Class Action Claims Fiat Chrysler Failed to Prevent December 2025 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit claims that automaker FCA US LLC, which does business as Stellantis North America, failed to adequately protect the data it possessed, alleging that an unauthorized third party was able to access, hold for ransom and then publish customers’ sensitive personal information.

Want to stay in the loop on class action lawsuits that matter to you? Sign up for ClassAction.org’s free weekly newsletter.

The 29-page lawsuit claims that, on December 25, 2025, ransomware group Everest breached FCA US’s internal systems and extracted a terabyte of customers’ personal information—including names, Social Security numbers (SSNs), dates of birth and addresses, among other data. Per the suit, Everest held the information for a ransom and, after FCA allegedly refused to meet the group’s demands, published the highly sensitive data online on January 4, 2026.

The complaint argues that FCA US, which operates brands including Chrysler, Dodge, Jeep and Ram, should have known that the personal data it collected from customers was a valuable target for cybercriminals and therefore taken greater defensive measures, such as encrypting the data or deleting it when it is no longer needed, to protect customers’ information from such attacks as the alleged Everest breach.

The types of personal data that were stolen and published during the Chrysler data breach, according to the lawsuit, are frequently targeted, sold, bought and used in a variety of identity theft-related crimes. Per the filing, these crimes can include, but are not limited to:

• Credit card fraud, including taking out new cards or loans in the victim’s name;
• Obtaining a driver’s license or other government ID in the victim’s name with the thief’s picture;
• Obtaining government benefits or a job, renting a house or receiving medical services using the victim’s SSN and name;
• Filing a fraudulent tax return using the victim’s information;
• Bank and financial fraud, including opening a new bank account and writing bad checks or using a debit card number to withdraw funds from the victim’s account;
• Changing the victim’s billing address; and
• Using the victim’s information in the event of arrest or court action.

Oftentimes, the complaint argues, these instances of identity theft or related crimes are incredibly difficult to resolve, usually taking at least over a month and sometimes well over a year, and can have disastrous impacts on the victims’ lives. The theft of Social Security numbers is especially damaging, the lawsuit says, due to their highly sensitive nature and the fact that replacing them is difficult at best and impossible at worst.

The lawsuit argues that Chrysler, despite having such sensitive information in its care, failed to comply with or implement several established cybersecurity standards and practices that have been identified as the most effective ways to protect such valuable information. As such, per the suit, affected FCA customers are now at a substantially increased risk of identity theft.

The Chrysler class action lawsuit seeks to represent anyone in the United States whose personally identifiable information was accessed and disclosed to unauthorized parties as a result of the Chrysler data breach.

Check out ClassAction.org’s lawsuit list for the latest open class action lawsuits and investigations.