to tepid enforcement.

Although the complaint does not explicitly accuse BerryDunn of regulatory capture, the widespread frustration with corporate data breaches arises, in part, from this background dynamic. The sense that large corporations “get away with it” stems from a system that critics say is increasingly unbalanced—where the penalty for a data breach is too light compared to the profound harm inflicted on unsuspecting consumers.

Erecting Layers of Legal Protections

One of the key arguments in the complaint involves whether BerryDunn failed to meet industry standards, which can strengthen the notion of negligence. Corporations often shield themselves by referencing professional guidelines, disclaimers, or vendor compliance forms that give the illusion of security compliance without guaranteeing robust, ongoing adherence.

The complaint contends that BerryDunn’s clients and the impacted individuals were led to believe their data would be treated with the utmost confidentiality and state-of-the-art security protocols. That promise allegedly remained unfulfilled when the breach surfaced. Moreover, if these data subjects had been adequately informed of the potential security shortfalls, many might have refused to hand over their personal information or would have at least insisted on more robust privacy guarantees.

In short, the lawsuit frames BerryDunn’s alleged misconduct as part of a pattern whereby corporations rely on murky frameworks and paternalistic assurances to sidestep more fundamental accountability.

---

The Cost of Doing Business

Under neoliberal capitalism, companies often view certain operational risks as part and parcel of profitability. Data breaches, if not entirely accepted, sometimes get relegated to the “cost of doing business.” By the time a breach is discovered, executives weigh the expense of immediate notification, possible business disruptions, and potential litigation against the expected returns of continuing operations as normal.

The Economic Fallout for Communities

For 1.1 million individuals, the “economic fallout” is intensely personal. According to the complaint, many victims may be forced to spend precious time (itself a cost) monitoring credit reports, placing fraud alerts, and even dealing with identity theft if criminals successfully exploit their stolen information. As the lawsuit observes, the theft of Social Security numbers is particularly damaging because they can be exploited for years.

On a larger scale, data breaches trigger downstream economic ripple effects:

• Credit Worries: Banks and credit card companies face increased fraud. They pass these costs on to the public through higher fees and stricter lending practices.
• Insurance Premiums: Health insurers may raise premiums to account for potential fraudulent claims and administrative overhead in dealing with the aftermath.
• Local Markets: Communities in which the victims reside may face less consumer spending if those affected fear using payment methods for everyday transactions, out of fear of future digital vulnerabilities.

These hardships converge to highlight how, under a system bent on growth and profit maximization, ordinary people bear the brunt of corporate missteps.

BerryDunn’s Profit Maximization Strategies?

While the complaint does not provide exact figures on BerryDunn’s net revenues or profits, it underscores the firm’s broad range of services, from tax consulting to assurance and financial advisory, potentially pulling in hundreds of millions annually—some of it from businesses, nonprofits, and government agencies. If BerryDunn’s data security environment was insufficiently funded or maintained, critics might argue that the money saved on cybersecurity upkeep effectively contributed to short-term profit margins.

As we examine time and again in the broader corporate world, real accountability for data misuse or negligence often only arrives in the form of class actions or regulatory fines. Even then, such payouts can pale in comparison to a company’s earnings—essentially allowing businesses to treat cybersecurity failings as a line item on the balance sheet.

Privatized Gains, Socialized Losses

The class action complaint sees BerryDunn as an example of how corporations privatize gains while socializing losses. The firm, presumably, used the data to facilitate profitable services. Yet when the data was compromised, it was the plaintiffs—the individuals—who suddenly had to invest time, money, and emotional labor in mitigating the fallout.

This dynamic exemplifies a longstanding critique of late-stage capitalism: corporations are quick to claim ownership of data and the right to profit from its analysis, but when that data becomes a liability, the cost is largely foisted onto consumers. The complaint rings alarm bells that no matter how successful a corporation is, if it fails to commit to robust cybersecurity, the people whose data is compromised will shoulder the real and immediate financial impact.

---

Systemic Failures

The BerryDunn data breach allegations point to a broader phenomenon of systemic failure. We live in a time when critical personal data is an organization’s gold mine. Yet ironically, the systems intended to safeguard these digital gold mines remain underfunded, under-prioritized, or outdated.

