Ally Bank data breach class action dismissed

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

Update:

• A New York federal judge dismissed a lawsuit over an Ally Bank data breach, saying plaintiff David De Medicis failed to show the data breach injured him.
• U.S. District Judge Nelson S. Roman called the arguments of injury speculative and said they relied on a chain-of-possibilities argument the Supreme Court rejected in prior cases.
• De Medicis’ amended complaint brings the same claims Judge Roman previously dismissed.
• Ally Bank provided evidence the data breach did not lead to a series of customer credential attacks.

Ally Data Breach Class Action Lawsuit Overview:

• Who: Plaintiff David De Medicis is suing Ally Bank over an alleged data breach.
• Why: The lawsuit stems from a notification letter sent to customers on June 11 disclosing to customers that a programming code error associated with Ally’s website “inadvertently” revealed Ally’s customers’ usernames and passwords to Ally’s business partners.
• Where: The lawsuit was filed in a New York federal court on behalf of anyone in the U.S. who was affected by the data breach.

(Aug. 16, 2021)

Ally Bank orchestrated its own data breach by programming its website portal to reveal customer usernames and passwords to third parties, a new nationwide class action lawsuit alleges.

Plaintiff David De Medicis filed the class action complaint against Ally Bank and Ally Financial Inc. Thursday in a New York federal court, alleging negligence and breach of implied contract. 

The class action lawsuit says a June 11 data breach notification letter sent to customers disclosed that a programming code error associated with Ally’s website “inadvertently” revealed Ally’s customers’ usernames and passwords to third parties with whom Ally had business relationships.

The letter went on to inform customers of steps they could take to mitigate the now-increased threat of identity theft, the class action says. 

The plaintiff is bringing the class action on behalf of any United States resident whose private information was compromised in the breach.

He says it’s notable that the data breach did not result from a sophisticated attack perpetrated by cyber criminals or state sponsored hackers, but instead “was entirely Ally’s doing.” 

“It’s difficult to imagine anything could be more central to data security at an online bank like Ally than protecting the very customer usernames and passwords that provide access to the entirety of customers’ account information and assets,” De Medicis says.

“Not only did Ally negligently program its website to reveal its customers’ usernames and passwords, Ally also failed to adequately test or monitor the security of its website.”

He says, had Ally undertaken reasonable steps to test or monitor the security of its website, it would have immediately discovered and stopped revealing those usernames and passwords to third parties. 

After the bank discovered the breach, Ally delayed notifying its customers for almost two months, De Medicis says.

He’s suing for negligence, breach of implied contract and violation of the Virginia Personal Information Breach Notification Act. He’s seeking certification of the class action, damages, fees, costs and a jury trial.

Last month, a class action lawsuit alleging that Ally Financial violates the Telephone Consumer Protection Act by calling family members of those in debt without their consent, was tossed out by a Michigan federal court judge.

That news came after Ally Financial Inc. agreed to a settlement worth $787.5 million benefiting consumers who received notices from Ally that failed to comply with state requirements.

What do you think of Ally’s actions around the data breach? Let us know in the comments! 

The plaintiff is represented by Melissa R. Emert and Gary S. Graifman of Kantrowitz, Goldhamer & Graifman, P.C.

The Ally Data Breach Class Action Lawsuit is De Medicis et al., v. Ally Bank et al., Case No. 7:21-cv-06799, in the U.S. District Court Southern District of New York.

Read About More Class Action Lawsuits & Class Action Settlements:

• 73M AT&T customers’ data leaked online
• WellNow class action alleges urgent care data breach harmed patients
• Change Healthcare faces multiple class actions over data breach
• Roku data breach impacts 15,000+ customers