Drizly Hit with Class Action Over Data Breach Reportedly Affecting 2.5M Customers [UPDATE]

New to ClassAction.org? Read our Newswire Disclaimer

Online alcohol delivery service Drizly, LLC failed to detect a data breach for five months while customers’ private information was stolen, according to a proposed class action lawsuit.

Filed against Drizly, LLC and The Drizly Group, Inc., the 40-page lawsuit alleges insufficient data security measures were to blame for the breach, which the case notes may have occurred as early as February 2020.

Although Drizly, which claims to operate the world’s largest alcohol marketplace, says its customers “trust us to be part of their lives,” the company notified proposed class members in a July 2020 email that it had “recently identified some suspicious activity involving customer data” and determined through an internal investigation that “an unauthorized party appears to have obtained some of our customers’ personal information,” the suit says.

“Despite Drizly’s claims of ‘trust,’ Drizly’s deficient data security measures left its customers’ sensitive customer data vulnerable to hackers who pilfered this information and placed it for sale on the dark web on February 13, 2020, to which it appears Drizly was oblivious,” the complaint scathes.

According to the case, TechCrunch reported on July 28 that the breach was far more extensive than Drizly disclosed in its email, noting that as many as 2.5 million accounts are believed to have been compromised. Though Drizly claimed the compromised information was limited to customers’ email addresses, dates of birth, passwords, and delivery addresses, TechCrunch reportedly found after obtaining a portion of the data that customers’ phone numbers, IP addresses, and geolocation details associated with their billing addresses were also exposed to unauthorized parties.

“TechCrunch’s findings confirm that not only did Drizly allow a data breach to occur, but Drizly has failed to discover, and disclose, the full scope and extent of the Data Breach,” the complaint reads.

Although Drizly assured users that no financial information had been compromised in the breach, a screenshot captured by TechCrunch “blatantly shows the exact opposite,” the suit continues. According to the article cited in the complaint, TechCrunch discovered a February 13, 2020 post on the Dark Web in which a “well-known seller of stolen credit data” offered for sale “Fresh Hacked drizly.com Account [sic] with Valid CC attached and Order History” at a price of $14.

The post indicates hackers successfully exfiltrated customers’ credit card numbers as early as February, which exposed Drizly users to a “significant and imminent risk of future harm of identity theft and fraud,” the lawsuit asserts.

The case further claims Drizly not only failed to prevent the breach but failed to timely detect and report that customers’ information had been stolen, leaving them unable to take steps to mitigate the harm caused as a result of their data being compromised.

“Drizly failed to properly safeguard Plaintiff’s and Class members’ information or timely notify them that sensitive customer data was stolen, allowing cybercriminals to access its users’ sensitive customer data since at least February 13, 2020, when the ‘Fresh Hacked’ dump of sensitive customer data was posted on the dark web,” the complaint reads, averring that the incident would have discovered the breach “much sooner” had Drizly properly monitored its systems.

The lawsuit says Drizly has refused to provide any monitoring services or identity theft and fraud insurance, opting instead to urge customers to reset their passwords and “continue monitoring your account for any unusual activity.” The case claims the risk of identity and fraud faced by Drizly customers “will persist for years,” requiring that those affected “vigilantly monitor their financial accounts ad infinitum.”

The lawsuit looks to represent anyone in the U.S. whose sensitive customer data was compromised in the data breach made public by Drizly on July 28, 2020.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.