Advance America Data Breach Class Actions Allege Loan Company Failed to Protect Consumer Info

New to ClassAction.org? Read our Newswire Disclaimer

Payday loan company Advance America faces at least three proposed class action lawsuits in the wake of a February 2023 data breach that went unreported to authorities for roughly six months. 

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here. 

The cases, all filed in South Carolina within the last week, allege the data breach was a direct result of Advance America’s failure to have in place reasonable and adequate cybersecurity safeguards to protect consumers’ sensitive information. One suit says the Advance America data breach was caused by BlackBasta, a cybercriminal group that claimed to have infiltrated the defendant’s systems around the time of the incident and reportedly published a sample of the stolen data. 

According to the complaints, Advance America, which offers payday loans, flex loans, check cashing, cash advances and more, was on notice of the threat of a cyberattack, particularly given the sensitive nature of the data with which it is entrusted, yet nevertheless stored the information in a reckless, vulnerable manner. 

One case, filed on August 28, says that cybercriminals on February 7, 2023, “foreseeably” accessed Advance America’s network, which housed the personal information of thousands of consumers. According to the Spartanburg, South Carolina company’s data breach notice, Advance America on February 7 experienced “a temporary systems outage affecting our corporate network,” after which a subsequent investigation revealed that an unauthorized party had in fact accessed consumers’ sensitive information. 

However, Advance America “inexplicably” waited more than six months after learning of the breach to begin notifying victims, the lawsuits say. 

“Due to Defendants’ negligence and data security failures, cybercriminals had access to, and now potentially possess, everything they need to commit identity theft and wreak havoc on the financial and personal lives of thousands of individuals,” one filing shares. 

The suit filed on August 24 highlights that although certain sensitive information, including full names and Social Security numbers, was compromised and stolen by hackers, this data nevertheless remains in the possession of Advance America “without additional safeguards and independent review and oversight,” leaving it vulnerable to future theft. 

Victims of the Advance America data breach will face the risk of identity theft and fraud for their respective lifetimes and must spend time and money to closely monitor their financial accounts, one case relays. The lawsuit scathes that the temporary credit monitoring services offered by Advance America in the wake of the incident do nothing to offset the out-of-pocket costs borne by victims for credit freezes and other protective measures, much less address the lifelong harm caused by the data breach. 

Per the suit, Advance America has not disclosed how many consumers it notified of the cyberattack. 

The lawsuits look to represent all individuals who received notice from Advance America that their personally identifiable information was actually or potentially accessed during the data breach reported by the company in August 2023. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.