Regulatory Gaps and a Patchwork of Laws

Although data breach notification laws do exist, the complaint shows how BerryDunn’s internal decisions about disclosure left 1.1 million people in the dark for months. This discrepancy underscores a major problem with regulatory enforcement.

In the United States, each state has its own data breach laws, and the federal rules are scattered across sector-specific regulations (e.g., HIPAA for health data). The result is a patchwork of guidelines that vary from one jurisdiction to another. Companies with large national footprints—like BerryDunn, which serves diverse clients across state lines—can exploit these differences or use them strategically to delay comprehensive public notification.

The Illusion of Accountability

Government oversight often appears toothless when it comes to data security. Although agencies like the Federal Trade Commission are empowered to investigate and penalize companies for “unfair or deceptive acts or practices,” the fines levied are sometimes minuscule relative to corporate revenue. Furthermore, corporations frequently negotiate these fines down or tie them up in appeals for years.

According to the complaint, BerryDunn did not meet the “industry-standard data security practices” it should have adhered to. But “industry standard” is itself an ambiguous phrase. It might refer to guidelines like the FTC’s recommendations or frameworks such as NIST. Some states might look to organizations like the Center for Internet Security (CIS). But without a single mandatory federal standard or rigorous enforcement, compliance remains self-policed to a large degree.

The Role of Insurance

Data breach insurance is increasingly common, allowing companies to offset some of the costs when a breach occurs. Critics argue that the existence of robust cyber insurance markets can inadvertently disincentivize rigorous data protections: if the financial impact of a breach is partially neutralized by insurance, some organizations might deprioritize large-scale cybersecurity investments.

The complaint does not specify BerryDunn’s insurance details, but it is a typical scenario for major professional services firms to carry substantial cybersecurity policies. Consequently, even large payouts may not necessarily cripple the firm financially. Meanwhile, the intangible damage remains—and that intangible damage translates into sleepless nights and ongoing identity protection burdens for 1.1 million unsuspecting victims.

---

This Pattern of Predation Is a Feature, Not a Bug

Allegations like the ones against BerryDunn do not arise in a vacuum. They reflect a structural dynamic within late-stage capitalism, particularly in the professional services and finance industries. Data is so highly valued that the same system that collects it for profit also fosters an environment where corners may be cut in protecting it, because robust safeguards require capital outlays that can reduce short-term profitability.

The Rise of “Data Opportunism”

Data opportunism is the notion that personal and demographic information is a ripe resource for monetization. The result is an aggressive push to gather as much as possible, justified under the mantra of “customer insights” or “better service.” However, the class action complaint highlights the flip side: if an organization invests heavily in data collection but invests insufficiently in data security, a breach becomes practically inevitable.

This dynamic is not limited to BerryDunn. We see it across industries—retail, e-commerce, healthcare, etc.—where companies mine user or patient data. Their aim is often to refine products, target ads, or expedite marketing. Yet behind the scenes, security lags. As one 2021 study on data governance found, a majority of data-rich corporations spend more money on marketing or big data analytics than on cybersecurity infrastructure.

Corporate Greed and a Growing Wealth Disparity

When a firm like BerryDunn experiences a data breach, it primarily impacts individuals who are far less wealthy than the corporation or its executives. The wealth disparity is made painfully evident in the complaint’s description of the life disruptions faced by the average victim: time and money spent on credit monitoring, the anxiety of identity theft, difficulties obtaining credit, and even the potential for losing government benefits or employment opportunities should their Social Security numbers be misused.

At the same time, it’s rarely the upper echelons of a corporation who personally suffer the immediate fallout. Executives may face reputational or organizational risks—perhaps the board might ask pointed questions—but rarely do they endure the same direct, long-term financial consequences or stress of identity theft that the impacted consumers do.

