Ally Financial Faces Class Action Lawsuit Over August Data Breach

Case Overview: A class action lawsuit has been filed against Ally Financial, alleging that the company failed to adequately protect customer data, leading to a data breach.

Consumers Affected: Ally Financial customers whose personal information was compromised in the data breach.

Court: North Carolina federal court

Ally Financial and its subsidiary, Ally Bank, have been hit with a class action lawsuit after a cyberattack compromised sensitive customer data. 

Plaintiff Robert Hamilton filed the class action complaint on Sept. 7 in a North Carolina federal court. The lawsuit stems from a data breach that occurred at the end of August, National Mortgage Professional reports.

The breach has led plaintiffs like Hamilton to claim that the financial giant was negligent in safeguarding their personal information.

Ally Financial Accused of Negligence In Data Breach, Leaving Customers Vulnerable

According to the lawsuit, Ally Financial failed to implement “reasonable security practices,” leaving customers’ sensitive data vulnerable. 

Hamilton says he received a breach notification letter on Aug. 30, 2024, informing him that an unauthorized party accessed his private information through a third-party vendor’s system. 

The compromised data included Hamilton's name, social security number, date of birth, address, driver’s license number and contact details.

Despite sending the breach notice in late August, Ally Financial and Ally Bank were reportedly aware of the incident on Aug. 1. Hamilton says this shows that Ally failed to act swiftly to mitigate the damage, leading to allegations of negligence, breach of implied contract, and unjust enrichment.

Stolen Data May Be Sold On Dark Web, Lawsuit Claims

One of the major concerns raised by Hamilton in the lawsuit is the potential sale of stolen information on the dark web. 

The complaint notes that personal data, such as social security numbers and other personally identifiable information (PII), can fetch high prices on the dark web, with some experts estimating they’re worth ten times more than credit card details.

According to IBM’s latest report on data breaches, the global average cost of a data breach in 2024 is $4.88 million—a 10% increase over last year and the highest total ever.

Data Breaches Continue to Plague Companies, Putting Consumers at Risk

The Ally Financial lawsuit is just the latest in a series of cyberattacks on American institutions.

The lawsuit cites recent high-profile breaches at companies like Mr. Cooper and loanDepot, emphasizing that such incidents highlight the growing threat to the financial services sector. In April, millions of AT&T customers found out that their personal information—including names, addresses and Social Security numbers—were stolen by cybercriminals and offered for sale on the dark web. 

Meanwhile, Farmers Investment Co. recently reached a settlement with customers following a data breach in May 2022 which allegedly exposed the personal identifiable information (PII) of consumers.

Now, Hamilton argues that Ally should have been more proactive in preventing this data breach, given the trend in cyberattacks targeting lenders. The class action seeks compensation for affected customers, along with a jury trial. 

Have you been affected by the Ally Financial data breach? Share your experiences and concerns in the comments below.