Class Action Alleges MyHeritage Failed to Provide Users with Timely Notice Following June 2018 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

MyHeritage, Ltd. and MyHeritage (USA), Inc. are the defendants in a proposed class action lawsuit filed over the DNA kit companies’ alleged shortcomings in protecting customers’ private information from unauthorized eyes.

MyHeritage is described in the lawsuit as a “leading global destination for discovering, preserving, and sharing family history.” The company, the suit continues, offers consumers both family history and DNA genealogy services. In its marketing and advertising of its services, MyHeritage reportedly holds its supposed security in such high regard that the company encourages consumers to keep their most intimate personal information on file, the case says. 

Filed in Utah, the lawsuit explains MyHeritage announced on June 4, 2018, that consumers’ usernames and password information had been accessed and stored by “unauthorized persons.” The plaintiff argues the defendants “knew or should have known” how valuable the information in its charge was to cyber attackers, yet apparently failed to take adequate measures to ensure the data was safeguarded from prying eyes.

“[The defendants] failed to disclose their negligent and insufficient data security practices and consumers relied on or were misled by these omissions,” the lawsuit reads, “resulting in [the plaintiff’s] and Class Members’ using [MyHeritage’s] services.”

Particularly worrisome in this situation is the trove of MyHeritage users’ private health information that the lawsuit says the defendants should have reasonably anticipated would be targeted by bad actors.

The suit rounds out in alleging that despite reportedly setting up an “Information Security Incident Response Team to investigate the incident,” MyHeritage still has not repaired holes in its security. 

[The defendants], by virtue of not knowing how the breach occurred, did not fix the flaw which permitted unauthorized access to [the plaintiff’s] and Class Members’ Private Information, and have not indicated any efforts to further secure the Private Information subsequent to their June 4, 2018, blog post,” the complaint states.