Three former employees of J.B. Hunt Transport have filed federal lawsuits accusing the Arkansas-based trucking giant of failing to protect their personal information after hackers allegedly broke into its computer systems and made off with sensitive employee and business records. The suits, filed as proposed class actions, claim the stolen data included names, birth dates, Social Security numbers, driver's license numbers, and financial information belonging to thousands of current and former workers.
The three suits were filed Oct. 27 in the U.S. District Court for the Western District of Arkansas, Fayetteville Division, and each seeks class-action status, according to The Arkansas Democrat-Gazette. The plaintiffs are Aaron Hunter of Ellenwood, Georgia, Wendy Parnell of Bentonville, and Shileen Lange of Richmond, Virginia, and all three are seeking jury trials. Court documents cited by the newspaper say a hacker group reported a breach at J.B. Hunt on Oct. 23, though court filings in Hunter's case note that the hackers' own figures have not been independently verified.
According to the newspaper's reporting, a threat actor calling itself Whitearmor claimed it infiltrated J.B. Hunt's computer system and accessed employee personal information along with business records, then demanded a $5 million ransom for the data. Hunter's lawsuit claims the hackers obtained roughly 1.7 million carrier contacts, 38.2 million invoices, 973 Microsoft 365 mailboxes, 187,000 access-permission records, 3,196 ranked account-takeover targets, and records tied to 374,000 organizations, along with 140,838 employee records containing personal information and national identification numbers.
Separate Cyber Trackers Flag a Ransomware Claim
Outside the courtroom, cybersecurity monitoring sites independently picked up on a Whitearmor claim targeting J.B. Hunt around the same period. QPulse by QuasarCyberTech reported that the claim was posted Oct. 26 at 00:00 UTC, with an estimated attack date of Oct. 25, and cautioned that the claim should be treated carefully until independently verified. QPulse noted that no specific technical details about the attack vector or the full extent of any compromise were provided.
A separate listing reviewed by Darkwiser described a seller offering the same categories of data, including 140,838 employee records with personal information and national IDs, 1.7 million carrier contacts, and 38.2 million invoices, while asking $5 million in Bitcoin or Monero. Darkwiser stressed that these were the seller's own claims, reported as advertised, and had not been confirmed. The Democrat-Gazette's reporting notes that other outlets, including Cyber News Live, DeXpose and Dark Web Intelligence, also reported on Whitearmor's claim that it breached J.B. Hunt's network.
What the Lawsuits Allege
Across the three suits, the plaintiffs allege negligence, implied breach of contract, unjust enrichment, invasion of privacy and breach of fiduciary duty. They contend J.B. Hunt had an obligation to safeguard employees' and customers' personal information, and argue that sensitive data should have been encrypted or redacted and better protected. The suits further allege that the breach was preventable, that J.B. Hunt's computer system was vulnerable, and that the company failed to follow security guidelines suggested by the Federal Trade Commission.
Hunter's suit also argues that J.B. Hunt did not promptly notify people affected by the breach. Lange's suit states that hackers targeted and obtained the private information because of its value in exploiting and stealing the identities of class members and to conduct financial crimes against them, adding that the risk to victims will persist. The plaintiffs broadly contend that outsider access to their data leaves them vulnerable to financial crimes for the rest of their lives.
Parnell and Lange are represented by the Sanford Law Firm, based in Little Rock, while Hunter is represented by Carney, Bates and Pulliam PLLC, also based in Little Rock. Separately, the law firm Migliaccio & Rathod LLP, which has offices in Washington, D.C. and San Francisco, announced Oct. 26 that it was investigating a possible J.B. Hunt data breach affecting an unknown number of people.
No Public Response From J.B. Hunt
As of 10 a.m. Thursday, J.B. Hunt had not published any news release addressing the alleged breach, the Democrat-Gazette reported. The newspaper said the company did not immediately respond to press account and media inquiry emails sent Wednesday evening and early Thursday. J.B. Hunt Transport Services operates intermodal, dedicated, refrigerated, truckload, less-than-truckload, flatbed, single source, last mile and transload operations.
The company celebrated its 65th year in business in August and recently reported third-quarter results that slightly exceeded analysts' estimates, including net income of $172.4 million, up 2% year over year, on quarterly revenue including fuel surcharges of $3.68 billion, a 20% increase from the prior year. Earnings per share came in at $1.82 for the quarter.
What Arkansas Law Requires
Under the Arkansas Personal Information Protection Act, businesses handling Arkansas residents' personal information must implement and maintain reasonable security procedures and practices appropriate to the nature of the information they hold. The law defines a security breach as the unauthorized acquisition of computerized data that compromises the security, confidentiality or integrity of personal information, and it requires disclosure when unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Violations of the act are subject to enforcement by the state attorney general.
