Ally Bank Hit with Class Action Over April 2021 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Ally Bank and Ally Financial Inc. face a proposed class action lawsuit over an April 2021 data breach in which customers’ usernames and passwords were exposed to the bank’s third-party business associates.

The 26-page lawsuit alleges Ally, one of the country’s largest branchless, online-only banks, failed to adequately safeguard customers’ personally identifiable information despite promising to do so and then waited an unacceptable two months to notify those whose data was exposed in the breach.

According to the case, the incident was not the result of a cyberattack but was “entirely Ally’s own doing,” and stemmed from a website programming error that exposed customers’ unencrypted login credentials to Ally’s business partners. From there, it was possible to access customers’ full names; email addresses; account numbers, balances and statements; check images; beneficiary names and birth dates; employment information; linked bank account details; tax forms; and Zelle account history and information, according to the complaint.

The suit claims that Ally has failed to provide customers with adequate information concerning the breach, including who received their login information, what Ally’s partners are doing to secure the data, how long the programming code error was active on Ally’s website, and how Ally will verify that the information was deleted. Moreover, the case says that Ally has failed to explain why it took two months to notify customers about the breach.

Per the suit, the defendants had a statutory obligation under California law to protect customers’ personally identifiable information yet failed to adequately monitor their website and issue timely notification that certain sensitive data had been exposed. The lawsuit contests that the bank’s negligence is “particularly egregious” given its repeated warnings to customers about how to protect their own information and its knowledge of the consequences of data breaches.

The suit argues that although Ally has offered those affected by the breach 24 months of credit monitoring by Equifax, the service will not fully protect them from identity theft and is insufficient in duration in light of the type of information that was exposed.

The lawsuit looks to represent California citizens whose personally identifiable information was compromised in the data breach announced by Ally Bank around June 11, 2021.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.