Bujok, Jones & Smart v. MC2 Data, LLC
Dismissed Feb 6, 2025 · no class certifiedS.D. Florida · Three class actions · Filed October 2024
- Defendant
MC2 Data, LLC
- Dockets
0:24-cv-61864 · 0:24-cv-61978 · 0:24-cv-62006
- Filed
Oct 7 · Oct 22 · Oct 25, 2024
- Records exposed
106,316,633 + 2.3M subscribers
- Database size
2.2 TB · passwordless
On August 7, 2024, Cybernews researchers found MC2 Data had left a passwordless 2.2TB database open to the internet - 106,316,633 records on US citizens plus data on roughly 2.3 million subscribers, attributed to human error rather than a hack. The exposed data included names, home addresses, dates of birth, phone numbers, property and legal records, family data, and employment history; SpyCloud's analysis adds that the public-records entries were partially sourced through data provider Enformion and included Social Security numbers and criminal history. Have I Been Pwned indexed the subscriber side in December 2024 as 2.1 million accounts. Three class actions followed in the Southern District of Florida that October - the dockets are confirmed via CourtListener's case search. The court consolidated them as Bujok v. MC2 Data, LLC that November and dismissed the case on February 6, 2025 after a settlement notice - with prejudice for the named plaintiffs, without prejudice for the putative class, and with no class certified.




























