Petco Hit with Class Action Over Data Breach Reportedly Affecting 30,000 PupBox Customers

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims Petco Animal Supplies Stores, Inc. and a subsidiary failed to adequately protect customers’ personal information from a data breach that reportedly affected 30,000 PupBox, Inc. subscribers.

According to the lawsuit out of California’s Southern District Court, Petco and PupBox maintained customers’ data in a “reckless manner” that left the information vulnerable to cyberattacks. Moreover, the defendants’ apparent failure to properly monitor their website and computer network allowed the breach to go undetected for nearly six months, the case argues.

“Had Defendants properly monitored their property, they would have discovered the intrusion sooner,” the complaint claims, adding that customers’ information was reportedly accessible to an unauthorized third party between February 11, 2020 and August 9, 2020.

PupBox customers, the case says, now face a heightened risk of identity theft and fraud as a result of the defendants’ “negligent conduct.”

PupBox, which offers a subscription service through which customers are mailed a customizable collection of dog treats, toys and accessories each month, was acquired by Petco in November 2017, the case explains.

In an October 2020 notice to customers, PupBox reportedly stated that it had “received notification that fraudulent activities may have occurred on credit cards that were used on the PupBox website.” Per the case, an investigation uncovered an unauthorized plugin on PupBox’s website that had captured and shared the personal information of customers who visited the website between February 11, 2020 and August 9, 2020.

According to the suit, the information compromised in the breach included customers’ names, email addresses, mailing addresses, credit card numbers, credit card expiration dates, credit card CVV codes and PupBox.com passwords.

The lawsuit alleges that the defendants “substantially delayed” notifying affected customers of the cybersecurity incident, stressing that although the breach was reportedly discovered in early August, customers were not notified until October 2, 2020, nearly two months later.

The case goes on to argue that Petco neglected to properly secure customers’ data by failing to encrypt payment card information at the point of sale; install updates, patches and malware protection in a timely manner; and provide sufficient control employee credentials and access to computer systems that may have prevented the breach.

Per the suit, customers whose information was stolen now face an increased threat of identity theft and fraud and will be forced to “vigilantly monitor their financial and medical accounts for many years to come.”

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.