Class Action Lawsuit Filed Over 2021 Geico Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

Geico and parent company Berkshire Hathaway face a proposed class action in the wake of a data breach that reportedly took place from November 24, 2020 to March 1, 2021.

The 26-page lawsuit alleges the “foreseeable” incident took place as a result of Geico and Berkshire Hathaway’s negligent failure to safeguard the confidential information of millions of current and former Geico customers. Data stolen in the breach appears to be linked to current and former customers’ driver’s license numbers, according to the complaint. 

To date, Geico and Berkshire Hathaway have offered those affected by the data breach only 12 months of free identity theft and credit monitoring services, the lawsuit claims. This offer, according to the complaint, is “wholly inadequate” given it provides no remedy for identity theft and fraud risks proposed class members might face for years to come. 

The suit notes that Geico collects and has collected a significant amount of information from current and former policyholders, including Social Security numbers, addresses, phone numbers, dates of birth, bank account and credit card numbers, financial transaction records, credit ratings and driver’s license data. Per the case, this data is now “readily available on the internet for anyone and everyone to acquire, access, and use for unauthorized purposes for the foreseeable future” due to the defendants’ alleged failure to implement and follow “basic security procedures.” 

According to the complaint, Geico informed the plaintiffs by letter on or about April 9 that personal information obtained illegally from other sources had been used to obtain unauthorized access to their driver’s license numbers through the online sales system on the insurer’s website. Geico said this information could be used to fraudulently apply for unemployment benefits in policyholders’ names, the case says. 

The complaint relays Geico’s “Notice of Breach” sent earlier this month does not state when the breach was discovered, only that it was “recently determined.” Each plaintiff has “already determined that false claims have already been filed under their names for illicit purpose [sic] including filing for unemployment benefits,” the lawsuit says. 

Geico, at all relevant times, “promised and agreed in various documents” to safeguard and protect proposed class members’ personally identifiable information in accordance with federal and state laws and industry standards, the suit reads. The case argues Geico and Berkshire Hathaway should have known they were the targets of cybersecurity threats given the vast amount of personal consumer information they collect, manage and maintain. 

Who does the lawsuit aim to cover?

The case looks to represent all individuals in the United States whose personally identifiable information was compromised in the data breach initially disclosed by Geico on or about April 9, 2021. The suit also aims to cover a New York-only “subclass” of individuals who fit the same criteria.

How do I join the class action lawsuit? 

There’s nothing you need to do to “join” or be considered a part of a class action lawsuit. Class actions usually take some time to work their way through the legal system toward a settlement, dismissal or, increasingly, binding arbitration outside of court. 

This means it might be a while before the time comes for those who might be considered a part of a lawsuit’s “class” to submit claims for whatever compensation the court deems appropriate. At any rate, it’s only if and when a case settles that consumers would need to take action. You can learn more about it here. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.