.svg)
US fintech giant is facing a class action lawsuit after a former employee of the firm siphoned off data about millions of customers.
US fintech giant Block has had a tumultuous week. After being sued by Rohit Chopra’s consumer protection watchdog for delaying the agency’s investigation into Block’s Cash App, the company is yet again at the centre of a lawsuit.
This time, the $44bn company is accused of negligence and failure to safeguard the information of millions of consumers.
The accusations relate to the theft of data last December, when a former employee downloaded reports from Cash App Investing, a stock trading platform available on Block’s popular mobile app.
The reports included full name and brokerage account numbers, and for some customers also included other brokerage data and stock trading activity for one trading day. The reports did not include passwords, social security numbers, payment card or bank account information, or any other personally identifiable information, the company said.
Although that employee had regular access to these reports as part of their past job, in December the staff member accessed the reports without permission after their employment ended.
Block first revealed the incident in an April securities filing and said it affected 8.2m current and past customers.
The complaint accuses Block of failing to “exercise reasonable care in securing and safeguarding consumer information”.
The plaintiffs, a Texas and an Illinois resident, allege that hackers can now gain access to Cash App Investing users’ portfolios and account funds and use those funds to commit a wide range of fraudulent activities against the users, as was done against them.
For instance, one plaintiff says that following the theft she spotted a number of unauthorised charges on her Cash App account, totaling more than $50 that has never been reimbursed to her, and she found false information on her Experian credit report.
Meanwhile, the other plaintiff claims he noticed numerous unsuccessful attempts to withdraw money from his account until finally criminals could transfer $394 from his Cash App account.
The complaint argues that criminals can use the stolen information to commit further crimes, including identity theft and financial fraud. These types of fraud cause victims on average $1,100 in direct losses, according to Javelin Strategy & Research.
Plaintiffs seek to represent all the US persons whose private information was compromised because of the data breach and ask the court to order the fintech giant to pay “actual” and “punitive” damages.
