Capital One Data Breach Class Action Lawsuit Says Millions Were Impacted

Capital One and Amazon’s failure to adequately safeguard credit card holders’ personal data allowed it to be compromised in a 2019 data breach, according to a class action lawsuit filed in the Superior Court of Québec.

Not only did the defendants fail to safeguard against the Capital One credit card data breach, they also failed to provide timely notification to those who were affected, the Capital One data breach class action lawsuit says. The data theft reportedly occurred on March 22 and 23, 2019 and was initially discovered on July 17, 2019. However, the data breach was not disclosed to the public until July 29, 2019.

“This case involves one of the biggest data security breaches in history,” the Capital One data breach class action lawsuit states.

Capital One has collected massive amounts of data on its customers since 2005. To store and mine this data, it had created a massive data centre that it would spend significant amounts of money to upgrade, maintain and secure.

“Class Members entrusted their most sensitive data — data that could be used by a miscreant to assume those customers’ identities — to a bank and cloud computing company based on their reasonable belief that it would be safe and secure,” the Capital One data breach class action lawsuit alleges.

“Capital One and Amazon thoroughly monetized (and continue to monetize) sensitive Capital One Customer data, mining it for every edge and insight about their behaviours.”

Capital One decided the cost of maintaining a data centre was too high and decided to utilize Amazon’s AWS public cloud to store and process customer data in 2015. This system allowed Capital One to buy only as much computing power and storage as it needed. It also allowed the credit card company to take advantage of Amazon’s machine learning tools and data scientists.

“Unfortunately, there were serious problems with using AWS to mine customer data,” the data breach class action lawsuit says. “Most importantly, the machine learning models required massive amounts of historical data and if the data was insufficient, the models would not be accurate.”

According to the data breach class action lawsuit, Capital One created massive repositories of customer data that included “data retained far in excess of customer expectations.”

Unlike other large financial institutions that prioritized the security of customer data, Capital One elected to provide customers’ sensitive data to a public cloud provider. At the same time, Amazon was looking for a large financial institution to sign on to the AWS ecosystem to signal to other financial institutions that it was safe to put their data in the public cloud.

Because it was widely known that AWS suffered from a security flaw, Capital One created software that it jointly marketed with Amazon to misleadingly reassure customers, regulators and the public that the data would be protected. However, this software reportedly failed to safeguard the data as promised.

The data breach reportedly affects information that was collected at the time individuals and small businesses applied for a Capital One credit card between 2005 and 2019. The information compromised in the data breach may include: names, addresses, postal codes, phone numbers, email addresses, birthdates, credit card application data, and other customer data.

According to the data breach class action lawsuit, Capital One and Amazon together “orchestrated a massive migration of highly-sensitive data” to a public AWS cloud from Capital One’s private cloud. Together, Amazon and Capital One allegedly misled customers, regulators and members of the public by claiming the data was being protected. However, the Capital One data breach class action lawsuit says these assurances are “indisputably false and/or misleading.”

Capital One credit card holders and applicants who reside in Quebec and whose personal information was compromised in the Capital One credit card data breach incident that occurred on March 22-23, 2019 are included as potential Class Members of this data breach class action lawsuit.

Approximately 100 million U.S. residents and 6 million Canadians were likely impacted by the Capital One credit card data breach. Additionally, about 1 million social insurance numbers were compromised.

The Capital One data breach class action lawsuit asks a judge to order the defendants to implement safeguards to prevent and detect unauthorized access to private information, and offer compensatory and punitive damages to Class Members.

A similar Capital One credit card data breach class action lawsuit has been filed in Calgary.

Do you have a Capital One credit card? Are you worried about your personal information being exposed in this data breach? Tell us your thoughts in the comment section below! 

The plaintiffs are represented by Jeff Orenstein of Consumer Law Group Inc.

The Capital One Data Breach Class Action Lawsuit is M. Royer, et al. v. Capital One Bank (Canada Branch), et al., Case No. 500-06-001010-194, in the Superior Court of Québec, Canada. 

Read More Lawsuit & Settlement News:

Fitness Depot Data Breach Class Action Lawsuit Claims Thousands Were Impacted

Airbnb Service Fees Class Action Settlement

Glyphosate Regulations in Canada

RCMP Discrimination Class Action Lawsuit Expected to Expand