Stellantis hit with class action over alleged data breach affecting Chrysler customers

Stellantis class action lawsuit overview:

• Who: Two consumers filed a class action lawsuit against FCA US LLC, doing business as Stellantis North America.
• Why: The plaintiffs allege FCA, which operates automaker Chrysler, failed to implement reasonable data security procedures and practices, resulting in a data breach.
• Where: The Stellantis class action lawsuit was filed in Michigan federal court.

A new class action lawsuit claims Chrysler failed to maintain reasonable data security, allowing hackers to access Stellantis-related systems and access customer information.

Plaintiffs Loria Spadafore and Thomas Spadafore filed the class action complaint against FCA US on Jan. 21 in Michigan federal court, alleging violations of state and federal consumer laws.

The class action complaint alleges that in September 2025, unauthorized third parties infiltrated the databases of FCA’s parent company Stellantis, gaining access to customer information.

“Despite such knowledge, Defendant failed to implement and maintain reasonable and appropriate data privacy and security measures to protect Plaintiffs’ and Class Members’ [personally identifiable information] from cyberattacks that Defendant should have anticipated and guarded against,” the Stellantis class action lawsuit states.

The plaintiffs allege that around Dec. 25, 2025, the ransomware group Everest gained access to FCA’s systems and exfiltrated approximately 1 terabyte of sensitive personal information, including names, phone numbers, addresses, dates of birth and Social Security numbers.

Stellantis data breach allegedly exposed customers to identity theft, fraud

The class action lawsuit says Everest threatened to publish the data unless a ransom was paid, but Stellantis refused, and Everest published the information on Jan. 4, 2026.

The plaintiffs claim FCA US and Stellantis failed to implement reasonable security measures, such as encryption, to protect the data and failed to delete it when it was no longer needed.

They say FCA US also failed to comply with industry standards and best practices for data security, such as using strong passwords, multi-factor authentication and backup data.

As a result, the plaintiffs say they and other customers have suffered a substantially increased risk of identity theft and fraud as a result of the Stellantis data breach, justifying expenditures for protective and remedial services.

They seek to represent anyone in the United States whose personal information was accessed by and disclosed to unauthorized persons as a result of the Stellantis data breach, and are seeking certification of the class action, damages, fees, costs and a jury trial.

The plaintiffs are suing for negligence, breach of fiduciary duty, breach of implied contract, unjust enrichment and violations of the Illinois Consumer Fraud and Deceptive Business Practices Act.

What do you think of the allegations made in this Chrysler class action lawsuit? Let us know in the comments.

The plaintiffs are represented by E. Powell Miller and Gregory A. Mitchell of The Miller Law Firm P.C. and Bradley K. King of Ahdoot & Wolfson P.C.

The Stellantis class action lawsuit is Spadafore, et al. v. FCA US LLC, Case No. 2:26-cv-10214-TGB-DRG, in the U.S. District Court for the Eastern District of Michigan.

Read About More Class Action Lawsuits & Class Action Settlements:

• Labcorp settles class action alleging it sold data without consent
• Academy Sports recalls Magellan Odyssey Rocker Chairs due to hazardous defect
• TikTok settlement comes in days before social media lawsuit trial begins
• Amazon class action settlement to pay $309M to customers allegedly shortchanged on refunds