Disney Facing Class Action Lawsuit Over July 2024 Data Breach Affecting Employees, Guests

New to ClassAction.org? Read our Newswire Disclaimer

The Walt Disney Company and Disney California Adventure Park face a proposed class action lawsuit over a “massive” July 2024 data breach in which personal information belonging to Disney staff members and guests was reportedly leaked.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter.

The 32-page case accuses Disney of “intentionally, willfully, recklessly, or negligently” failing to implement adequate measures to protect victims’ private information from unauthorized access. The lawsuit also takes issue with the defendants’ alleged failure to send notice of the incident to affected parkgoers and staff, many of whom, the suit says, only became aware that their information had been compromised after reading articles that reported the breach early last month.

According to the filing, a hacker group known as NullBulge infiltrated Disney’s internal Slack channels earlier this year, gaining access to and subsequently leaking over one terabyte of the company’s data. The leaked Disney data includes more than 44 million Slack messages, 18,800 spreadsheet files and 13,000 PDFs.

The Wall Street Journal reports that the compromised Slack messages contained the passport numbers, visa information, addresses and birthplaces of Disney Cruise Line employees, as well as the names, addresses and phone numbers of some Disney Cruise Line passengers. YahooTech says that crew members also had their employee assignments and dates of birth exposed, and a “cluster” of Disneyland guests who had dining reservations at the park had their names and contact information leaked.

Still, the complaint says, Disney data breach victims remain “in the dark” regarding what particular information was stolen, where it ended up and who may have exploited it for potentially nefarious purposes.

“Indeed, they are left to further speculate as to the full impact of the data breach and how exactly Defendants intend to enhance their information security systems and monitoring capabilities so as to prevent further breaches,” the data breach lawsuit stresses.

The filing notes that those impacted by the Disney data leak have been exposed to a heightened risk of identity theft and fraud. Per the case, these “imminent and impending” harms could have been avoided had Disney properly secured and encrypted its servers.

The Disney lawsuit looks to represent anyone whose personal information was exposed to unauthorized third parties as a result of the data breach that occurred on or about July 2024.

Check out ClassAction.org’s lawsuit list for the latest open class action lawsuits.