P.F. Chang’s Didn’t Protect Customer Data, Class Action Lawsuit Says

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

P.F. Chang’s China Bistro Inc. failed to take adequate measures to protect their customers’ credit and debit card data from theft, according to a class action lawsuit filed Wednesday in Illinois federal court.

On June 12, 2014, P.F. Chang’s disclosed a data breach that compromised customers’ credit card and debit card data. While the restaurant company claimed to have learned of the data breach just days before the announcement, the class action lawsuit alleges that the breach likely began in September 2013 and may have affected as many as 7 million credit and debit card accounts.

“The Security Breach was caused by P.F. Chang’s knowing violation of its obligations to abide by best practices and industry standards in protecting customers’ personal information,” the P.F. Chang’s class action lawsuit says. “P.F. Chang’s failed to comply with security standards and allowed their customers’ financial information to be compromised, all in an effort to save money by cutting corners on security measures that could have prevented or mitigated the Security Breach that occurred.”

Illinois resident John Lewert filed the class action lawsuit, claiming that he used his debit card at a P.F. Chang’s restaurant in April 2014. He alleges that his sensitive financial information was exposed as a result of PF Chang’s lax security measures. Lewert points to a report indicating that credit and debit card information stolen during the P.F. Chang’s data breach were being sold on the black market.

The P.F. Chang’s data breach lawsuit also alleges that the restaurant company failed to disclose the extent of the data breach and failed to notify the affected customers in a timely manner. By failing to notify the affected consumers, the class action lawsuit alleges P.F. Chang’s prevented them from protecting themselves from the data breach.

“According to the Federal Trade Commission (FTC), identity theft wreaks havoc on consumers’ finances, credit history and reputation and can take time, money and patience to resolve,” the P.F. Chang’s class action lawsuit says. “Identity thieves use stolen personal information for a variety of crimes, including credit card fraud, phone or utilities fraud, and bank/finance fraud.”

Lewert alleges that P.F. Chang’s customers were injured by the data breach because they suffered monetary losses associated with unauthorized bank account withdrawals and the costs associated with identity theft and the prevention of identity theft. He seeks to certify a class of U.S. residents who made an in-store purchase at a P.F. Chang’s restaurant with a debit or credit card at any time between Sept. 18, 2013 and June 10, 2014.

The P.F. Chang’s data breach class action lawsuit asserts claims for breach of implied contract and violation of the Illinois Consumer Fraud and Deceptive Business Practices Act. Lewert seeks injunctive relief, declaratory relief, monetary damages, statutory damages and all other relief deemed appropriate.

P.F. Chang’s is not the first major company to be hit with a class action lawsuit in the wake of a data breach. In January, Neiman Marcus Group Ltd. LLC and Michaels Stores Inc. were accused of failing to take reasonable precautions to safeguard their customers’ credit and debit card data. In April, dozens of class action lawsuits filed against Target following a massive data breach that compromised the personal information of as many as 70 million customers were consolidated in Minnesota federal court.

Lewert is represented by Joseph J. Siprut, Gregg M. Barbakoff and Gregory W. Jones of Siprut PC.

The P.F. Chang’s Data Breach Class Action Lawsuit is John Lewert v. P.F. Chang’s China Bistro Inc., Case No. 1:14-cv-04787, in the U.S. District Court for the Northern District of Illinois.

UPDATE: The P.F. Chang’s data breach class action lawsuit was dismissed on Dec. 10, 2014. The plaintiffs immediately appealed the decision to the 7th U.S. Circuit Court of Appeals.

UPDATE 2: On Apr. 14, 2016, the Seventh Circuit Court revived a previously-dismissed proposed class action lawsuit against P.F. Chang’s China Bistro Inc. that was filed over the restaurant’s data breach.

UPDATE 3: On Jan. 25, 2017, Lewert and Kosner asked the court to deny P.F. Chang’s motion to dismiss the data breach class action lawsuit. The plaintiffs allege P.F. Chang’s failed to respond to its requests for discovery.