Whole Foods Class Action Filed After Data Breach

Whole Foods has been hit with a class action lawsuit alleging violations of the Fair Credit Reporting Act and Nevada state law after a data breach exposed the credit and debit card information of its customers.

Whole Foods recently disclosed that its taproom and restaurant service payment system was hacked, although the grocery payment system appeared to be unaffected.

Lead plaintiff Lynn Marie Cousino alleges in her class action lawsuit that Whole Foods collected personally identifiable information from its customers in violation of the Fair Credit Reporting Act (FCRA).

The information exposed in the data breach includes names, credit card numbers, expirations dates, and security codes, states the lawsuit. The plaintiff claims that she only became aware of the breach when news agencies began reporting on the hack last week. She fears that the information Whole Foods collected from her when she shopped at the market this summer is highly likely to be implicated in the breach.

According to the Whole Foods class action lawsuit, the plaintiff and other Whole Foods customers will have to go through the hassle of canceling the credit cards and other payment methods they used at Whole Foods.

“The FCRA protects consumers through a tightly wound set of procedural protections from the material risk of harms that otherwise follow from the compromise of a consumer’s sensitive personal information,” alleges Cousino. “Through these protections, Congress recognized a consumer’s substantive right to protection from damage to reputation, shame, mortification, and emotional distress that naturally follows from the compromise of a person’s identity.”

The class action lawsuit claims Whole Foods is subject to FCRA regulations because it is a consumer reporting agency under the law. Whole Foods had a duty to protect the personally identifiable information of the plaintiff and other customers from the alleged breach, says the complaint; however, Whole Foods failed to follow industry standards when it came to the payment systems in its restaurants and taprooms.

Cousino also alleges that had she and other consumers known that Whole Foods failed to properly protect consumer’s personally identifiable information (PII), they would not have shopped there or, at a minimum, would have paid less for the goods and services they received.

“Moreover, there is a high likelihood that significant identity theft and fraud has not yet been discovered or reported, and that Plaintiff and Class members’ PII will be offered for sale or actually sold in ‘dark web’ marketplaces,” the lawsuit states. “This will result in ongoing harm to Plaintiff and members of the Class as data thieves invariably seek to utilize the PII, or seek to re-sell it. Thus, Whole Foods’s wrongful disclosure of Plaintiff and Class members’ PII placed them in an imminent, immediate, and continuing risk of harm for identity theft and identity fraud.”

The plaintiff seeks to represent a nationwide Class of consumers whose private, personal information was exposed by Whole Foods’ allegedly inadequately secured payment system, along with a Nevada subclass.

Cousino is seeking damages as well as an order declaring that Whole Foods failed to protect consumer information and requiring the grocer to update its security measures.

The plaintiff is represented by David H. Krieger of Haines & Krieger LLC, Matthew I. Knepper and Miles N. Clark of Knepper & Clark LLC, and Sean N. Payne of Payne Law Firm LLC.

The Whole Foods Data Breach Class Action Lawsuit is Cousino v. Whole Foods Market Inc., Case No. 2:17-cv-02531-JAD-PAL, in the U.S. District Court for the District of Nevada.