Class Action Filed Over Charter Foods January 2023 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Charter Foods faces a proposed class action over a January 2023 data breach that reportedly exposed the names, addresses, dates of birth and Social Security numbers of a yet-unknown number of current and former fast-food employees.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 31-page lawsuit says that defendants Charter Foods and Charter Foods North are franchisees of Yum! Brands, a parent company that owns several fast-food chains, including Taco Bell, Long John Silvers, KFC, Pizza Hut and A&W. In order to work for restaurants operated by Charter Foods, employees must provide their highly sensitive personal and financial information, which the companies then maintain on their computer systems, the filing explains.

According to the case, an “undoubtedly nefarious” third party was able to infiltrate Charter Foods’ networks on January 13 of this year due to the companies’ “intentional, willful, reckless and/or grossly negligent” failure to implement adequate cybersecurity measures. Although the exact number of victims is unknown, the complaint claims that the incident has potentially affected hundreds of thousands of individuals. 

As the case tells it, Charter Foods and Charter Foods North were obligated to protect consumers’ sensitive information from unauthorized disclosure in accordance with their own internal policies, state and federal law and reasonable industry standards. The filing argues that as large, sophisticated organizations, the defendants should have known they were responsible for safeguarding consumers’ data from the “known risk and foreseeable likelihood” of a data breach.

Moreover, Charter Foods and Charter Foods North could have prevented the cyberattack by properly encrypting their servers and the sensitive information they maintained and by implementing processes that would immediately detect a breach of their systems, the suit contends.

The plaintiff, a former Taco Bell employee from New Hampshire, claims to have received a letter from the defendants dated April 7, 2023 informing her that her personal and financial information had been compromised in the cyberattack.

“Despite this, Plaintiff and the Class Members remain, even today, in the dark regarding what particular data was stolen, the particular malware used, and what steps are being taken, if any, to secure their [personally identifiable information] and financial information going forward,” the case reads. “Plaintiff and Class Members are, thus, left to speculate as to where their [personally identifiable information] ended up, who has used it, and for what potentially nefarious purposes, and are left to further speculate as to the full impact of the Data Breach and how exactly Defendants intend to enhance their information security systems and monitoring capabilities to prevent further breaches.”

The suit alleges that victims’ data has likely been put up for sale on the dark web, exposing them to a substantially increased risk of identity theft and fraudulent charges that will likely persist for years.

The lawsuit looks to cover anyone in the United States whose personally identifiable information and/or financial information was exposed to unauthorized third parties as a result of the data breach experienced by Charter Foods and Charter Foods North on January 13, 2023.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.