MarineMax Class Action: Data Breach Exposes Customer Information

Case Overview: A class action lawsuit has been filed against MarineMax, alleging the company's negligence in data security led to a data breach that exposed customer information.

Consumers Affected: Individuals whose personal information was compromised in the MarineMax data breach.

Court: U.S. District Court for the Middle District of Florida, Tampa Division

Florida-based MarineMax, a company that sells boats and boating services, has been hit with a lawsuit from a New York customer accusing it of failing to secure his and many others’ sensitive personal information. 

According to the new lawsuit, a July data that could have been prevented by the company has compromised the personal identifiable information (PII) of more than 123,000 individuals.

MarineMax Failed To Protect Sensitive Customer Data, Lawsuit Claims

Harrison, New York resident Sandro Lomedico filed the proposed class action lawsuit against MarineMax, Inc. alleging the company was negligent with his and other consumer’s data. Lomedico alleges he entrusted his sensitive personal information—including his full name, Social Security number, and driver’s license number—to MarineMax when he purchased products and services from the company in 2021.

Lomedico says in the lawsuit he was diligent in safeguarding his personal information, storing documents securely, and never transmitting sensitive data over unencrypted sources, but despite these precautions, his PII was exposed in a data breach that he claims resulted from MarineMax’s lax data security practices. 

The breach has left him dealing with the fallout, including monitoring his financial accounts for suspicious activity and spending significant time mitigating the potential for identity theft, he alleges.

Details Of July Data Breach Remain Vague

According to the lawsuit, on July 16 MarineMax began notifying customers of a “Data Incident” in letters that Lomedico alleges failed “to inform, with any degree of specificity” on what had happened. The notice did not provide critical information such as the identity of the cybercriminals, the dates of the breach, the vulnerabilities exploited, and the measures being taken to prevent future breaches, he alleges.

The lawsuit argues that this lack of transparency severely hampers the ability of Lomedico and other consumers affected to protect themselves from further harm. According to the complaint, the compromised data has already been taken by cybercriminals and could be used to commit identity theft, open fraudulent accounts, and more.

Consumers Allege The Breach Was Preventable 

The lawsuit claims that the data breach was entirely preventable and resulted from MarineMax’s failure to use reasonable security measures, such as encrypting sensitive information or deleting data that was no longer needed.

As a retail company handling valuable personal data, MarineMax was allegedly an attractive target for cybercriminals and should have known so, the lawsuit contends. The lawsuit accuses the company of neglecting its duty to protect customers’ PII by not taking standard precautions to secure its data systems. 

Data Breaches On The Rise

The MarineMax breach is part of a trend of increasing data breaches across industries, which target consumers' personal information. Stuart Madnick, a professor at MIT Sloan and director of the Cybersecurity at MIT Sloan research consortium, told Wall Street Journal that despite global investments in cybersecurity reaching an estimated $188 billion in 2023 and expected to grow to $215 billion in 2024, data breaches continue to rise dramatically. 

In the U.S., reported data breaches hit a record 3,205 in 2023, marking a 78% increase from the previous year. Madnick says the rise in breaches comes down to the evolution of ransomware attacks. Traditional ransomware involved hackers locking up a company’s data and demanding a ransom for its release. 

Now, attackers not only lock up data but also steal it, threatening to expose sensitive information unless a ransom is paid. This new approach has made ransomware attacks more damaging and widespread, as even less skilled cybercriminals can now participate, leading to larger and more frequent data breaches.

Consumers Increasingly Hold Companies Accountable For Data Breaches

As the breaches increase, so too do consumers' legal actions against companies they say aren’t doing enough to protect their private information. Similar lawsuits have been filed against companies like HealthEquity, Coastal Orthopedics & Sports Medicine, and SouthCoast Medical Group, all accused of negligence in protecting sensitive customer information.

In one case, Coastal Orthopedics & Sports Medicine is defending a class action lawsuit over a breach that exposed the personal and medical information of over 200,000 patients. SouthCoast Medical Group faces accusations of negligence in a data breach that allegedly led to identity theft and fraud.

In the MarineMax data breach class action lawsuit, Lomedico wants to represent consumers from across the U.S. in his claims of negligence, breach of implied contract, and unjust enrichment. He’s seeking damages, injunctive relief, fees, and costs.

Case Details

• Lawsuit: Lomedico v. Marinemax, Inc.
• Case Number: 8:24-CV-01784-MSS-AEP
• Court: U.S. District Court for the Middle District of Florida, Tampa Division 

Plaintiffs' Attorneys

• Mariya Weekes (Milberg Coleman Bryson Phillips Grossman, PLLC)

Have you been affected by the MarineMax data breach or have concerns about your personal information being handled by businesses? Share your thoughts in the comments below.