Paxton Media that owns a number of media outlets, including WPSD in Paducah, Kentucky is facing a federal lawsuit over a massive date breach.

The lawsuit claims that the company had a cyber attack and massive data breach earlier this year, yet waited three or more months to tell more than 20,000 current and former employees that their private information was hacked — many of whom reside in west Kentucky.

Jason Riley, a criminal justice Reporter for WDRB in Louisville, first broke the news of the lawsuit.

According to some details in the lawsuit, the cyberattack occurred between February 26 and March 20 of this year, in which an “unauthorized third-party” of cybercriminals gained specific access to data of current and former employees, including Social Security numbers, financial account and routing number information, as well as credit card numbers and other assorted data.

On June 24, or thereabouts, officials within Paxton Media Group began sending out Notices of Data Privacy Event to current and former employees whose information was accessed. However, some plaintiffs still haven’t been notified.

According to Riley, the lawsuit also claims that “some of the private information was sold on the “dark web” — an underground overlay of networks that use the Internet, but requires specific software and authorization, and often lends itself to unscrupulous and unsavory transactions.

H/T WKDZ