Westwood Country Club Data Breach — Class Action Review

Westwood Country Club operates as a premier private social and recreational institution, offering members exclusive access to championship golf courses, tennis facilities, fine dining, and private event hosting. To maintain these comprehensive member services, manage sprawling facilities, and process substantial financial transactions, the club routinely collects and maintains vast repositories of sensitive personally identifiable information (PII) and financial data. This includes not only active members and their families, but also prospective applicants, event guests, and a dedicated staff of hospitality and maintenance personnel. The institution holds a position of high trust within the community, making the secure handling of this sensitive personal information an essential operational and ethical responsibility.

In 2025, Westwood Country Club formally reported a significant security incident to the Indiana Attorney General, triggering widespread concern among affected individuals. While specific technical forensics continue to be evaluated, incidents affecting high-end membership organizations and hospitality entities typically involve sophisticated cyberattacks such as ransomware deployments, unauthorized intrusions into administrative databases, or compromises of third-party vendor management systems utilized for membership billing and reservations. These types of breaches often exploit vulnerabilities in legacy IT infrastructure or credential management, allowing malicious actors undetected access to internal networks where extensive member and employee records are stored.

The exposure resulting from the Westwood Country Club data breach encompasses a dangerous cocktail of sensitive information, including full names, dates of birth, Social Security numbers, banking or credit card details, billing addresses, and potentially detailed membership profiles. The compromise of Social Security numbers and financial account details exposes victims to severe, long-term risks of identity theft, fraudulent credit card applications, and unauthorized bank withdrawals. Furthermore, because country clubs often store familial data, dependent children and spouses may also be implicated, compounding the household risk and creating multi-layered financial and privacy vulnerabilities that can persist for years.

Under Indiana state law, as well as broader standards enforced by the Federal Trade Commission Act regarding unfair and deceptive trade practices, Westwood Country Club had an affirmative legal obligation to implement and maintain reasonable data security measures to protect the sensitive information entrusted to it. This duty requires utilizing modern encryption standards, robust firewall protections, multi-factor authentication, and regular vulnerability assessments. The occurrence of a widespread data breach strongly indicates a potential failure in these administrative and technical safeguards, raising serious legal questions regarding whether the institution adhered to industry-standard data protection protocols.

For individuals who have received a data breach notification letter from Westwood Country Club, this correspondence serves as formal legal acknowledgment that your private information was compromised due to corporate negligence. Legally, the receipt of this notice establishes the necessary standing to participate in a class action lawsuit aimed at holding the organization accountable. Affected members and employees do not need to wait until they experience actual financial fraud or out-of-pocket losses to take legal action. Our firm evaluates and investigates these data breach claims on a strict contingency fee basis, meaning there are never any upfront costs or out-of-pocket expenses for class members, and we only collect a fee if a successful recovery is secured on your behalf.