Easy Cash ASAP Exposed Applicants’ Private Financial Data to ‘the Entire Internet,’ Class Action Claims

New to ClassAction.org? Read our Newswire Disclaimer

A Utah consumer has filed a proposed class action against ACQ Holdings, LLC and Easy Cash ASAP, LLC over what he alleges is the lenders’ “almost incomprehensibly sloppy treatment of confidential financial information.”

The defendants, who operate an internet lending business, have allegedly exposed to the public the personal and financial information of roughly 120,000 loan applicants due to security vulnerabilities on their website, which the suit describes as having “no protection against private data theft.”

“Defendants’ acts expose the confidential financial information of plaintiff and the Class and Subclass to the entire internet, without any safeguard or protection, and for no reason, without justification or permission,” the complaint scathes.

According to the 20-page suit out of Utah, when an applicant looking to apply for a loan on easycashasap.com hits the “apply” button on the site’s landing page, they’re directed to a second page that requests personal data, including their name, Social Security number, income, employer, and bank information. In the fine print on the page, the applicant is told that by using the site, they’ve agreed to “the terms of use and privacy notice,” located elsewhere on the site, the lawsuit says.

After beginning the application process, a prospective borrower is then assigned an account number, which, according to the case, is “nothing more than a sequential system for each application from any applicant.” If an applicant clicks to review their application, the account number is listed in a public URL “that immediately populates,” the suit says.

Per the complaint, simply changing the account number in the URL could allow an unauthorized user to access another consumer’s application and private financial information.

“Anyone can type random seven-digits into this public URL feature,” the suit relays, “and – if it happens that those seven digits are assigned as an account number to a loan applicant – then the person entering the random digits has access to the loan applicant’s name; date of birth; address; Social Security number; home phone number; cell phone number; email address; employer name and phone number; next pay date and pay frequency; monthly income; bank name; bank account type; bank routing number; bank account number; and military status.”

The lawsuit argues that consumers’ private financial information could be “easily used” by unauthorized parties to commit bank, credit and/or identity fraud “and worse,” adding that once the information has been input into Easy Cash ASAP’s website, “there is no way to remedy the problem.”

The plaintiff says that after realizing his information was vulnerable to data theft, he “tried, but was unable” to remove his private financial details from the defendants’ website.

Per the case, a review of the defendants’ database reveals that upward of 120,000 people have supplied information to the lender through the loan application process and now face a heightened risk of identity theft and fraud. 

“Every one of those persons’ private financial information is now exposed on the internet due to the failures of the ACQ website,” the case states.

According to the plaintiff, “a simple security review” of the defendants’ website design would have revealed the glaring security flaw.

The lawsuit looks to cover anyone who, within the past six years, supplied their personal financial information to ACQ through its website as part of their loan application, with a proposed class of Utah residents who did so.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.