Claire’s Class Action Lawsuit Filed Over Data Breach

Claire’s was recently hit with a class action lawsuit from consumers who say they were not told of a data breach that occurred earlier this year until it was too late.

Plaintiffs Delilah Parker and Kelvin Holmes claim they were notified of the Claire’s data breach in early July. However, the store had allegedly been aware of the data breach in early June.

Despite this fact, the retailer reportedly waited nearly a month to inform their customers that their sensitive data may have been compromised. The plaintiffs argue that this time could have been valuable in fighting against fraud and identity theft.

From April 7 to June 12, hackers allegedly “scraped” consumer info from Claire’s and Icing websites – gathering sensitive information. Data such as addresses, email addresses, telephone numbers, payment card numbers, CVV security codes, and payment card expiration dates were reportedly stolen by hackers during this time period.

According to the Claire’s data breach class action lawsuit, the breach was only discovered by the retailer when a third-party contacted them on June 11 and told them that their websites had been hacked through an added data scraping code. The retailer later said that further investigation showed that the “added code was capable of obtaining information entered by customers during the checkout process and sending it out of the Claire’s system.”

After being informed of the issue, Claire’s reportedly hired an outside security firm to investigate. Shortly after, the data breach was reported by the press to which Claire’s responded in a formal statement.

“On Friday, we identified an issue related to our e-commerce platform and took immediate action to investigate and address it. Our investigation identified the unauthorized insertion of code to our e-commerce platform designed to obtain payment card data entered by customers during the checkout process,” Claire’s said in a June statement, according to Bank Info Security.

“We removed that code and have taken additional measures to reinforce the security of our platform. We regret that this occurred and apologize to our customers for any inconvenience caused.”

However, despite enlisting the help of private investigators and even giving statements to the press, Claire’s allegedly failed to directly inform consumers about the breach until July 7 when they starting the process of notifying affected customers and state attorneys general.

If the thousands of affected consumers – including the plaintiffs – had received prompt notice of the data breach, they would have reportedly been able to take steps to protect themselves and monitor their credit earlier for signs of fraud and identity theft.

The plaintiffs say they both received notice of the data breach around this date. The class action lawsuit claims the plaintiffs made purchases on Claire’s website in May and were informed that their debit card information had been exposed during the data breach. However, because they were denied valuable time to combat the data breach, the plaintiffs have allegedly suffered from fraud.

Parker says that she was subject to more than $700 in fraudulent charges following the data breach. Although her bank acknowledged these charges as fraudulent, it reportedly took significant time for these expenses to be reimbursed.

Although Holmes has not suffered from fraudulent charges, he says that he has been inundated with phishing emails and other suspicious communications as a result of his compromised personal data.

The plaintiffs argue that Claire’s should have been aware of the risks associated with data scraping hackers. The prominence of these hackers has reportedly been known since 2010. However, despite being aware of the risk, Claire’s allegedly failed to protect consumer data.

Holmes and Parker seek to represent a Class of consumers whose personal information was compromised in the data breach announced by Claire’s on July 7. The plaintiffs also seek to represent a subclass of the same consumers from Tennessee.

According to the Claire’s data breach class action lawsuit, tens of thousands of consumers may be affected by this issue. Although no numbers have been released by Claire’s, the Washington Attorney General said 1,166 state residents were affected while the Indiana Attorney General reported 1,257 state residents were affected.

Did you shop at Claire’s stores affected by the 2020 data breach? Have you suffered from fraudulent consequences due to the breach? Share your story in the comment section below.

Plaintiffs and the proposed Class are represented by Carl V. Malmstrom of Wolf Haldenstein Adler Freeman & Herz LLC as well as by M. Anderson Berry and Leslie Guillon of Clayeo C. Arnold PLC.

The Claire’s Data Breach Class Action Lawsuit is Delilah Parker, et al. v. Claire’s Stores Inc., et al., Case No. 1:20-cv-05574, in the U.S. District Court for the Northern District of Illinois.

Read About More Class Action Lawsuits & Class Action Settlements:

Claire’s Website Hit With ADA Violation Class Action Lawsuit

Does Johnson’s Talc Contain Asbestos?

New Laws Aim to Protect California Students from Sexual Assault

Instagram Class Action Lawsuit Accuses App of Monitoring User Data