Forever 21 Class Action Says Retailer Failed to Safeguard Customer Data

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

Two plaintiffs have filed a class action lawsuit against Forever 21 Retail Inc. and Forever 21 Inc. over allegations that the clothing retailer failed to safeguard customers’ payment card data and other personally identifiable information, leaving them vulnerable to identity theft following a data breach.

Plaintiffs Jowharah Hameed-Bolden and Ali Conrad O’Brien filed the Forever 21 data breach class action lawsuit earlier this week in California federal court.

“In the last few years, retailers such as Target, Saks Fifth Avenue, Home Depot, Kmart, Neiman Marcus, and Brooks Brothers have experienced a stream of attacks on their data security,” the Forever 21 class action lawsuit says.

“Implementing measures to prevent those attacks, as well as quickly identifying them is a normal, expected part of the business — except in Forever 21’s case. Inexplicably turning a blind eye to this key aspect of its business, Forever 21 did not just ignore security weaknesses, it failed to set up the systems necessary to even detect them.”

Hameed-Bolden and O’Brien allege Forever 21 implemented encryption technology in 2015, but it was not turned on in some of the retailers’ point of sale devices. According to the data breach class action lawsuit, this lack of encryption created a vulnerability that allowed malware to be installed and led to payment card data being compromised.

Not only did Forever 21 fail to prevent the data breach, the retailer failed to detect the data breach, which was ongoing for seven months, according to the Forever 21 class action lawsuit. Forever 21 only learned about the data breach from a third party, the plaintiffs claim.

According to the Forever 21 class action lawsuit, the Forever 21 data breach has caused customers to experience unauthorized charges on their credit and debit card accounts; theft of personal and financial information; loss of use and access to their account funds; costs associated with time spent and loss of productivity in attempting to mitigate future consequences of the data breach; costs associated with identity theft detection and prevention; and other losses.

Hameed-Bolden and O’Brien say they would not have used their payment card to make purchases at Forever 21 if they had known the company lacked adequate data security practices to protect their customer data from theft.

The plaintiffs filed the data breach class action lawsuit on behalf of themselves and a proposed Class of U.S. residents who made a credit or debit card purchase from any affected Forever 21 location from April 3, 2017 through Nov. 18, 2017.

Hameed-Bolden and O’Brien are represented by Kevin F. Ruf and Brian P. Murray of Glancy Prongay & Murray LLP; John A. Yanchunis and Marisa Glassman of Morgan & Morgan Complex Litigation Group; Paul C. Whalen of Law Office of Paul C. Whalen PC; Jean Sutton Martin of Law Office of Jean Sutton Martin PLLC; and Jasper D. Ward IV of Jones Ward PLC.

The Forever 21 Data Breach Class Action Lawsuit is Jowharah Hameed-Bolden, et al. v. Forever 21 Retail Inc., et al., Case No. 2:18-cv-03019-SJO-JPR, in the U.S. District Court for the Central District of California.