VRBO’s Payment Processor Wants Data Breach Class Action Dismissed

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

VRBO, a vacation rental service, and various related service providers were hit with a proposed class action over an alleged data breach in September of last year. YapStone Inc., who processes payments for VRBO, argued the case should be dismissed in a motion filed this week.

Lead plaintiff Jonathan Koles alleged in his class action lawsuit that YapStone failed to protect VRBO customers’ personal information after YapStone informed users about a data breach that occurred between July 2014 and August 2015.

The plaintiff alleged that YapStone, a company that processes payments for VRBO and its subsidiary HomeAway Inc., did not adequately protect customers’ personal information, nor did the company notify customers about the exposure of their data and indicate what information had been potentially accessed by unauthorized users.

According to the VRBO class action, the plaintiff sought to represent New Jersey and California residents whose private data may have leaked as a result of YapStone’s alleged negligence in protecting that information. In addition to the negligence claim, the plaintiff says that Yapstone was unjustly enriched and violated both California and New Jersey state laws regarding unfair competition.

The class action was consolidated with a similar lawsuit filed by a California resident and brought to California federal court. This week, YapStone filed a motion asking a California federal judge to dismiss claims against it because it would set a “dangerous precedent” and that customers’ personally identifiable information was not exposed in the breach.

In its motion, YapStone argued that the data potentially leaked in the breach did not include “personally identifiable” information, but only “email and bank account information.” YapStone contended that since this information is regularly exposed when consumers use checks in a store, holding YapStone liable would fly in the face of a long-standing practice of allowing businesses to accept checks over-the-counter in real life.

“What plaintiffs are requesting of the court would lead to dangerous precedence,” argued YapSstone in its motion. “Where businesses and individuals are sued for the tradition of using checks over the counter as if they were cash. Checks with contact and bank account information are routinely exchanged over the counter and in the open, without any additional regard, as if cash was being exchanged.”

YapStone argued further in its motion to dismiss the class action lawsuit that the plaintiffs did not alleged that customers’ identities had been stolen or that customers had suffered any loss, like unauthorized transactions, as a result of the alleged breach.

According to YapStone, the plaintiffs needed to show that the company had leaked information that would allow a hacker to access their bank accounts, like a password or security code. Additionally, the account numbers would have needed to be released along with bank accounts, YapStone said.

“Even those courts who have given plaintiffs deference on standing required some minimal showing of injury-in-fact,” pointed out YapStone in its motion. “No court has ever held that disclosure of bank account numbers alone constitutes ‘certainly impending’ or ‘real and immediate’ injury.”

The plaintiffs are represented by Tina Wolfson, Robert Ahdoot, Theodore W. Maya and Bradley K. King of Ahdoot & Wolfson PC, Michael A. Galpern, Andrew P. Bell and James A. Barry of Locks Law Firm LLC, Shannon L. Hopkins, Shane Rowley, Nancy A. Kulesa and Andrea Clisura of Levi & Korsinsky LLP, and John H. Donboli and J.L. Sean Slattery of Del Mar Law Group LLP.

The VRBO YapStone Data Breach Class Action Lawsuit is In re YapStone Data Breach, Case No. 4:15-cv-04429, in the U.S. District Court for the Northern District of California.

UPDATE: On Jan. 20, 2017, Yapstone has agreed to provide Class Members with payments and services worth close to $4.9 million in order to resolve allegations brought from the data breach class action lawsuit.