Court lets victims sue IT vendors
A Massachusetts court ruled that companies hit by ransomware can sue negligent IT vendors, treating data loss as property damage — a decision that could shift liability expectations for school districts and their contractors. The precedent raises procurement stakes and may push districts to demand clearer security SLAs and vendor accountability. (masslawyersweekly.com)
The case is Calvary Design Team, Inc. v. Wasabi Technologies, LLC and Winslow Technology Group, LLC, Suffolk Superior Court Civil Action No. 2584CV00908-BLS-1. (masslawyersweekly.com)) Calvary’s complaint alleges a September 6, 2023 ransomware incident that resulted in deletion of its cloud backups and a $4 million ransom payment to recover data. (masslawyersweekly.com)) Court filings identify the malware as LockBit 3.0 and allege the threat actor gained access via a VMware ESXi hypervisor Winslow configured for Calvary. (universalhub.com)) The complaint and the court’s recounting state the attacker submitted credential-change requests at 2:38 a.m. and 2:51 a.m., used the new credentials to change the Wasabi account email, and then requested deletion of all Calvary data on Wasabi’s platform. (universalhub.com)) Suffolk Superior Court Judge Christopher Barry‑Smith ruled that Calvary’s loss of electronic data can be characterized as property damage and denied defendants’ motions to dismiss in part while granting Calvary leave to amend its complaint. (universalhub.com)) Records show Calvary hired Winslow in 2022 and purchased Wasabi-backed cloud storage and backup coverage marketed to protect data for a five‑year term through 2028. (masslawyersweekly.com)) Calvary’s April 2, 2025 complaint asserts causes of action including negligence, fraudulent and negligent misrepresentation, breach of contract, tortious interference, and violations of G.L. c. 93A. (masslawyersweekly.com))
