Fidelity faces class action over August data hack

Fidelity Investments is facing a proposed class action lawsuit following a data breach in August that compromised the personal information of more than 77,000 customers.

The suit, filed in the US District Court for the District of Massachusetts, alleges that the asset management firm failed to adequately protect customer data and delayed notifying affected individuals of the hack that occurred between August 17 and 19.

In a letter sent to impacted customers, Fidelity said it determined an anonymous third party managed to gain access to the data by setting up two user accounts on August 19, at which point it "immediately took steps to terminate the access."

The lead plaintiffs, Seth and Yaakov Gluck, residents of Spring Valley, New York, noted that hackers were able to access sensitive information, including Social Security numbers, addresses, and financial data, through Fidelity’s systems. They argued that Fidelity’s security measures were insufficient to prevent the breach and that the company failed to detect it promptly.

Although Fidelity detected the breach on August 19, the plaintiffs claim they were not notified until October 10, a day after the firm reported the incident to Maine's attorney general. The Glucks argue that this delay increased the risk of identity theft and other financial harm.

“Due to the data breach, plaintiffs have experienced anxiety over the public release of their personal information, which they trusted would be safeguarded against unauthorized access and disclosure,” the lawsuit read, highlighting "concerns about unauthorized individuals viewing, selling, and using Private Information for identity theft and fraud."

The Glucks' action seeks statutory damages, litigation costs, attorney’s fees, and class action certification for all customers affected by the breach.

"In the aggregate, Plaintiffs' claims, and the claims of the other members of the Class exceed $5,000,000 exclusive of interest and costs," the complaint read.

The proposed class action, reported earlier Monday by CityWire, also seeks injunctive relief to ensure Fidelity adequately takes proper steps to maintain the personal information in its possession and ensure the data that's already been stolen isn't used for identity theft against its customers.

As of publication, InvestmentNews has yet to get a statement from Fidelity responding to the complaint.