Duke Energy Class Action Lawsuit: Data Breach Exposed Customer Information

Case Overview: A class action lawsuit claims Duke Energy failed to protect customer data, leading to a data breach that exposed sensitive personal information.

Consumers Affected: Duke Energy customers in North and South Carolina whose personal information was compromised in the data breach.

Court: U.S. District Court for the Western District of North Carolina

A recent class action lawsuit alleges Duke Energy Carolinas failed to protect sensitive customer data, leaving thousands at risk after a data breach in May 2024. The breach, which the company disclosed in November, is said to have exposed names, Social Security numbers, and other personal information.

Duke Energy Data Breach Exposed Customer Information, Lawsuit Claims

According to the lawsuit, unauthorized access between May 20 and May 24, 2024, allowed a third party to compromise sensitive details for around 374,000 Duke Energy customers. Personal information involved in the breach reportedly included names, addresses, account numbers, dates of birth, and Social Security numbers. Payment-related details were also impacted.

The incident stemmed from vulnerabilities in systems managed by TIO Networks, a third-party payment processor used by Duke Energy for in-person bill payments. While the breach affected 1.6 million individuals across multiple organizations, Duke Energy customers in North and South Carolina accounted for a substantial portion.

Duke Energy Accused of Failing to Protect Customer Data and Delaying Notification

Lead plaintiff Matthew Saunders claims Duke Energy failed to implement adequate safeguards to protect personal information. The lawsuit alleges that the company did not use reasonable security practices, such as encrypting sensitive data or deleting outdated records, to prevent unauthorized access.

The filing also accuses Duke Energy of delaying notification about the breach. Customers were reportedly informed months after the incident, leaving them vulnerable to identity theft and other risks. Saunders alleges this delay compounded the harm caused by the breach.

“Defendant promised to provide confidentiality and adequate security for the data it collected from customers through its applicable privacy policy,” the lawsuit states. However, the complaint alleges the company did not uphold those commitments.

Data Breach Increases Risk of Identity Theft and Fraud

The breach has raised concerns about potential misuse of the exposed information. With Social Security numbers and other personal details compromised, affected individuals may face heightened risks of identity theft, financial fraud, and other issues.

Duke Energy has acknowledged the breach and stated that it is working to address vulnerabilities in its systems. The company emphasized its commitment to safeguarding customer information and has taken steps to improve its data security practices. However, the lawsuit contends these efforts came too late for customers whose data had already been exposed.

Additionally, while Duke Energy offered credit monitoring and identity theft protection to those impacted, the lawsuit argues these measures fall short of addressing the harm caused. 

Lawsuit Seeks Accountability and Improved Data Security Practices

This class action lawsuit highlights growing concerns about data security, particularly for companies handling sensitive customer information. With breaches becoming more frequent, organizations are under increasing pressure to demonstrate their ability to protect personal data. 

In December, a similar class action lawsuit was brought against Deloitte over its alleged failure to protect personal data in the Rhode Island RIBridges system, leading to a data breach that exposed sensitive information.

By bringing a data breach class action lawsuit against Duke Energy, Saunders is asking the court to hold the company accountable for failing to protect customer information. He is seeking damages for affected individuals and measures to prevent similar incidents in the future. The lawsuit also calls for stronger transparency in how Duke Energy manages and secures personal data.

Case Details

• Lawsuit: Saunders, et al. v. Duke Energy Carolinas LLC
• Case Number: 3:24-cv-01074
• Court: U.S. District Court for the Western District of North Carolina

Plaintiffs' Attorneys

• Scott C. Harris (Milberg Coleman Bryson Phillips Grossman, PLLC)

Were you affected by the Duke Energy data breach? Share your experience in the comments below.