Circle K class action alleges data breach exposed employee info

Circle K class action lawsuit overview:

• Who: A former Circle K employee is suing the company.
• Why: The plaintiff alleges Circle K failed to protect her and other employees’ personally identifiable information in a data breach.
• Where: The Circle K class action lawsuit was filed in a Georgia federal court.

A former Circle K employee is suing the company, claiming it failed to protect her and other employees’ personally identifiable information in a data breach.

Plaintiff Brittany Canup filed the class action complaint against Gas Express LLC, doing business as Circle K, on Jan. 29 in a Georgia federal court, alleging negligence, breach of implied contract and unjust enrichment.

Canup claims in the lawsuit that Circle K failed to implement reasonable and industry-standard data security practices to properly secure, safeguard and adequately destroy her and other class members’ sensitive personal identifiable information that it had acquired and stored for its business purposes.

The lawsuit alleges that as a result, a targeted cyberattack occurred on May 20, 2024, compromising Circle K’s network and allegedly exposing the personal identifiable information of Canup and other individuals.

Circle K began sending notice letters to affected individuals on Jan. 13, 2025, the lawsuit says.

The data breach exposed personal information, including names, driver’s license numbers and Social Security numbers, the Circle K class action lawsuit alleges.

Canup argues Circle K failed to implement adequate and reasonable cybersecurity procedures and protocols necessary to protect individuals’ personal identifiable information.

Circle K data breach left victims vulnerable to identity theft, lawsuit alleges

Canup claims Circle K failed to design, implement, monitor and maintain reasonable network safeguards, data retention policies and staff training on data security.

She also alleges Circle K failed to encrypt or adequately encrypt the personal identifiable information and failed to recognize or detect the network compromise in a timely manner to mitigate the harm.

As a result, Canup and other class members are now at risk of fraud and identity theft, the lawsuit says. They must closely monitor their financial accounts for years to guard against identity theft, incurring costs and loss of time in the process, Canup alleges.

She seeks to represent anyone in the United States whose personal identifiable information was compromised in the data breach and received a notice letter from the company in January 2025.

Canup is suing for negligence and negligence per se, breach of implied contract and unjust enrichment and is seeking certification of the class action, compensatory damages, reimbursement of out-of-pocket costs and injunctive relief to improve Circle K’s data security systems.

In 2023, Polar Corp. sued Circle K alleging the convenience store company was violating a settlement deal made over the use of the Polar Pop trademark.

What do you think of the allegations in this Circle K data breach lawsuit? Let us know in the comments.

The plaintiff is represented by J. Cameron Tribble of Barnes Law Group LLC and Jeff Ostrow of Kopelowitz Ostrow P.A.

The Circle K data breach class action lawsuit is Brittany Canup v. Gas Express LLC, Case No. 1:25-cv-00396, in the U.S. District Court for the Northern District of Georgia.

Read About More Class Action Lawsuits & Class Action Settlements:

• DeepSeek data exposed online, Wiz says
• $45M MGM settlement resolves data breach class actions
• Marriott, Hilton hotels exposed in Otelier data breach
• Consumers hit Norwex, PowerSchool with data breach class actions