Judge denies X’s bid to dismiss data breach class action

Update: 

• A California federal judge allowed claims to proceed alleging a defect in the X application programming interface allowed cybercriminals to access usernames, email addresses and passwords from June 2021-January 2022.
• On Dec. 18, U.S. Magistrate Judge Kandis A. Westmore ruled to dismiss one breach of contract claim in the X class action but allowed negligence and breach of unfair competition claims to continue. X Corp. asked the judge to dismiss all the claims against it.
• Plaintiff Stephen Gerber says the X data breach compromised his personal identifiable information. 
• He says, at the time, he went by an alias to speak more freely online. Had he known X Corp. would fail to adequately protect users’ information, Gerber says he would either not have provided identifying information to X, formerly known as Twitter, or would not have used the social media platform at all.

Twitter class action lawsuit overview:

• Who: Plaintiff Stephen Gerber has filed a class action lawsuit against Twitter Inc.
• Why: Twitter allegedly failed to protect users’ personal identifiable information and enabled cybercriminals to access usernames and their linked email addresses and phone numbers.
• Where: The Twitter class action lawsuit was filed in California federal court.

(Jan. 19, 2023)

A defect in Twitter’s application programming interface (API) allowed cybercriminals to access usernames, email addresses, and passwords from June 2021 through January 2022, according to a class action lawsuit filed Jan. 13 in California federal court.

Plaintiff Stephen Gerber says he used a pseudonym to protect his identity on Twitter so that he could express his thoughts without fear of retribution or embarrassment from his employer and peers.

Gerber’s personal identifiable information (PII) was exposed in the Twitter data breach, the class action lawsuit alleges. Had he known Twitter would fail to adequately protect users’ PII, Gerber says, he would either not have provided identifying information to Twitter or would not have used the social media platform at all.

He says Twitter has failed to notify or contact users who have been affected by this data breach and has not attempted to remediate the damage it has caused them.

Twitter class action says social media company violated its privacy policy and 2011 FTC agreement

The Twitter class action lawsuit points to Twitter’s privacy policy, which describes how the social media company uses the information it collects from users.

“At no point does Twitter disclose in their Privacy Policy that they allow cybercriminals to commandeer Twitter’s API in order to scrape sensitive PII from Twitter and then weaponize or sell that information on the dark web,” the class action lawsuit says.

The alleged defect in Twitter’s API reportedly allowed cybercriminals to “scrape” data from Twitter, including usernames and the email addresses and phone numbers associated with the specific account.

The Twitter data breach effectively de-anonymized Twitter users who had wished to remain anonymous while posting on the social media platform, Gerber alleges.

Gerber claims Twitter violated a 2011 agreement with the Federal Trade Commission that prohibits the social media company from misrepresenting the extent to which it protects nonpublic user data.

As a result of the Twitter data breach, Gerber says, users are at risk of being targeted by phishing attempts, unwanted phone calls and text messages, having their private Twitter accounts and identities exposed, and having their PII available for sale on the dark web.

The Twitter class action lawsuit asserts claims for negligence, breach of contract and violations of California’s Unfair Competition Law.

Were you affected by the Twitter data breach? Tell us what you think of the class action lawsuit in the comments.

Gerber is represented by Israel David and Blake Hunter Yagman of Israel David LLC and Jeff Westerman of Westerman Law Corp.

The Twitter class action lawsuit is Stephen Gerber v. Twitter Inc., Case No. 4:23-cv-00186-KAW, in the U.S. District Court for the Northern District of California.

Read About More Class Action Lawsuits & Class Action Settlements:

• DraftKings shared customer data with third parties for advertising, class action claims
• MasterClass class action claims company shares customer data with third parties
• Parent files TikTok class action over collection, sale of children’s data
• Apple, Google, online casino operators conduct illegal gambling enterprises, class action claims