Fidelity faces class-action lawsuit over August data breach

Two customers have filed a proposed class-action lawsuit against Fidelity Investments following a data breach in August that exposed the personal information of nearly 77,100 clients. The lawsuit, submitted last week in the U.S. District Court in Massachusetts, accuses the Boston-based asset manager of negligence and invasion of privacy, alleging a failure to adequately safeguard client data.

The plaintiffs, Yaakov and Seth Gluck from Spring Valley, New York, claim that the breach compromised sensitive data, including Social Security numbers, financial details, names, addresses, and phone numbers. According to the complaint, the breach has put affected individuals at risk for identity theft and other financial harm.

The lawsuit criticizes Fidelity for not taking sufficient measures to prevent the breach, detect it promptly, or notify customers promptly. The Glucks argue that Fidelity’s security protocols were inadequate and that the company failed to honor its commitments to protect client information. They seek damages and injunctive relief on behalf of all impacted clients.

The data breach occurred between August 17 and 19, when a hacker exploited two newly established accounts to access personal information. Fidelity stated it identified the breach on August 19 and immediately revoked the unauthorized access. The company launched an internal investigation with the help of external security experts but has not disclosed the exact method the hacker used to access the data.

In response to the incident, Fidelity has offered affected clients two years of free credit monitoring and identity restoration services through TransUnion. Despite these measures, the plaintiffs allege that Fidelity’s delayed notification and response have left customers vulnerable.

The company has downplayed the breach, noting that fewer than 0.15% of its customers were affected, and has maintained no evidence of misuse of the stolen data. However, the lawsuit underscores growing concerns over cybersecurity practices in the financial services industry, where breaches can have far-reaching consequences.

Fidelity Investments, one of the world’s largest asset managers, oversees $14.1 trillion in assets under administration and employs over 75,000 associates globally. The company has yet to issue a detailed public response to the lawsuit, and a Fidelity representative did not respond to a request for comment.