Samsung Failed to Protect Private Customer Data from Cyberattack, Class Action Claims

New to ClassAction.org? Read our Newswire Disclaimer

Samsung faces a proposed class action lawsuit that claims the electronics company failed to properly protect consumers’ personal information from a cyberattack in early August 2022.

According to the 48-page lawsuit, highly sensitive personal information belonging to “likely millions” of people was compromised in the data breach. The complaint relays that although Samsung claimed Social Security numbers and credit and debit card numbers were unaffected, the information compromised by the ransomware attack may have included consumers’ names, contact and demographic information, dates of birth and product registration details.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The suit alleges that Samsung “negligent[ly]” and “careless[ly]” failed to implement standard cybersecurity measures to safeguard the customer information stored in its servers. Per the case, consumers handed over their private information to Samsung with the expectation that the “sophisticated” electronics giant would uphold its legal duty to secure the data against unauthorized disclosure.

“Defendant has a duty to safeguard and protect customer information entrusted to it and could have prevented this theft had it limited the customer information received from its business associates, and employed reasonable measures to ensure its systems were secure from threats like ransomware attacks,” the filing reads.

The complaint also takes issue with Samsung’s delay in notifying victims of the breach. Per the lawsuit, though the cyberattack occurred in early August, the defendant posted a notice on its website and sent emails notifying those impacted a month later, on or around September 2.

The company’s message to victims neglects to provide precise details about what information was accessed, how the cybercriminals entered the network, and what steps Samsung is taking to prevent such breaches in the future, the suit says. The lack of detail in the notice, coupled with Samsung’s delay in notifying victims—notice issued on the Friday of a holiday weekend—seems “calculated to minimize” the news of the cyberattack, the case contends.

The plaintiff, a New York resident, learned that his personal data was compromised in the breach when he received the email notice sent by Samsung in September, the complaint says. Like other victims, he now faces a substantially increased risk of identity theft, fraud, and other illegal schemes as a result of the unauthorized exposure of his information, the filing claims.

According to the case, Samsung announced in March of last year that it had experienced a data breach that exposed internal company data, including Galaxy smartphone source code, algorithms related to biometric authentication and other sensitive technical data. In the wake of that breach, Samsung promised that it would implement measures to prevent any such incidents from happening in the future, the filing says.

The suit says that it is possible that the breach Samsung announced in September was a “continuation” of the March incident.

The lawsuit looks to represent anyone in the United States whose private information was actually or potentially accessed or acquired during the Samsung data breach that is the subject of the company’s “Notice of Cybersecurity Incident” sent to consumers around September 2, 2022.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.