Exactis Class Action Claims Data Breach Exposed Personal Info of 200M

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

A new class action lawsuit hit the data firm Exactis over an alleged data breach that exposed the personal information of more than 200 million people.

Lead plaintiff Kenneth Heretick claims in the Exactis data breach class action lawsuit that the company failed to properly protect sensitive data in violation of consumers’ privacy rights.

The plaintiff says that a gigantic amount of private information was left on an unsecure server easily accessed by hackers.

“Exactis is a leading compiler and aggregator of premium business and consumer data, boasting over 3.5 billion records of businesses and consumers alike,” alleges the Exactis class action lawsuit. “These records contain people’s phone numbers, home and email addresses, personal interests and preferences, ages and genders of their children, and other extremely detailed, personal information—exceeding as many as 400 data points on each business and consumer.”

The Exactis data breach class action lawsuit alleges that criminals can use this data to access consumers’ financial accounts, reset passwords, and change the details of their accounts.

The company, states the Exactis class action lawsuit, had a responsibility to protect this information. In fact, alleges the Exactis data breach class action lawsuit, it had even “bragged” about the amount of highly sensitive information it held about hundreds of millions of consumers.

“Except Exactis failed to employ even the most basic forms of security, and left this highly sensitive information of some 230 million consumers and 110 million businesses on a public server—bare, unprotected, and available to anyone to download,” alleges the Exactis data breach class action lawsuit. “Even worse, Exactis did not employ any form of encryption to protect this data.”

The Exactis data breach class action lawsuit points out that data security has been a high-profile issue for a number of years at this point, with major retailers and, recently, Experian, experiencing massive data breaches. Law makers have weighed in, pointing out the importance of data security in an increasingly connected world.

Stunningly, according to the Exactis data breach class action lawsuit, the data company was not even aware of the huge amount of private information sitting in public view. A notification from a separate security company, Night Lion Security, notified Exactis of the massive breach.

“Citizens from across the United States have suffered real and imminent harm as a direct consequence of Defendant’s conduct, which includes: (a) refusing to take adequate and reasonable measures to ensure its data systems, as well as the data stored therein, were protected; (b) refusing to take available steps to prevent the breach from happening; (c) failing to disclose to its customers the material facts that it did not have adequate computer systems and security practices to safeguard Personal Information; and (d) failing to provide timely and adequate notice of the data breach,” alleges the Exactis data breach class action lawsuit.

The plaintiff is seeking damages for himself and putative Class Members.

Heretick is represented by Adam Levitt, Amy Keller, Mark Abramowitz and Justin Hawal of DiCello Levitt & Casey LLC, John A. Yanchunis and Ryan J. McGee of Morgan & Morgan and Stuart A. Davidson and Christopher C. Gold of Robbins Geller Rudman & Dowd LLP.

The Exactis Data Breach Class Action Lawsuit is Kenneth Heretick v. Exactis LLC, Case No. 3:18-cv-00822, in the U.S. District Court for the Middle District of Florida.