Wells Fargo faces class action lawsuit over data breach

A Wells Fargo customer filed a class action lawsuit against the financial giant after disclosing a significant personal data breach last month. The lawsuit, filed by Tamra Bacon in the U.S. District Court for California’s Northern District, accuses the bank of negligence, breach of fiduciary duty, and failure to protect sensitive customer information.

Bacon alleges that Wells Fargo did not adequately secure customers’ personally identifiable information (PII), which included full names, addresses, phone numbers, email addresses, birth dates, Social Security numbers, and details of driver’s licenses, bank accounts, brokerage accounts, and credit cards.

The breach was discovered in July and reportedly took place between May 2022 and March 2023, when a former employee accessed and, in some cases, misused customer information for fraudulent activities. Wells Fargo informed customers of the breach through a September letter submitted to the Vermont Attorney General’s office. However, the lawsuit claims the bank delayed notifying customers for nearly three months after uncovering the breach.

Bacon’s complaint highlights that the notification failed to provide sufficient details about how the breach occurred, what steps Wells Fargo has taken to prevent future incidents, and where the exposed information is currently being stored. The lawsuit contends that affected customers “remain in the dark” about critical information, such as the malware used in the attack and the specific measures taken to secure their PII.

In its communication with customers, Wells Fargo assured customers that it had taken the incident seriously and had been working to notify and assist customers. The bank offers identity theft protection services and actively monitors accounts for suspicious activity. Wells Fargo emphasized its ongoing efforts to enhance security protocols and reduce the likelihood of future breaches. Bacon is seeking injunctive relief, damages, and class certification for potentially thousands of customers impacted by what she describes as a “preventable hack.”