Ethos Technologies Hit with Class Action Over Months-Long Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Ethos Technologies, Inc. faces a proposed class action lawsuit over a “widespread” data breach that reportedly exposed customers’ names and Social Security numbers.

The 43-page lawsuit claims the life insurance provider failed to implement adequate data security practices and policies and essentially left customers’ sensitive information “in a condition vulnerable to cyberattacks.”

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

Per the case, Ethos announced in late December 2022 that “malicious actors” had gained access to its network through the company’s third-party integrated service provider, Guidewire, and extracted customers’ full names and Social Security numbers in a data breach spanning August 4 through December 9, 2022.

As explained in the defendant’s December 21 data breach notice, the unauthorized actors used customer information obtained from other sources, particularly their names, dates of birth and addresses, and entered it into Ethos’ online insurance application. Per the suit, Guidewire’s integrated service then returned each customer’s Social Security number in the page’s source code, from which the hackers “used specialized tools” to extract the sensitive data.

The lawsuit alleges that although the improper disclosure of customers’ sensitive information was “a known risk” to Ethos, the company failed to take reasonable steps to protect the data and left it “in a dangerous condition” in an unencrypted, internet-accessible environment. Moreover, Ethos allegedly failed to properly monitor its computer network, IT systems and integrated service to timely detect any unauthorized access.

Per the case, the defendant’s notice to data breach victims was “unreasonably delayed,” coming almost five months after the breach initially began and nearly two weeks after Ethos concluded its investigation.

The lawsuit alleges that Ethos’ “negligent” conduct has put data breach victims at an increased risk of identity theft and fraud given their personally identifiable information “is now in the hands of malicious cybercriminals.”

Indeed, the plaintiff, a Florida resident, says she has already experienced over $7,000 of fraudulent credit card charges and several attempts by identity thieves to open new credit cards under her name.

“[The plaintiff] has taken significant efforts to remedy her credit file as a result of the Data Breach,” the lawsuit states.

The case looks to represent anyone identified by Ethos or its agents or affiliates as being among the individuals who were impacted by the data breach, including those who were sent a notice.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.