A Cascade of Effects

The claim that data breaches are part of a “feature, not a bug” of neoliberal capitalism addresses the broader environment where cost-benefit analyses often overshadow moral or ethical obligations. If the cost of truly safeguarding personal data is deemed excessive, corporate decision-makers may settle for the “good enough” approach—knowing that many vulnerabilities can stay hidden for years. If and when a breach occurs, the immediate costs are spread out among insurance coverage, statutory fines, or “business as usual” overhead. Meanwhile, the intangible losses of the victims remain off the corporate ledger.

Thus, the complaint is also a wake-up call that these alleged corporate misbehaviors track with a systemic priority: profits over people. By tying this incident back to late-stage capitalism, we see how the worst corporate instincts flourish when there is little effective oversight and no consistent impetus to protect consumer welfare, other than to avoid negative press.

---

The PR Playbook of Damage Control

BerryDunn’s approach, according to the lawsuit, mirrors a classic “damage control” playbook that many corporations adopt after a breach. It involves carefully worded public statements, a controlled timeline for disclosure, offers of minimal credit-monitoring services (to appear responsive), and strategies to limit long-term liability.

Standardizing Apologies and Firm Denials

Corporate press releases following such breaches tend to sound familiar: “We take data security very seriously. We regret any inconvenience caused.” These statements, no matter how sincere they might read, often aim to convey only the bare minimum of responsibility required. In many cases, they’re drafted by a mix of legal counsel, PR strategists, and compliance officers who weigh every word’s liability implications.

In the complaint’s telling, BerryDunn’s statement about “immediately implementing cybersecurity experts” or “promptly taking steps to secure compromised systems” may ironically underscore what critics suspect was insufficient caution from the start. The question remains: If “immediate” measures were needed, why weren’t those measures already in place?

The Breach Notification Letter

Part of the lawsuit’s critique focuses on the form letter sent to victims. The complaint calls out that it included innocuous-sounding language about “suspicious network activity” and “an unauthorized actor.” Meanwhile, the truly critical detail—that Social Security numbers had likely been stolen—was relegated to the middle paragraphs.

While the factual statements in the letter may be accurate, the complaint alleges that the structure and timing are designed to blunt the shock, presenting a semblance of corporate responsibility while never fully acknowledging that these affected individuals may face a lifetime of vigilance for identity theft.

Deploying the “No Admission of Liability” Clause

Another hallmark of post-breach PR is the “No Admission of Liability” disclaimer. Often, the breach notification letters or subsequent press statements mention that while the company is extending services or performing an investigation, it is not admitting any wrongdoing. By positioning itself as a victim of a sophisticated criminal act—rather than a potential enabler of that act through lax security—BerryDunn would aim to maintain a stronger legal defense.

This stance can hamper settlement negotiations in class actions, making the process of restitution to victims more drawn out. In the meantime, from a purely PR standpoint, the stance helps contain brand damage.

---

Corporate Power vs. Public Interest

When corporations mishandle personal data, we confront deeper questions about corporate social responsibility and the role of companies in protecting public welfare. In theory, a professional services firm like BerryDunn stands as a trusted advisor to the community, interfacing with nonprofits, government agencies, and individuals in sensitive positions. Yet this lawsuit exemplifies how, when push comes to shove, the profit motive can overshadow the broader public interest.

Eroding Trust in Public Institutions

A large chunk of BerryDunn’s revenue may come from government contracts or public sector engagements, as it promotes itself as an experienced consultant for state agencies. If the allegations are true and BerryDunn’s lax data security compromised PII for over a million individuals, these same state agencies (and the taxpayers funding them) are effectively paying for a flawed service.

The damage extends beyond individuals to the credibility of entire public systems. When data breaches occur under the watch of a firm that manages sensitive public or semi-public data, residents lose faith in the government’s ability to protect them. This outcome can undermine public trust in essential services, from tax collection to welfare administration.

Consumers vs. Shareholders

Under the current system, executives often answer to shareholders, not necessarily to consumers or the broader population. In maximizing shareholder profits, a corporation might cut corners on data security or hire cheaper (and possibly less rigorous) third-party vendors.

When data breaches happen, it’s consumers—particularly those from less wealthy backgrounds—who disproportionately experience personal and financial damages. Meanwhile, shareholders are shielded behind the corporation’s structure. If a lawsuit emerges, the burden generally does not fall on them directly but on the company’s balance sheet.

