Ace Hardware Data Breach: Lawsuit Says Social Security Numbers Exposed in 2023 Cyberattack

New to ClassAction.org? Read our Newswire Disclaimer

Ace Hardware faces a proposed class action lawsuit that alleges the retailer had no effective means to stop an October 2023 data breach that compromised sensitive personal information belonging to current and former employees and job applicants.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 33-page Ace Hardware data breach lawsuit says names and Social Security numbers were stolen in the incident, which began on or around October 27, 2023. Ace Hardware, the largest retailer-owned coop in the world, did not become aware of the unauthorized activity on its network until at least two days later, the filing says.

It wasn’t until April 1, 2024, that the home improvement retailer finally notified state attorneys general and proposed class members about the data breach, more than five months after it occurred, the lawsuit shares.

“The Data Breach not only affects current and former employees but also prospective job applicants and thus, affects consumers who had no direct employment with Ace Hardware.

On information and belief, cybercriminals bypassed Ace Hardware’s inadequate security systems to access Plaintiff’s and the Class Member’s [personal information] in its computer systems.”

Per the suit, nearly 7,300 people “had their most sensitive personal information accessed, exfiltrated, and stolen” in the Ace Hardware data breach, causing damages that include lost time spent mitigating the harm from the cyberattack and the lost value of their sensitive data.

In its data breach notice, Ace Hardware “obfuscated the nature of the breach” and the threat it posed to current and former employees and job applicants, as the retailer did not mention how many victims there were, how the cyberattack happened, or why it took months to notify the public.

“Defendant’s failure to timely detect and report the data breach made the victims vulnerable to identity theft without any warnings to monitor their financial accounts or credit reports to prevent the unauthorized use of their [personal information],” the case states.

Although Ace Hardware has offered data breach victims 12 months of complimentary credit monitoring services, the case says this fails to address the lifelong harm consumers now face following the cyberattack.

The lawsuit looks to cover all individuals residing in the United States whose personal information was compromised in the Ace Hardware data breach, including everyone who received a notice of the breach.

Are you owed unclaimed settlement money? Check out our class action rebates page full of open class action settlements.