Astoria Company Facing Class Action Over Early 2021 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Astoria Company LLC faces a proposed class action over a January 2021 data breach during which the personal information of roughly 940,000 consumers was reportedly compromised.

According to the 39-page suit, Astoria, who operates a lead exchange that seeks to connect consumers with auto loan, mortgage or other financial products and services in which they’ve expressed interest, failed to take reasonable steps to protect the sensitive information with which it was entrusted. Due to the nature of Astoria’s business, the company often maintains personal information about consumers with whom it has no direct relationship, the lawsuit says.

According to the case, Astoria has breached its legal and equitable duties to protect consumers’ personally identifiable information (PII) and exposed victims of the breach to an increased risk of identity theft and fraud.

“This PII was compromised due to Defendant’s negligent, careless, and intentional acts and omissions and the failure to protect the PII of Plaintiff and Class Members,” the complaint alleges.

As the case tells it, Astoria announced in November 2021—after “nine months of denying that a data breach had even occurred, downplaying the extent of the data breach (claiming that only 70 people had PII compromised), and refusing to give notice of the Data Breach,” according to the suit—that an unauthorized third party had gained access to a database where the company stored consumer information. Per the complaint, the compromised data included consumers’ first and last names; mailing and email addresses; dates of birth; phone, Social Security and driver’s license numbers; and in some cases employment information.

According to the lawsuit, the breach was a direct result of Astoria’s failure to properly secure the information in its care, including by implementing data security measures recommended by the U.S. government, U.S. Cybersecurity & Infrastructure Security Agency, Microsoft Threat Protection Intelligence Team and Federal Trade Commission.

“Defendant could have prevented this Data Breach by properly securing and encrypting the PII of Plaintiff and Class Members,” the complaint attests. “Alternatively, Defendant could have destroyed the data that was no longer useful, especially outdated data.”

Moreover, the lawsuit claims Astoria failed to implement even the minimum industry-wide best practices for lead exchange companies.

Per the suit, the defendant’s failure to secure consumers’ data has “long lasting and severe” consequences given impacted individuals may experience the fraudulent use of their information for many years to come.

The lawsuit looks to cover anyone Astoria Company identified as being among the consumers impacted by the data breach, including those who were sent a data breach notice.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.