Saks Class Action Lawsuit Filed Over Saks OFF 5TH Data Breach

Saks & Company LLC d/b/a Saks OFF 5TH has been hit with a data breach class action lawsuit accusing it of failing to safeguard customers’ information, leaving it vulnerable to hackers.

According to the Saks class action lawsuit, which was filed last week by plaintiff Alexandria Rudolph in California federal court, the “notorious” hacking group Fin7 announced on March 28 that it had successfully hacked an unnamed corporation and released the information of more than 5 million credit and debit cards.

On April 1, a cyber threat research group called Gemini Advisory confirmed the stolen customer data belonged to Hudson’s Bay Company (HBC), the parent company of Saks Fifth Avenue, Saks OFF 5TH and Lord & Taylor.

The same day, HBC confirmed that its stores had been affected by a data breach. Later, it was reportedly confirmed that the Saks data breach involved point of sale systems at HBC stores in North America from about July 1, 2017 through March 31, 2018.

“The private Customer Data obtained from the data breach was compromised due to Saks’ acts and omissions and its failure to properly protect the Customer Data,” the Saks data breach class action lawsuit says.

Rudolph alleges that, not only did Saks fail to prevent the data breach, it also failed to detect the data breach for more than 11 months. The retail company did not disclose the Saks data breach until after Gemini Advisory made a public statement about it, the Saks class action lawsuit says.

Saks should have been aware of the vulnerability of point of sale systems to malware because the issue is well-known in the retail industry, Rudolph alleges. Further, nearly every major data breach in the retail industry in the last five years has been caused by malware installed on point of sales system. As a result, data security experts warned retailers that their point of sale systems are being targeted by hackers, the Saks class action lawsuit says.

“Unfortunately, Saks’ profit-driven decisions to ignore these warnings led to the damage upon which this case is based,” the Saks class action lawsuit states. “Had Saks detected the breach earlier, less data would have been stolen and customers would have been able to take earlier action to mitigate their damages.”

The Saks data breach has exposed customer data to criminals for potential misuse such as unauthorized charges on credit and debit cards, theft of financial information, loss of use of credit and debit card accounts, lack of access to account funds, costs associated with attempts to deal with actual and possible consequences of the data breach, and costs of purchasing credit monitoring and identity theft protection services.

Rudolph says she was notified by Bank of America on May 18 that there was suspected fraudulent activity on the debit card that she used at a Saks OFF 5TH retail location in November 2017.

According to the Saks class action lawsuit, Rudolph would not have used her debit card if she had known the retailer failed to adequately safeguard its customer data from theft.

Rudolph seeks to represent herself and a proposed Class of U.S. consumers who made a debit or credit card purchase at any affected Saks OFF 5TH store between July 1, 2017 and March 31, 2018.

The Saks data breach class action lawsuit asserts claims for violations of breach of implied contract, negligence, negligence per se, unjust enrichment, declaratory judgment, and violation of California’s Unfair Competition Law.

Rudolph is represented by Benjamin Heikali and Joshua Nassir of Faruqi & Faruqi LLP.

The Saks Data Breach Class Action Lawsuit is Alexandria Rudolph v. Saks & Company LLC, Case No. 2:18-cv-05107, in the U.S. District Court for the Central District of California.