The complaint highlights this tension, arguing that BerryDunn’s senior leadership effectively gave priority to short-term cost savings over the well-being of the individuals whose PII they had promised to safeguard.

Corporations’ Dangers to Public Health (and Well-Being)

Although the stolen data in question includes health insurance policy numbers rather than strictly medical records, the potential for medical identity theft or compromised healthcare coverage is substantial. An unauthorized user might rack up medical bills under someone else’s name or cause confusion in that victim’s medical history. Ultimately, that confusion can become a public health risk if inaccurate records lead to misdiagnoses or hamper the victim’s ability to receive correct medical treatment.

This phenomenon underscores that data security is not merely a technical or financial issue; it’s intertwined with people’s quality of life, economic stability, and health. Any corporate ethics framework that deprioritizes data security effectively gambles with individuals’ mental and physical well-being.

---

The Human Toll on Workers and Communities

At the core of this breach are everyday people whose personal lives may be turned upside down. This includes members of BerryDunn’s own workforce—consultants, administrative staff, or even the employees of BerryDunn’s clients—alongside everyday residents who interact with BerryDunn’s services.

Emotional Stress and Real-Life Consequences

The complaint details the fear and anxiety that comes with not knowing if one’s Social Security number or date of birth has been sold on the dark web. Victims may face harassing calls from debt collectors if thieves open new credit lines. Others might discover fraudulent jobless claims or see inaccurate medical charges on their insurance statements.

Time is another hidden casualty. Victims spend hours, even days, sorting through credit reports, filing police reports, or contesting inaccurate statements. For single parents, hourly wage earners, or those juggling multiple jobs, the burden of dealing with identity theft can be catastrophic—potentially leading to missed shifts or lost income.

Impacts on Local Economies

The class action complaint underscores that community-level impacts may follow. When large numbers of residents worry about identity theft, local businesses can suffer. People might become reluctant to apply for credit, making them less likely to purchase homes or cars. Decreased consumer confidence can depress local commerce.

Further, victims who lose time at work addressing identity fraud may have less discretionary income, generating a ripple effect in the local economy. Add to that the potential cost of professional credit monitoring services, which can be expensive if not provided by the company at fault.

Health and Social Justice Concerns

Because health insurance policy numbers are part of the compromised data, this breach has direct implications for healthcare access. Undocumented or vulnerable individuals may be particularly hesitant to engage with healthcare systems once their personal data is compromised, leading to public health ramifications. Additionally, even for those with stable documentation, the possibility that someone else might use their health insurance can result in claims denials or confusion about coverage.

The lawsuit highlights that in a system marked by wealth inequality, it is typically those with fewer resources who have the hardest time recovering from identity theft. Affluent victims might pay for premium identity theft protection or lawyers. In contrast, those living paycheck to paycheck face an even heavier burden.

---

Global Trends in Corporate Accountability

BerryDunn’s alleged failings fit snugly into a global pattern: major corporations are targeted by hackers seeking valuable data, and the public is left to pick up the pieces. Similar large-scale breaches have made headlines in Europe, Asia, and Latin America.

The Influence of Neoliberal Policies Worldwide

From the vantage point of neoliberal policies, governments across the globe have often sought to roll back regulations to stimulate business. Yet the unintended (or, as some argue, intended) consequence is that companies face fewer mandates to maintain robust cybersecurity measures.

Even the European Union’s General Data Protection Regulation (GDPR), one of the strongest frameworks globally, can still only go so far if companies are reluctant to pour substantial investments into data protection or if regulators lack resources to enforce existing rules vigorously.

Class Actions as a Tool for Accountability

In countries with well-established legal frameworks for class actions, lawsuits have become a principal mechanism for holding corporations accountable for data breaches. While BerryDunn might not be a household name globally, the fact that a firm of its stature can be sued for failing to protect PII is emblematic of a larger shift. People are no longer taking these breaches as unavoidable inconveniences but are legally challenging them.

