Capital One Data Breach: Did the Bank Fail to Protect Your Data?

Case Overview: A class action lawsuit accuses Capital One of negligence after a data breach exposed sensitive customer information, including Social Security numbers and financial details.

Consumers Affected: Capital One customers whose data was accessed in the alleged data breach.

Court: U.S. District Court for the Eastern District of Virginia, Alexandria Division

Capital One is facing a proposed class action lawsuit after a former employee allegedly gained unauthorized access to its systems and stole sensitive personal information belonging to customers. 

The breach, which occurred over a nine-month period between August 2022 and May 2023, exposed names, Social Security numbers, dates of birth, addresses, phone numbers, credit card details, transaction history, and other financial data, according to the new lawsuit.

Filed in federal court in February, the lawsuit accuses Capital One of failing to implement adequate cybersecurity measures to protect customers’ data, despite being in possession of highly sensitive information. 

According to the complaint, the company’s negligence has put consumers at lifelong risk of identity theft and fraud, and that the company’s delayed response worsened the fallout.

Capital One's Security Under Fire After Major Data Leak

Andrew Willoughby of New York filed the proposed class action lawsuit after he noticed an unauthorized charge on his Capital One account and soon learned his information may have been part of the breach. 

The lawsuit says Willoughby is meticulous about protecting his personal data—using strong passwords, storing documents securely, and never transmitting unencrypted information online. Despite these precautions, he now faces years of financial monitoring, lost time, and growing anxiety. 

Willoughby is calling for damages and more robust identity theft protection services, arguing that Capital One has offered only a year of credit monitoring—a remedy he calls inadequate.

Customers Say Bank's Negligence Led to Data Theft

According to the complaint, a Capital One employee had access to customer information from August 2022 until May 2023 due to insufficient internal safeguards. Customers were not notified of the breach until January 2025—eight months after it ended.

Even now, the lawsuit says, the company hasn’t disclosed exactly how the breach occurred, what security flaws were exploited, or what steps it has taken to prevent future incidents. Willoughby alleges that Capital One failed to encrypt highly sensitive data and ignored public warnings from federal agencies about the growing threat of cyberattacks against financial institutions.

A Growing List of Lawsuits Over Data Leaks

Capital One isn’t alone. Insurance provider Globe Life is facing a lawsuit after an October 2024 breach exposed more than 850,000 customers’ Social Security numbers, health records, and insurance details. 

Robinhood is also being sued over claims that a ransomware group accessed and threatened to leak millions of user records, including Social Security numbers, unless a ransom was paid. 

AnnieMac Home Mortgage is also under fire after hackers allegedly accessed the personal and banking information of roughly 171,000 customers. Meanwhile, Wells Fargo is the subject of a class action alleging that it failed to secure customer data, allowing unauthorized access to sensitive personal and financial details.

In his lawsuit against Capital One, Willoughby wants to represent anyone whose data may have been accessed in the ransomware attack. He is suing for negligence, invasion of privacy, breach of implied contract, breach of contract, breach of fiduciary duty, and more, and is seeking damages, injunctive relief, fees, costs, and interest.

Case Details

• Lawsuit: Willoughby v. Capital One Financial Corporation, et al.
• Case Number:  1:25-cv-302
• Court: U.S. District Court for the Eastern District of Virginia, Alexandria Division 

Plaintiffs' Attorneys

• Lee A. Floyd and Justin M. Sheldon (Breit Biniazan, PC)
• William B. Federman and Jessica A. Wilkes (Federman & Sherwood)

Were you a Capital One customer during the data breach? Share your experience and concerns below.