Salesforce, Hanna Andersson Agree to Settle Data Breach Class Action Lawsuit for $400K

Hanna Andersson and Salesforce have agreed to pay $400,000 to resolve claims that more than 200,000 of their customers had information compromised in a data breach.

The companies have joined plaintiffs in the data breach class action lawsuit to ask the court for preliminary approval of the proposed settlement deal. According to the lead plaintiffs, the settlement is a strong resolution with both monetary and non-monetary benefits.

“Plaintiffs strongly believe the settlement is fair, reasonable and adequate, and that the court should grant it preliminary approval and notice distributed to class members,” the customers said.

“The settlement provides quick relief for class members, including compensation for the alleged unauthorized dissemination of their [personal information].”

The settlement deal is proposed to benefit individuals who made purchases from Hanna Andersson’s website between Sept. 16, 2019, and Nov. 11, 2019. This settlement Class reportedly includes 200,273 consumers.

Under the terms of the settlement deal, these Class Members will be able to collect cash payments of up to $5,000 depending on their situation.

The basic settlement award will be a cash payment of up to $500. However, in extraordinary cases such as rampant identity theft or fraud, extraordinary expense awards of up to $5,000 are available for Class Members.

Although cash payments are capped at $500, actual payments may not be this high. Based on similar data breach settlements, the plaintiffs estimate that each Class Member could receive around $38 in a basic payment.

Exact payment amounts will vary greatly depending on the number of Class Members who participate in the settlement. For example, if fewer Class Members participate in the settlement than expected, cash payments could be much higher than expected. However, if many Class Members choose to participate in the deal, lower cash payments are likely.

In addition to providing monetary benefits, the settlement deal would provide non-monetary relief by requiring Hanna Andersson to implement stricter cybersecurity. This includes hiring additional information technology personnel to help with data security, enabling multi-factor authentication of accounts to reduce the risk of fraudulent logins and “conducting a risk assessment of the Hanna data assets and environment consistent with the NIST Risk Management Framework.”

The proposed data breach class action settlement would put an end to claims Hanna Andersson and Salesforce mismanaged a 2019 data breach. The data breach reportedly affected Hanna Andersson’s website, which uses an e-commerce platform from Salesforce.

According to plaintiff Bernadette Barnes, the companies failed to protect her and other customers from a data breach that occurred between September and November 2019.

During the breach, unauthorized hackers allegedly gained access to sensitive consumer information, including payment card information and billing addresses.

Unfortunately, Hanna Andersson and Salesforce allegedly failed to prevent the data breach and even failed to detect the breach in a timely fashion — allowing the unauthorized access for nearly three months.

To make matters worse, Barnes and other consumers were reportedly not informed of the data breach until Jan. 15, 2020 — months after the initial data breach. According to the Salesforce class action lawsuit, this time could have been used to mitigate the effects of the data breach, including fraud and identity theft.

Plaintiffs in the case argued that the Hanna Andersson and Salesforce data breach was handled negligently. Based on this, the plaintiffs claimed the companies violated California’s Unfair Competition Law and the California Consumer Privacy Act (CCPA).

The CCPA went into effect Jan. 1, 2020 and beefs up Californians’ rights when it comes to their data. Under the law, Californians can request information about how companies are storing their information, request that the information be deleted and opt out of having their data sold.

The CCPA covers several forms of data including personal identifiers, smartphone locations, online activity, biometric face data, voice recordings, ad data and more. If this information is used by companies to make inferences about consumers, that information is also covered under the CCPA.

Barnes argued that Hanna Andersson and Salesforce violated terms of the CCPA by mishandling the data breach in 2019. These claims and others in the data breach class action lawsuit would be resolved by the proposed settlement.

Were you affected by the Hanna Andersson and Salesforce data breach? Share your story in the comment section below.

Top Class Actions will post updates to this class action settlement as they become available. For the latest updates, keep checking TopClassActions.com or sign up for our free newsletter. You can also receive notifications when this article is updated by using your free Top Class Actions account and clicking the “Follow Article” button at the top of the post.

The plaintiffs are represented by John Yanchunis of Morgan & Morgan Complex Litigation Group, M. Anderson Berry of Clayeo C. Arnold Professional Law Corp. and Rachele Byrd of Wolf Haldenstein Adler Freeman & Herz LLP.

The Salesforce Data Breach Class Action Lawsuit is In Re: Hanna Andersson and Salesforce.com Data Breach Litigation, Case No. 3:20- cv-00812, in the U.S. District Court for the Northern District of California.

Read About More Class Action Lawsuits & Class Action Settlements:

• Workers Ask Judge to Approve $18M Conagra Lawsuit Settlement
• Woman Files Class Action Lawsuit, Says Cottonelle Flushable Wipes Made Her Sick
• Hackensack Meridian Health Sued Because of Hospital Ransomware Attack
• IED Attacks in Iraq Traced to Big Bank Financing