Disney Faces Class-Action Lawsuit Over Massive Data Breach, Alleging Negligence and Privacy Violations

Walt Disney Co. is facing a class-action lawsuit for negligence, breach of implied contract, and privacy law violations. The Los Angeles Times reports that the allegations follow a major data breach earlier this year.

The case was filed by plaintiff Scott Margel, who claimed Disney failed to adequately protect and notify victims about the extent of the breach. The compromised data includes sensitive personal information from Disney employees and possibly customers. The case demands stronger security measures and damages for Margel and thousands of others.

The class-action lawsuit stems from a hacking incident involving a group called NullBulge, composed of self-described “hacktivists,” which allegedly leaked 1.2 terabytes of Disney’s internal data. The breach, reportedly caused by unauthorized access to Disney’s Slack platform, compromised over 18,800 spreadsheets, 13,000 PDFs, and 44 million Slack messages. The Wall Street Journal reported that Disney plans to stop using Slack after the breach.

In July, NullBulge said it had leaked Disney’s data because of the company’s treatment of artists, “approach to AI,” and “pretty blatant disregard for the consumer.” The hackers told CNN they penetrated Disney’s system thanks to “a man with Slack access who had cookies.”

The compromised information includes passport numbers, visa data, birthplaces, and addresses. Disney Cruise Line employees and passengers were particularly affected. The lawsuit highlights Disney’s failure to inform victims about the breach’s full scope.

The court filing stresses Disney’s liability for not taking adequate preventive measures and for its delayed response in notifying those affected. It argues that class members are uncertain of how their data is used and vulnerable to victimization.