CTH Rentals Facing Class Action Over Data Breach Affecting 140K Customers

New to ClassAction.org? Read our Newswire Disclaimer

CTH Rentals, LLC faces a proposed class action over a data breach that reportedly exposed the personal information of more than 140,000 of the storage barn provider’s customers.

The 31-page case alleges CTH Rentals failed to implement reasonable security measures to protect customers’ data from unauthorized access. According to the suit, the hacker(s) had access to customers’ full names, addresses and Social Security numbers between August 11 and September 10, 2021.

The case alleges that the breach was a direct result of CTH’s failure to properly store and encrypt customer data in line with industry standards and its own obligation to safeguard the information.

“By obtaining, collecting, using, and deriving a benefit from the [personally identifiable information] of Plaintiff and Class Members, Defendant assumed legal and equitable duties to those individuals to protect and safeguard that information from unauthorized access and intrusion,” the complaint contests. “Defendant’s conduct in breaching these duties amounts to negligence and/or recklessness and violates federal and state statutes.”

Per the complaint, CTH provides rent-to-own portable storage barns through several affiliates, including Southern Lease Management Group, LLC; Carolina Lease Management Group, LLC; and Sunrise Rentals, LLC. The case states that the defendant collects customers’ personally identifiable information—such as names, addresses and Social Security numbers—in the course of its business and stores the data “in a vulnerable central location.”

According to the filing, CTH discovered in September 2021 that unauthorized individuals had accessed its network and installed malware that encrypted “a number of network drives and backups.” The case says the nefarious actors maintained access to the defendant’s systems, which housed the personal information of 140,330 individuals, for a roughly one-month period beginning on August 11.

The lawsuit alleges that CTH failed to properly encrypt customers’ information and implement reasonable data security measures recommended by the U.S. government, U.S. Cybersecurity & Infrastructure Security Agency and Microsoft Threat Protection Intelligence Team, as well as follow guidelines recommended by the Federal Trade Commission.

Although CTH disclosed in a January 2022 letter to data breach victims that it had begun taking steps to prevent a similar situation from happening by resetting passwords, implementing an end-point monitoring system and upgrading its virus and malware protections, these measures “should have been taken before the Data Breach,” the case argues.

The lawsuit goes on to argue that the relief offered by CTH to data breach victims—namely 12 to 24 months of identity monitoring services—is “woefully inadequate” given customers may face several years of ongoing identity theft and fraud.

The case looks to cover anyone identified by CTH as among those who were impacted by the data breach, including customers who were sent notice of the breach.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.