Employees file for class-action suit over Sibanye Stillwater data breach

A group of current and former Sibanye Stillwater Mining employees are seeking a class-action lawsuit against the company over a data breach this summer that affected more than 7,000 employees.

Billings attorney John Heenan, who is representing the workers, claimed in the lawsuit that the company failed to protect employees' personally identifiable information, which included names, contact information, passport numbers, Social Security numbers, tax ID numbers, birth certificates, financial information and medical information.

According to the complaint, which was filed Sept. 20 in Yellowstone County District Court, the South Africa-based Sibanye Stillwater was struck by the ransomware attack in mid-June 2024, but the breach wasn't discovered until July 8.

The company confirmed the data breach on Aug. 19, according to a letter filed with regulators.

The exposure of employees' personal data leaves them vulnerable to identity theft or fraud, particularly if the data is sold illegally on the dark web, Heenan argued in the
suit.

The complaint names three plaintiffs: former employee Shawn Crane of Gallatin County, employee Daniel Vogl of Stillwater County and employee Skylar Marchand of Yellowstone County. If a judge agrees to a class-action suit, the company could be responsible for damages suffered by the more than 7,000 workers affected by the breach.

The lawsuit comes at a difficult time for Sibanye Stillwater, which announced last month it's planning to lay off 700 Montana workers this fall. The company blamed the plummeting price of palladium, which is Stillwater's primary output, as the reasons for the cutback.

Sibanye Stillwater operates two mines in Montana at Nye and near Big Timber. The company also operates a smelter in Columbus.