Burton Snowboards Hit with Class Action Over 2023 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Burton Snowboards faces a proposed class action after the company was targeted by cybercriminals during a 2023 data breach.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 49-page case relays that between February 11 and March 9 of this year, an unauthorized actor infiltrated Burton’s computer systems and accessed personal information belonging to over 5,000 people, including names, Social Security numbers, driver’s license or state-issued identification numbers, passport numbers and financial account information.

The complaint contends that the incident has affected current, former and prospective employees of Burton, as well as current, former and prospective employees of The Chill Foundation, a Vermont nonprofit corporation owned by the snowboard company.

According to the lawsuit, the cyberattack stemmed from Burton’s failure to employ reasonable cybersecurity measures to adequately secure the sensitive information stored in its network.

Contrary to the defendant’s privacy policies, which explicitly state that it has “implemented commercially reasonable precautions to protect the information we collect … in accordance with industry practice and applicable laws,” Burton had “no effective means” to detect and prevent attempted data breaches, the case alleges.

The complaint stresses that data breach victims must now deal with a substantially increased risk of identity theft and fraud, especially in light of the “strong probability that entire batches of stolen information have been dumped on the black market.” As a result of Burton’s negligence, affected individuals must vigilantly monitor their accounts for years to come, the case contends.

The lawsuit says that Burton, which manufactures snowboards and other recreational equipment, accessories and apparel, posted a now-deleted online notice on February 14 stating that a “cyber incident” had impacted some of its operations, and that it was able to process orders.

Then, on March 27, the company began sending affected individuals direct notice of the data breach, the case says. Per the suit, the letter attempted to minimize the harm caused by the incident and omitted details about how the cyberattack occurred, how long class members’ data was accessible to unauthorized parties and how many individuals were impacted. 

Although Burton’s March 27 report to the Maine Attorney General stated that only 737 people had been affected by the data breach, a supplemental report filed on May 26 revealed that 5,282 individuals had been involved, the filing relays.

It wasn’t until late May that Burton sent out additional notices informing most data breach victims that their information had been exposed, the complaint says.

“Defendant materially breached the contracts it had entered with Plaintiffs and Class Members by failing to safeguard such information and failing to notify them promptly of [the] Data Breach that compromised such information,” the suit reads.

The lawsuit looks to represent anyone whose personally identifiable information was compromised as a result of the data breach announced by the Burton Corporation beginning on February 11, 2023.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.