Paradies Shops to pay $6.9 million for employee data leak after REvil attack

Paradies Shops has agreed to pay $6.9 million in compensation after a massive data breach caused by the REvil hack in 2020 that affected the personal information of more than 76,000 employees.

A Georgia court has tentatively approved a settlement between Paradies Shops and affected employees whose personal information was stolen in an October 2020 cyberattack. The hackers accessed the company’s administrative systems for five days and took possession of files containing names, social security numbers and other sensitive information.

Although Paradies Shops only started sending the messages eight months later, which caused outrage among victims, the company rejected a plea deal but agreed to settle the dispute to avoid expensive and lengthy litigation.

The lawsuit was filed by a former employee who alleged that the company not only ignored basic data protection principles, but also concealed details of the incident — including the causes of the vulnerability. This, the plaintiffs believe, magnified the negative consequences of the attack. Paradies Shops is one of the largest airport retailers in the United States and Canada, with more than 1,000 stores. The incident occurred in 2020, when hackers from the REvil group hacked the company’s network. It was only eight months after the hack that the company reported the leak to both its own employees and relevant regulatory authorities.

The Paradies case is just one of many similar lawsuits: Retina Group of Washington recently agreed to pay $3.6 million in compensation, and in 2024 Lehigh Valley Health Network paid $65 million after a medical information leak.

This case demonstrates: protecting personal data is not only a task for IT specialists, but also a legal obligation. The company’s slow response and concealment of information about the incident became the basis for a lawsuit, and the significant compensation shows how seriously the courts have begun to take such leaks. Businesses need not only to implement protection, but also to respond promptly to incidents, otherwise they risk losing not only data, but also reputation.