Ally Financial faces class action lawsuit following cyberattack and data breach

US’s leading digital financial services company Ally Financial Inc. and its subsidiary Ally Bank are facing a proposed class action lawsuit following a cyberattack and data breach that compromised sensitive customer information.

 

Filed on September 7, 2024, in a North Carolina federal court, the lawsuit stems from a cyberattack that occurred at the end of August, exposing personal data such as Social Security numbers, addresses, and driver’s license information. The plaintiff, Robert Hamilton, and class members claim Ally Financial was negligent in implementing sufficient security measures to safeguard this data.

 

The lawsuit accuses Ally Financial of failing to follow “reasonable industry standard security practices,” resulting in the breach. The company allegedly became aware of the breach on August 1, 2024, but did not notify affected customers until August 30, prompting accusations of delayed disclosure.

 

The compromised information, accessed through a vendor’s system, is believed to be highly valuable on the dark web, with prices for personally identifiable information (PII) like Social Security numbers exceeding those of credit card details.

 

The plaintiffs seek damages on the grounds of negligence, breach of implied contract, and unjust enrichment. They are calling for a trial by jury and demand that Ally Financial take steps to prevent further misuse of the stolen information.

 

The case is part of a broader trend of increasing cyberattacks on financial institutions. Data breaches surged in 2023, with 3,205 incidents—up 78% from the previous year. The growing threat of cybercrime has raised alarms about the need for enhanced cybersecurity measures in the financial sector.