Truist Bank class action alleges data breach compromised customer data

Truist Bank data breach class action overview: 

• Who: Plaintiff Stephen Ruffin is suing Truist Bank.
• Why: Ruffin claims he and other customers of the bank had their private information exposed in a Truist Bank cyberattack that could have been avoided. 
• Where: The Truist Bank data breach class action lawsuit was filed in a North Carolina federal court.

A Georgia man is suing Truist Bank, saying a cyberattack on the bank’s systems caused his private information to get into the hands of cybercriminals, causing him anxiety and leaving him open to becoming the victim of multiple crimes. 

Plaintiff Stephen Ruffin filed the class action lawsuit against Truist Bank on June 21 in a North Carolina federal court, alleging negligence. 

According to the lawsuit, the bank failed to properly secure and safeguard the sensitive information of its customers, which was then targeted by cybercriminals in an October 2023 data breach.

“The Data Breach was a direct result of [Truist Bank’s] failure to implement adequate and reasonable cyber-security procedures and protocols necessary to protect consumers’ [personal identifiable information] from a foreseeable and preventable cyber-attack,” Ruffin alleges. 

Bank didn’t give customers enough information about hack, lawsuit says

Truist Bank collected personally identifiable information of Ruffin and other customers, including their full names, dates of birth, Social Security numbers, and account information, the lawsuit says. 

All of this information was exposed to cybercriminals when the bank’s system was hacked in 2023, according to the lawsuit. 

Ruffin says he learned of the Oct. 27, 2023, cyber attack through a letter he received in May this year. He says the letter advised him that his personal information had been exposed in a data breach of Truist Bank, however he says the letter didn’t tell him enough to protect himself. 

“This ‘disclosure’ amounts to no real disclosure at all, as it fails to inform, with any degree of specificity, Plaintiff and Class Members of the data breach’s critical facts,” the lawsuit says. 

“Without these details, Plaintiff’s and Class Members’ ability to mitigate the harms resulting from the Data Breach is severely diminished.”

Truist Bank should have strengthened its cybersecurity, lawsuit says

Ruffin says Truist Bank should have known it was at risk of a data breach due to a number of other, recent high profile data breaches at other industry leading companies, including T-Mobile, USA (37 million records, February-March 2023) and 23andMe Inc. (20 million records, October 2023).

“Defendant knew or should have known that the [information] that they collected and maintained would be targeted by cybercriminals, Ruffin says. 

Instead, it used its customers’ information in a “reckless” manner, by transmitting it in conditions that were vulnerable to cyberattack, he says. 

Ruffin says he and other customers will now face years of constant surveillance of their financial and personal records. Not only will they suffer fear, anxiety and stress, they are also now targets for crime including cybercriminals opening new financial accounts in their names, using their information to obtain government benefits, or giving false information to police during an arrest.

As a result, Ruffin is looking to represent anyone in the United States whose private information was accessed by an unauthorized party as a result of the data breach reported by Truist Bank in June 2024. He is suing for negligence, breach of implied contract and unjust enrichment and is seeking certification of the class action, damages, fees, costs and an injunction forcing the bank to improve its cybersecurity practices. 

In a similar case, a pair of customers filed separate Centennial Bank class action lawsuits last month after a company data breach compromised the information of current and former customers. The Centennial Bank data breach occurred in April 2023, but the company allegedly did not begin to notify the individuals who had their information compromised until April 19, 2024, the class actions claim.

Were you affected by the Truist data breach? Let us know in the comments! 

The plaintiff is represented by Scott C. Harris and David K. Lietz of Milberg Coleman Bryson Phillips Grossman PLLC

The Truist Bank Class Action Lawsuit is Stephen Ruffin v. Truist Bank, Case No. 3:24-cv-00582 in the U.S. District Court for the Western District of North Carolina. 

Read About More Class Action Lawsuits & Class Action Settlements:

• Ticketmaster class action alleges data breach exposed personal info of 560M
• Prudential Financial class action alleges data breach impacts 37,000
• Cencora class action claims data breach exposed sensitive patient info
• EPA warns majority of drinking water systems vulnerable to cyberattack