Citi Trends Facing Class Action Over January 2023 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit claims clothing retailer Citi Trends failed to protect the personal information of current and former employees during a January 2023 cyberattack.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 71-page lawsuit says that on January 14, an unauthorized third party gained access to the company’s computer network and exfiltrated files containing private employee data. The suit relays that the ransomware attack compromised the personal information of current, former and prospective employees, including at least their full names, Social Security numbers, dates of birth, bank or financial account information and routing numbers.

The case argues that the Georgia-based clothing retailer, which operates more than 600 stores across 33 states, failed to implement adequate cybersecurity measures to safeguard employee data, which the company allegedly stored unencrypted and unredacted in its network.

Per the complaint, the notice letter sent to victims of the breach—which the defendant sent more than five months after the incident, in late June of this year—did not explain how cybercriminals gained access to the system, why it took so long to notify impacted individuals or what steps, if any, are being taken to prevent future ransomware attacks.

Given the frequency of cyberattacks in recent years, the filing charges that Citi Trends should have known that the stored information was valuable to hackers and appropriate safeguards were necessary to secure it against unauthorized disclosure.

Although the company has reportedly offered 12 months of identity monitoring services to affected individuals, the lawsuit contends that this gesture is “wholly inadequate” in the face of victims’ lifelong threat of identity theft and fraud.

The plaintiff, a Pennsylvania resident and former employee, received notice on June 22 that her personal information had been compromised in the breach, the suit says. The woman claims that, since the cyberattack, she has experienced a surge in spam communication and, more worryingly, a fraudster has attempted to open a Bank of America account in her name.

The lawsuit looks to represent anyone in the United States whose personal information was accessed or acquired by an unauthorized party as a result of the data breach reported by Citi Trends in June 2023.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.