M&T Bank Facing Class Action Over Data Breach Announced in August 2023

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims M&T Bank Corporation’s failure to safeguard consumers’ personal information resulted in a data breach announced by the New York-based bank in August 2023.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 30-page case says the names, addresses and account numbers of at least 95,000 M&T Bank customers are believed to have been compromised in the cyberattack that targeted MOVEit, a file transfer platform the bank uses to send and receive sensitive data. According to the complaint, hackers exploited a vulnerability in the platform’s software earlier this year and demanded ransom for the exfiltrated data.

Per the filing, M&T Bank was obligated under state and federal law to protect consumers’ data from unauthorized access by following appropriate cybersecurity protocols. However, the complaint contends, the defendant “willfully” and “recklessly” failed to properly secure and encrypt the sensitive information stored on its network.

The suit argues that affected individuals now have to deal with a substantially increased risk of fraud, identity theft and misuse resulting from the unauthorized disclosure of their personal information.

The plaintiff, a Massachusetts resident who received a letter from M&T Bank in August 2023 stating that her data had been involved in the incident, says she is now forced to spend time mitigating the effects of the data breach by researching credit monitoring and identity theft insurance options and tracking her accounts for fraudulent activity.

The complaint argues that the untimely notice, which came several months after M&T Bank claims to have discovered the incident, prevented the plaintiff and other class members from taking “meaningful, proactive” steps to secure their information.

The lawsuit also takes issue with the bank’s alleged failure to accurately disclose the data breach to victims, who remain in the dark regarding what particular data was stolen, the kind of malware used during the incident and what steps are being taken to secure their information going forward.

“Plaintiff and Class Members are, thus, left to speculate as to where their [personally identifiable information] ended up, who has used it, and for what potentially nefarious purposes, and are left to further speculate as to the full impact of the Data Breach and how exactly Defendant intends to enhance its information security systems and monitoring capabilities to prevent further breaches,” the complaint says.

The lawsuit seeks to cover anyone in the United States whose personally identifiable information and/or financial information was exposed to unauthorized third parties as a result of the data breach disclosed by M&T Bank Corporation in August 2023. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.