Samsung Data Breach Exposed Private Info of Thousands of Customers, Class Action Alleges

New to ClassAction.org? Read our Newswire Disclaimer

Samsung Electronics America, Inc. faces a proposed class action over a data breach during which the personally identifiable information of thousands of consumers was reportedly accessed without authorization.

The 17-page lawsuit says that Samsung’s failure to properly secure consumers’ data and implement even “rudimentary security practices” allowed cybercriminals to access files on the company’s network during an incident discovered in August 2022.

According to the case, the information compromised in the breach included consumers’ names, contact and demographic information, dates of birth and product registration information.

The lawsuit says Samsung data breach victims face “a very high risk of misuse of their Private Information” as a result of the breach, and must now take steps to protect themselves from identity theft and fraud.

According to another lawsuit filed against Samsung on September 10, thousands of customers provided their personal information to the company when they signed up for a Samsung account, which the complaint notes is often required in order to access certain product features, warranty-related registration, the Samsung Galaxy store or software updates.

The second lawsuit contends that consumers “relied to their detriment” on Samsung’s promises and representations that their data would be kept safe. Per the suit, Samsung continued to assure customers that it had adequate cybersecurity procedures in place even after experiencing a data breach earlier this year when an organization known as Lapsus$ accessed and published 190 gigabytes of the company’s confidential data online.

The lawsuit says Samsung “minimized entirely” the impact of the Lapsus$ data breach, which the company confirmed in April, and failed to beef up its security to prevent another breach of its system in July.

“Despite this earlier breach and full knowledge of the exposed sensitive technical data and the immediate need to protect customers’ private information and data from Lapsus$ and other attackers, Defendant utterly failed to adequately secure its systems, and allowed another breach to occur, this time compromising consumer [personally identifiable information],” the September 10 complaint states.

The instant lawsuit, filed on September 6, says that although Samsung learned of the data breach in early August, the company waited until September 2, 2022 to notify consumers whose information was compromised. The data breach notice was not only untimely, the case contests, but “woefully deficient” in that it failed to disclose “basic details” about the incident, including how the authorized parties accessed Samsung’s network, whether the information was encrypted or otherwise protected, how Samsung learned of the breach, whether it was system-wide and how many people were affected.

According to the September 10 suit, it is believed that more than half of Samsung’s U.S. customers may have been affected by the data breach.

The instant lawsuit claims Samsung has failed to offer data breach victims monetary compensation for the damages they’ve suffered “or even assistance with identity protection services.”

Per the case, consumers would not have purchased goods and services from Samsung had the company disclosed that it did not have industry-standard cybersecurity measures in place.

The suit looks to represent anyone whose sensitive personal information—including name, contact and demographic information, date of birth and product registration details—was obtained by an unauthorized individual or individuals from Samsung during the data breach.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.