Arby's Hit with Another Class Action Over Lagged Data Breach Response

New to ClassAction.org? Read our Newswire Disclaimer

A Tennessee consumer has filed a proposed class action in Georgia against Arby’s Restaurant Group, Inc. (ARG) over its allegedly botched handling of a months-long data breach that exposed customers’ personally identifiable information. The lawsuit alleges the data breach, which reportedly began in October 2016 and spread through point-of-sale systems at roughly 1,000 Arby’s corporate restaurant locations for the next three months, was the result of the company’s lax approach toward customer data security. Arby’s handling of the breach, the plaintiff argues, did nothing to help the situation.

“ARG disregarded the rights of [the plaintiff] and class members by intentionally, willfully, recklessly, or negligently failing to take adequate and reasonable measures to ensure its data systems were protected, failing to take available steps to prevent and stop the breach from ever happening, and failing to [disclose] to its customers the material facts that it did not have adequate computer systems and security practices to safeguard customer data,” the complaint alleges, adding that Arby’s should be on the hook for exposing customers’ information to criminals.

Though it isn’t true for all cases, the plaintiff in this particular lawsuit claims she suffered actual harm due to the defendant’s conduct. The woman claims that after using her debit card to buy food at an Arby’s location in Tennessee on December 3, 2016, she was quickly contacted by her bank with information that her card had been compromised. In response, the bank reportedly placed a freeze on her account, which lasted roughly 10 days, until a new debit card could be sent. The plaintiff argues she and similarly situated consumers are still at risk for future fraud or identity theft.