(A report from the Iowa Capital Dispatch) – A potential class-action lawsuit against an Iowa company that makes ignition interlock devices for people with drunken-driving convictions has been paused while the company completes an investigation into a cyberattack that triggered the litigation.
In March, attorneys for Derrick Curry of Worth, Illinois, and four other individuals filed separate federal lawsuits against Consumer Safety Technology, an Urbandale corporation that does business as Intoxalock, in U.S. District Court for the Southern District of Iowa. Earlier this week, Robert Million, a resident of Crystal, Minnesota, filed a similar lawsuit against the company.
Intoxalock manufactures devices that are designed to disable a vehicle’s ignition if the driver is unable to first pass a breathalyzer-style test showing they are not under the influence of alcohol. The devices are an integral part of court-ordered remedial programs that allow people convicted of drunken driving to continue driving in an electronically monitored fashion.
ntoxalock says it is the “leading ignition interlock device company in Iowa, with 177 (installation) locations across the state.”
The lawsuits allege Intoxalock failed to properly secure its information technology network and implement reasonable cybersecurity measures such as data encryption, multifactor authentication and updated software patches. The lawsuits assert those alleged failures allowed unauthorized third parties to hack the company’s system in March 2026 and disable the ignition interlock devices, leaving users stranded wherever their cars happened to be parked at that moment.
The proposed class members have suffered and will continue to suffer injuries including loss of property, use of their vehicles, and lost wages, the lawsuits allege.
Each lawsuit seeks class-action status so that one case can proceed on behalf of all the currently named plaintiffs as well as all others affected by the alleged product failure. In seeking court approval for class-action status, the plaintiffs’ attorneys have argued that while the exact number of Intoxalock users affected by the cyberattack remains unknown, it is “estimated to be in the tens of thousands.”
The initial five lawsuits, which have since been consolidated into a single case, were stayed by a federal judge on Thursday, which means there will likely be no further court proceedings in the matter until Feb. 1, 2027.
The stay was issued in response to a request by Intoxalock, which said it is still working on what it calls an “extensive incident response investigation” that’s designed to determine the full extent of the data breach and the number of customers affected.
