Neiman Marcus Class Action Lawsuit: Data Breach Exposes Customer Information

Case Overview: A class action lawsuit has been filed against Neiman Marcus and its cloud storage vendor Snowflake, alleging negligence in a data breach that exposed millions of customers' personal information.

Consumers Affected: Individuals in the United States whose data was acquired in the Neiman Marcus data breach reported in June 2024.

Court: U.S. District Court for the Southern District of Florida.

Luxury retailer Neiman Marcus and its cloud storage vendor Snowflake are facing a class action lawsuit alleging they were negligent with customer data, leading to a major data breach. 

Florida resident Marc Reichbart filed the class action complaint against the companies on August 1 in a Florida federal court, alleging they violated state and federal consumer protection laws.

The breach, which happened in May, led to consumer data being auctioned online by hackers for $150,000, the lawsuit states.

Neiman Marcus failed to implement basic security measures, lawsuit claims

Reichbart says that Neiman Marcus, known for its high-end brands Neiman Marcus and Bergdorf Goodman, failed to secure the personally identifiable information of millions of customers. 

The exposed data includes names, emails, addresses, phone numbers, dates of birth, Social Security numbers, credit card details, transaction data, and employee identification numbers. 

Part of a larger hacking campaign, the breach reportedly affected hundreds of Snowflake’s clients, spilling the personal details of about 31 million customers overall. 

Reichbart alleges that Neiman Marcus required customers to provide their PII during transactions, promising to keep it safe. However, the company allegedly dropped the ball by failing to implement multi-factor authentication (MFA) for their cloud database, a crucial security measure.

Stolen data allegedly sold on the dark web after major breach

The breach came to light on May 20 when cybercriminals extracted the data, the lawsuit alleges. 

The hacker group ShinyHunters, notorious for several high-profile breaches, took credit, Reichbart says. 

By June 2024, Neiman Marcus admitted to the breach, revealing that unauthorized access to their Snowflake-managed cloud database had occurred. This admission followed a threat actor named "Sp1d3r" advertising the stolen data for $150,000 on a hacking forum, the lawsuit states.

Reichbart says he received a data breach notification from Neiman Marcus in July 2024, over a month after the breach was discovered. Since then, he’s noticed a spike in spam calls, texts, and emails, indicating his data was compromised. 

In the Neiman Marcus data breach class action lawsuit, Reichbart is seeking to represent anyone in the United States whose data was acquired in the breach reported in June 2024. He is suing for negligence, breach of implied contract, unjust enrichment, and invasion of privacy, demanding class certification, damages, fees, costs, and a jury trial.

Meanwhile, last month, Oracle agreed to a $115 million settlement in a class action lawsuit accusing the company of illegally collecting and selling consumer data to third parties.

Case Details

• Lawsuit: Reichbart v. Neiman Marcus Group LLC et al
• Case Number: 0:24-cv-61389-XXXX 
• Court: U.S. District Court for the Southern District of Florida

Plaintiffs' Attorneys

• Andrew J. Shamis (Shamis Gentile) 
• Paul J. Doolittle (Poulin | Willey | Anastopoulo)

Have you been affected by the Neiman Marcus data breach? Share your experiences in the comments below.