April 2023 Crossroads Equipment Lease & Finance Data Breach Triggers Class Action

New to ClassAction.org? Read our Newswire Disclaimer

Crossroads Equipment Lease & Finance has been hit with a proposed class action lawsuit over a targeted cyberattack that reportedly occurred in early April 2023.

Did you receive a data breach letter from Crossroads? Let us know here.

According to the 66-page data breach lawsuit, an unauthorized third party encrypted the transportation equipment leasing company’s computer systems on April 1, 2023, preventing it from accessing many of its files. The complaint says the ransomware attack compromised the personal information of approximately 24,000 individuals.

Per the suit, the data breach disrupted Crossroads’ ability to complete ACH payments and exposed highly sensitive data, including names, dates of birth, contact details, addresses, Social Security numbers, driver’s license and passport numbers and certain tax documents. As the case tells it, the incident also may have compromised individuals’ vehicle information, credit or debit card numbers, financial account data, credit reports, digital signatures, loan applications and medical information.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The complaint contends that negligent cybersecurity on Crossroads’ part is to blame for the ransomware attack, arguing that the company stored the sensitive data unencrypted, unredacted and in a condition “vulnerable to cyberattacks” in its network.

As a result of the defendant’s alleged negligence, victims now face an ongoing threat of identity theft, fraud and other illegal schemes, the filing charges.

In addition, the suit alleges Crossroads’ conduct is “particularly heinous” given that it waited nearly a year after the incident purportedly occurred to notify victims. Although the company claims to have discovered the data breach on April 2, 2023, it did not begin to send notice letters to impacted individuals until late February 2024, the case relays.

The lawsuit looks to represent anyone identified by Crossroads as being among the individuals affected by the data breach, including all who received notice of the incident.

Did you receive a data breach letter from Crossroads? Let us know here.