QuickTake:

The claim, made by a former employee, alleges negligence in safeguarding data like Social Security numbers and also a delay in notifying those affected by the security breach.

A longtime Springfield construction company that reported a data breach affecting more than 2,000 people has been sued by a former employee in a complaint seeking class action status.

Scott Jenkins, on behalf of himself and others, alleges negligence by Hamilton Construction Co. and a failure by the company to promptly notify those who had private information accessed in the breach. 

The lawsuit, filed Thursday, Sept. 24, in Lane County Circuit Court, cites a breach of implied contract among its claims. 

Jenkins and others “were required to provide their Private Information to Defendant to obtain employment.” But in so doing, they “reasonably understood that Defendant would keep their Private Information secure and protect it from data breaches.”

The complaint filed by Jenkins requires certification by a judge before it becomes a class action lawsuit. Jenkins is represented by attorneys with Lake Oswego-based Olsen Barton LLC.

A legal expert described an increasing trend of workers citing concerns about identity theft and turning to the courts after having their data exposed in company data breaches.

Some “important court rulings” in recent cases in various federal and state courts have found “that employers owe a duty of care to protect personally identifiable information of employees and that employees have standing to sue in such cases,” David W. Opderbeck, a law professor and co-director of the Institute for Privacy Protection at Seton Hall University School of Law, said in an email.

Opderbeck is not involved with the lawsuit filed by Jenkins and was not commenting about the specifics of the pending case in Lane County. But, generally speaking, “there’s an increasing likelihood in many jurisdictions that a motion to dismiss the case by the employer will fail,” he said.

Hamilton Construction Co. notified Washington state authorities “on or around” Nov. 12, 2025, about an “egregious data breach,” the lawsuit alleges, with the company reporting unauthorized access to its network June 19, 2025, and that “certain files were accessed.”

The lawsuit alleges that data such as names, Social Security numbers, driver’s license numbers, financial information and full dates of birth were accessed.

According to the lawsuit, the company did not notify individuals about the data breach until notice letters were sent out Nov. 12, 2025, which the lawsuit points out was 146 days after the date of the data breach.

“As a result of Hamilton’s delayed notification, Plaintiff and Class Members had no idea that their Private Information had been compromised, and that they were, and continue to be, at significant risk of identity theft and various other forms of personal, social, and financial harm,” the lawsuit claims.

The company is alleged to have been negligent “because it failed to properly maintain and safeguard its computer systems and data.”

Hamilton Construction Co. did not report the data breach to the Oregon Department of Justice until Dec. 15, 2025, the lawsuit states.

Oregon maintains a database of data breaches, which lists the Hamilton Construction Co. data breach as affecting 2,667 people.

The company was founded in 1939, and the lawsuit alleges the company has an estimated annual revenue of $60 million.

In the notice letter sent by the company to individuals about the breach, Jenkins was provided an offer of 12 months of credit monitoring services, the lawsuit alleges. 

But the 12 months of monitoring “is not sufficient provided that [Jenkins] will now experience a lifetime of increased risk of identity theft and other forms of targeted fraudulent misuse of his Private Information,” the lawsuit states.

The lawsuit seeks unspecified damages and lifetime credit monitoring for all who become part of the class.