ComplyRight Facing Class Action After Recent Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

According to the lawsuit, the defendant, which provides cloud-based human resources and tax preparation services to businesses, announced in July 2018 that it had suffered a data breach in which customers’ personal information—including names, addresses, phone numbers, email addresses, and Social Security numbers—may have been compromised. The lawsuit argues that ComplyRight failed to implement adequate security measures to protect its customers’ sensitive data despite repeatedly assuring on its website that security is one of its “top priorities” and boasting it employed the “strongest encryption program available.” ComplyRight should have been aware of the threat of a data breach, the case continues, citing recent large security breaches suffered by companies such as Target, Neiman Marcus, Michaels Stores, and SuperValu.

The lawsuit further poses that the defendant was even more obligated to ensure it was armed with proper security systems given the nature of its business and the highly sensitive information with which it is entrusted.

“ComplyRight’s conduct was particularly unreasonable given the nature and amount of Personal Information it collected and stored—which included highly sensitive Social Security numbers—and the foreseeable consequences of a breach, including, specifically, the immense damages that would result to consumers,” the complaint reads.

The defendant reportedly learned of the breach around May 22 yet waited nearly three months to notify potentially affected individuals, according to the complaint. Although the company is allegedly offering 12 months of complimentary credit monitoring services to those affected by the hack, the case claims this remedy is inadequate. One year of credit monitoring fails to protect affected consumers from the “prodigious number of threats that data breaches impose,” the lawsuit argues, adding that the damage could continue for many years to come.