Litigation grows against Iowa maker of ignition locks, but is paused by the court

A potential class-action lawsuit against an Iowa company that makes ignition interlock devices for people with drunken-driving convictions has been paused while the company completes an investigation into a cyberattack that triggered the litigation.

In March, attorneys for Derrick Curry of Worth, Illinois, and four other individuals filed separate federal lawsuits against Consumer Safety Technology, an Urbandale corporation that does business as Intoxalock, in U.S. District Court for the Southern District of Iowa. Earlier this week, Robert Million, a resident of Crystal, Minnesota, filed a similar lawsuit against the company.

Intoxalock manufactures devices that are designed to disable a vehicle’s ignition if the driver is unable to first pass a breathalyzer-style test showing they are not under the influence of alcohol. The devices are an integral part of court-ordered remedial programs that allow people convicted of drunken driving to continue driving in an electronically monitored fashion.

Intoxalock says it is the “leading ignition interlock device company in Iowa, with 177 (installation) locations across the state.”

The lawsuits allege Intoxalock failed to properly secure its information technology network and implement reasonable cybersecurity measures such as data encryption, multifactor authentication and updated software patches. The lawsuits assert those alleged failures allowed unauthorized third parties to hack the company’s system in March 2026 and disable the ignition interlock devices, leaving users stranded wherever their cars happened to be parked at that moment.

The proposed class members have suffered and will continue to suffer injuries including loss of property, use of their vehicles, and lost wages, the lawsuits allege.

Each lawsuit seeks class-action status so that one case can proceed on behalf of all the currently named plaintiffs as well as all others affected by the alleged product failure. In seeking court approval for class-action status, the plaintiffs’ attorneys have argued that while the exact number of Intoxalock users affected by the cyberattack remains unknown, it is “estimated to be in the tens of thousands.”

Court proceedings paused for six months

The initial five lawsuits, which have since been consolidated into a single case, were stayed by a federal judge on Thursday, which means there will likely be no further court proceedings in the matter until Feb. 1, 2027.

The stay was issued in response to a request by Intoxalock, which said it is still working on what it calls an “extensive incident response investigation” that’s designed to determine the full extent of the data breach and the number of customers affected.

In seeking the stay, Intoxalock — which has yet to file a formal answer to the plaintiffs’ allegations of negligence, unjust enrichment and breach of contract — also informed the court it “is open to engaging the plaintiffs and their counsel in early class-action settlement discussions, however, any potential settlement discussions are stymied by the fact that Intoxalock’s incident response investigation is ongoing. Without knowing the impacted class size or impacted data elements, the parties cannot participate in informed settlement discussions.”

Sometime around March 14, 2026, the lawsuits allege, cybercriminals attacked Intoxalock’s systems, disabled its critical network infrastructure and successfully stole information maintained by the company. Aside from the alleged data theft, “countless users were unable to use their vehicles for over a week, as the outage disabled countless Intoxalocks across the United States,” the initial lawsuits allege.

As part of his claim against the company, Curry alleges that as he was driving his vehicle home, the car “suddenly and dangerously shut off while he was driving down a city street.” As a result, the lawsuit states, Curry was forced to have his vehicle towed at a cost of more than $700.

The next day, the lawsuit alleges, Curry’s Intoxalock device remained nonfunctional, rendering his car useless and causing him to miss a day of work. The day after that, with the device still not working, Curry was allegedly fired from his job. He eventually paid $300 to have his car towed to the shop that originally installed the Intoxalock so the device could be removed, the lawsuit alleges.

At roughly the same time, Curry alleges, he began receiving “an alarming number of spam emails and spam calls,” along with notification that someone had applied for a loan using his credentials.

The Curry lawsuit, now consolidated with the cases brought on behalf of Oliver James Strahl, Bradley Praznik, Jermaine Peals and James Pratt, seeks unspecified damages for failure to reasonably safeguard users’ data, failure to maintain the continued operation of critical cloud infrastructure and systems, and failure to reasonably provide timely notification to users that their information had been compromised.

The plaintiffs in the Intoxalock lawsuits are represented by J. Barton Goplerud and Brian O. Marty of Shindler, Anderson, Goplerud & Weese in West Des Moines.