Bujok, Jones & Smart v. MC2 Data, LLC
Dismissed Feb 6, 2025 · no class certifiedS.D. Florida · Three class actions · Filed October 2024
- Defendant
MC2 Data, LLC
- Dockets
0:24-cv-61864 · 0:24-cv-61978 · 0:24-cv-62006
- Filed
Oct 7 · Oct 22 · Oct 25, 2024
- Records exposed
106,316,633 + 2.3M subscribers
- Database size
2.2 TB · passwordless
On August 7, 2024, Cybernews researchers found a passwordless 2.2TB database tied to MC2 Data open to the internet (106,316,633 records on US citizens plus data on roughly 2.3 million subscribers), attributed to human error rather than a hack. The exposed data included names, home addresses, dates of birth, phone numbers, property and legal records, family data, and employment history; SpyCloud's analysis adds that the public-records entries included Social Security numbers and criminal history. Have I Been Pwned indexed the subscriber side in December 2024 as 2.1 million accounts. Three class actions followed in the Southern District of Florida that October. The dockets are confirmed via CourtListener's case search. The court consolidated them as Bujok v. MC2 Data, LLC that November and dismissed the case on February 6, 2025 after a settlement notice, with prejudice for the named plaintiffs, without prejudice for the putative class, and with no class certified.




























