Class-Action Lawsuits Filed Against Ally Financial Following Major Data Breach

Cassandre Coyer, reporting in Bloomberg Law, writes that an April 2024 Ally Financial Inc. data breach has prompted two putative class-action lawsuits. Both were filed in the U.S. District Court for the Western District of North Carolina.

Both claim that Ally failed to protect customers’ personally identifiable information, including Social Security numbers, dates of birth, and auto account numbers. They seek damages on behalf of affected individuals and accuse Ally of negligence.

Ally customer Sebestian Owens’ complaint claims that someone took out an auto loan in his name after the breach, and his personal data appeared on the dark web. According to the Owens complaint, Owens v. Ally Bank et al., impacted current and former customers had not yet received notification from Ally.

On Sept. 10, Robert Hamilton, who lives in Texas, filed a similar complaint, but he says that he received a letter from Ally on Aug. 30 notifying him that he was affected by a data breach. His suit calls this a “long delay, ” exposing him to a high risk of identity theft.

Ally acknowledged the breach in a May 2024 notification to the Massachusetts Attorney General’s office that an “unauthorized party” may have accessed personal data through a vendor’s systems.

The Court is determining whether the lawsuits should be certified as class actions. Both complaints emphasize Ally’s failure to prevent cyberattacks and provide timely notification. The plaintiffs argue that this constitutes negligence, which caused them direct harm, including identity theft and diminished credit scores.