The lawsuit was filed Tuesday on behalf of Zachary Clark, who graduated in 2014, in U.S. District Court in Hammond.
The university had no comment on the suit, a spokesperson said in an email.
The university announced on its website on Sept. 19 that it had been subject to a data breach that occurred in August. According to that announcement, the university “experienced unusual activity” on its network, leading to an investigation by a third party.
“On August 11, 2025, our investigation determined that certain files and folders were copied and/or downloaded by an unknown third party between August 7, 2025, and August 8, 2025,” the university said in the announcement.
The breach included Social Security numbers, driver’s license or state identification numbers and/or financial account information, according to the statement. The university said it is working “to determine the full nature and scope of the information at risk.”
In light of the breach, university officials “took steps to ensure the security of our computer systems, notify law enforcement, and are providing notification to the potentially impacted individuals,” the statement said.
The university is also taking steps to “further enhance” cybersecurity, and encouraged anyone impacted by the breach to get a single free credit report and monitor their accounts, according to the university’s statement.
The lawsuit alleges the university didn’t do enough to prevent the data breach or notify impacted parties about what happened.
The lawsuit said the university failed to safeguard the personal data of “thousands of its current, former, and prospective students … and employees, as well as others whose personal information was stored on Valpo’s systems.”
“Plaintiff and Members of the Class have suffered significant injury and damages due to the Data Breach permitted to occur by Valpo, and the resulting monetary damages including out-of-pocket expenses, including those associated with the reasonable mitigation measures they were forced to employ, and other damages,” the lawsuit notes.
“Plaintiff and the Class also now forever face an amplified risk of further misuse, fraud, and identity theft due to their sensitive Personal Information falling into the hands of cybercriminals as a result of the tortious conduct of Defendant.”
Compounding the harm, the lawsuit states, the university waited one month to publicly disclose the breach.
“Defendant owed to Plaintiff and Members of the Class a duty to notify them within a reasonable time frame of any breach to the security of their Personal Information. Defendant also owed a duty to timely and accurately disclose to Plaintiff and Members of the Class the scope, nature, and occurrence of the Data Breach,” the lawsuit states.
The lawsuit requests a jury trial.
©2025 Post-Tribune (Merrillville, Ind.). Distributed by Tribune Content Agency, LLC.