Nonetheless, litigation is a slow process, with outcomes that may not always bring systemic change. Settlement sums, while seemingly large, can amount to a fraction of corporate profits, fueling arguments that these lawsuits alone will not meaningfully alter corporate behavior.

Rising Pressure for Global Data Security Standards

This case highlights the necessity for uniform global data security standards. Currently, the U.S. lacks a single, overarching federal data protection law comparable to the EU’s GDPR. But as cross-border digital transactions proliferate, data flows are no longer local.

Critics argue that until robust regulations with meaningful penalties are in place, corporations will have few incentives to prioritize consumer safety over profit margins. The BerryDunn breach, as described in the complaint, underscores just how quickly data can fall prey to criminals—and how easily organizations can appear to hide behind legal gray areas and corporate spin.

---

Pathways for Reform and Consumer Advocacy

The BerryDunn lawsuit paints a compelling picture of what can go wrong when data security is handled as an afterthought. While the complaint calls for relief and damages for the 1.1 million or so individuals allegedly impacted, it also points to the deeper structural issues plaguing corporate governance in late-stage capitalism.

Strengthening Corporate Ethics and Accountability

1. Mandatory Data Security Audits
   Regulators could compel corporations, especially those handling sensitive personal data, to undergo annual or even quarterly cybersecurity audits. These audits would be akin to financial audits but focused on verifying compliance with best practices like strong encryption, role-based access controls, and incident response protocols.
2. Transparent Incident Disclosure
   The complaint underscores the damage caused by delayed notification. Reforms could solidify a 30-day or 45-day maximum window for publicly announcing breaches. Stiffer penalties for failing to comply might incentivize companies to adopt better incident response plans.
3. Stronger Enforcement Mechanisms
   Fines for data breaches should scale with the company’s size or revenue so that even well-capitalized firms cannot treat these incidents as minor bumps. Regulators might also require extensive restitution packages, including free lifetime identity theft protection for victims.
4. Executive Accountability
   In a world of robust corporate accountability, senior managers who preside over major security failures might face direct consequences, such as clawbacks of bonuses or even personal fines if negligence is proven. This recasts data security as a high-level priority rather than a technical nuisance.

Consumer Advocacy and Empowerment

1. Know Your Rights
   From the vantage point of social justice, consumers should educate themselves on data privacy laws in their states and follow relevant news releases about data breaches. If they receive a breach notification letter, they should respond promptly—sign up for any free protection services offered and consider whether legal counsel or participation in a class action is in their best interests.
2. Holding Companies Publicly Accountable
   Grassroots consumer advocacy can utilize social media campaigns, public review platforms, and local media to publicize corporate breaches. The louder the public outcry, the harder it is for corporations to sweep the issue under the rug.
3. Policy Advocacy
   Individuals, especially those impacted by data breaches, can unite to lobby for state and federal legislation that standardizes strong data protection measures. Heightened political engagement on cybersecurity issues can lead to the passage of comprehensive data privacy laws modeled after or surpassing the EU’s GDPR.
4. Support Worker Protections
   Advocates should push for laws ensuring that employees and contractors—often the first line of defense when suspicious activity is noticed—are protected if they blow the whistle. Whistleblower protections can elevate the role of front-line IT staff who might feel corporate pressure to stay silent.

Destroying The Evidence

I want to emphasize again that it’s kind of suspicious for Berry Dunn to delete their own notice of the data breach from their own website.

It really makes it look like they’re hiding something…

Fortunately for us, the Wayback Machine exists!

https://web.archive.org/web/20240112214323/https://www.berrydunn.com/notice-of-reliable-networks-security-incident

---

💡 Explore Corporate Misconduct by Category

Corporations harm people every day — from wage theft to pollution. Learn more by exploring key areas of injustice.

• 💀 Product Safety Violations — When companies risk lives for profit.
• 🌿 Environmental Violations — Pollution, ecological collapse, and unchecked greed.
• 💼 Labor Exploitation — Wage theft, worker abuse, and unsafe conditions.
• 🛡️ Data Breaches & Privacy Abuses — Misuse and mishandling of personal information.
• 💵 Financial Fraud & Corruption — Lies, scams, and executive impunity.