A Glastonbury-based law firm that recently disclosed a data breach is now facing a class-action lawsuit brought by a former Waterbury firefighter and former client of the firm.
Brown Paindiris & Scott LLP notified individuals whose personal information was potentially compromised on April 11, 2024, following an investigation by cybersecurity professionals, according to a notice on the firm’s website.
The breach was the result of a cyber attack, which occurred between Nov. 7, 2023 and Nov. 9, 2023, the notice states.
Nearly a year later, in February 2025, Brown Paindiris & Scott’s cybersecurity team determined that additional individuals’ information may have been exposed in the breach, including Social Security numbers, dates of birth, driver’s license numbers, financial accounts, credit cards, medical Information and health insurance.
The firm notified the additional individuals on March 14, 2025.
One of those individuals was Thomas Eccleston, a former Waterbury firefighter who sued the city of Waterbury and former Mayor Neil M. O’Leary after he was fired in 2018 for testing positive for cannabis.
Eccleston was represented by a Brown, Paindiris & Scott partner, Bruce Newman, in his lawsuit against the city of Waterbury, which he lost.
Now, Eccleston finds himself as the lead plaintiff in a proposed class-action suit against Brown, Paindiris & Scott.
The complaint blames the firm’s “inadequate security practices” and failure to “follow industry standard practices in securing its current and former clients’ sensitive information” for the cyberattack.
Also, the suit claims the firm waited 464 days after the breach occurred to notify people like Eccleston.
“The defendant kept the class in the dark — thereby depriving the class of the opportunity to try and mitigate their injuries in a timely manner,” the suit states.
Reached for comment by the Hartford Business Journal, a Brown Paindiris & Scott spokesperson said the firm disputes that it waited an unreasonable amount of time to notify clients.
“After the November 2023 breach, Brown Paindiris & Scott LLP immediately notified the FBI, remediated the issue, and engaged cybersecurity professionals, inclusive of a cyber fraud forensic team,” the spokesperson said. “The cyber team determined that certain individual client information had been compromised. An initial data breach notice went out directly to those clients as soon as possible after gathering address and contact information.”
After further investigation, the team determined that the intruders may have viewed additional files on the firm’s servers.
“Immediately upon learning that the bad actors may have viewed additional files, Brown Paindiris & Scott LLP sent the supplemental data breach notice, with identity protection and defense, out of an abundance of caution after gathering all address and contact information,” according to the spokesperson.
Eccleston’s lawsuit was filed Monday in U.S. District Court in New Haven, on behalf of himself and other members of the proposed class, which includes all individuals residing in the United States whose information was compromised in the attack.
The suit claims negligence, breach of implied contract, unjust enrichment, invasion of privacy and breach of fiduciary duty.
Eccleston is represented by Shannon L. Hopkins of Levi & Korinsky LLP in Stamford, along with Raina C. Borrelli, of Chicago-based Strauss Borrelli, who has been admitted pro hac vice. Borrelli specializes in complex class-action matters and claims, including data breach.
Brown, Paindiris & Scott says it has taken precautions to safeguard the privacy of personal information in its possession and “continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information, including updating passwords and enhancing email access protocols.”
“For almost 50 years Brown Paindiris & Scott LLP has worked tirelessly to help its clients and any insinuation or allegation that it acted maliciously involving this breach is simply untrue,” the spokesperson said.
Brown Paindiris & Scott is a full-service firm with offices in Glastonbury, Hartford, Essex and New Hartford.
