Hyundai Accused of Failing to Protect Millions in Massive Data Breach Lawsuit

Case Overview: Lawsuit accuses Hyundai AutoEver America of failing to secure sensitive consumer and employee data for 2.7 million people and delaying breach notifications.

Consumers Affected: Hyundai, Kia, and Genesis customers and employees whose personal information was compromised in the 2024 breach.

Court: U.S. District Court for the Central District of California

Millions of Hyundai customers and employees are now at the center of a new class action lawsuit that accuses the automaker’s technology arm of failing to secure private information later exposed in a data breach.

The lawsuit, filed in federal court, alleges that Hyundai AutoEver America—the in-house information technology provider for Hyundai Motor Group—failed to properly protect the personal identifying information (PII) of approximately 2.7 million people. The compromised data reportedly included names, Social Security numbers, and driver’s license information.

According to the filing, the breach occurred in March but was not disclosed to affected individuals until late October, months after Hyundai AutoEver allegedly discovered the unauthorized access.

Hyundai’s Technology Arm Blamed for Major Data Exposure

The complaint states that Hyundai AutoEver collected and stored customer and employee data as part of its technology and software services for Hyundai, Kia, and Genesis vehicles. Plaintiffs argue the company had a duty to safeguard that information using reasonable security measures but failed to do so.

“Sensitive and confidential personal information—which consumers entrusted to the company on the understanding that it would be protected—was targeted, compromised, and unlawfully accessed,” the filing states.

The lawsuit claims the company did not encrypt or properly secure the data in its possession, leaving it exposed to cyberattacks. It also alleges Hyundai AutoEver transmitted personal information across systems in ways that increased its vulnerability to hackers.

The data breach allegedly exposed a range of personally identifiable information, including names, birth dates, driver’s license numbers, and Social Security numbers. Such information can be used for identity theft, tax fraud, or unauthorized credit activity, according to the filing.

Plaintiffs claim the breach affects both current and former customers as well as employees who provided personal details to Hyundai AutoEver in the course of business.

Delayed Notification Allegedly Increased Consumer Risk

According to the lawsuit, Hyundai AutoEver’s delayed disclosure left affected individuals unaware that their information had been stolen and at risk of misuse for months. Plaintiffs claim the company waited until the end of October to notify those impacted, despite learning of the breach much earlier in the year.

This delay, they argue, prevented consumers from taking timely steps to protect their financial accounts or monitor their credit. The complaint asserts that Hyundai AutoEver’s response to the breach compounded the harm caused by its alleged security failures.

Cybersecurity Failures Continue To Draw Legal Challenges

The class action accuses Hyundai AutoEver of negligence, breach of implied contract, and unjust enrichment. The plaintiffs say the company benefited financially from collecting and storing data without allocating sufficient resources to protect it.

They are seeking restitution, compensatory damages, and injunctive relief requiring Hyundai AutoEver to strengthen its cybersecurity safeguards. The lawsuit also asks the court to order regular audits and compliance checks to prevent future incidents.

“Defendant maintained, used, and shared personal information in a reckless manner,” the complaint alleges, adding that the company’s security controls fell short of industry standards.

The case adds to a growing list of legal disputes involving Hyundai and its subsidiaries. In a separate matter, Hyundai faces claims that it failed to disclose an alleged brake defect in certain Palisade SUVs identified during pre-production testing.

Meanwhile, Nissan is confronting litigation alleging that some of its vehicles contain defective door locks that may open unexpectedly or jam shut while in use.

Case Details

• Lawsuit: Gretchen Benedettini v. Hyundai Auto Ever America LLC
• Case Number: 8:25-cv-02561
• Court: U.S. District Court for the Central District of California

Plaintiffs' Attorney

• Kristen Lake Cardoso (Kopelowitz Ostrow P.A.)

Have you ever received a data breach notice from a company? How did you respond? Share your experience below.