Zoosk Class Action Lawsuit Says Dating App Exposed To Massive Data Breach

A California man has filed a class action lawsuit against online dating service Zoosk following a data breach in which 30 million user records were allegedly compromised.

Plaintiff Juan Flores-Mendez and others say Zoosk was hacked by a group that calls itself the “ShinyHunters.”

According to the Zoosk app class action lawsuit, the group hacked and in early May attempted to sell nearly “200 million stolen records from at least 13 companies.” 

In addition to the Zoosk app, ShinyHunters’ other targets included Home Chef, Minted, Minnesota’s Star Tribune newspaper and others, according to Wired. 

Someone claiming to be a ShinyHunters member told Wired in an instant message that it is “not too hard” to breach so many companies’ information.

“It’s just a way to make money, but if companies are afraid and want their database taken off the market, they can contact me for an agreement, it has been done recently and both sides were satisfied,” the group told Wired.

The class action lawsuit claims Zoosk did not contact affected customers until weeks after the breach took place.

The risk of “significant harm” to the plaintiffs and Class Members increased as the amount of time between the breach and the notification of customers grew longer, the class action lawsuit says.

In its notice to customers, Zoosk said the breach happened around Jan. 12. The database that was breached did not contain financial or credit card data.

The Zoosk app does not collect information such as Social Security number, passport numbers “or other taxation or government identity information, so none of these types of information are at issue,” the notice said.

The Zoosk dating app information stolen does include users’ names, email addresses, birth dates, gender, gender search preferences, other demographic information and possibly password information, the complaint says.

The user information uncovered in the data breach is protected under the California Consumer Privacy Act of 2018 (CCPA), which went into effect Jan. 1, 2020, the class action lawsuit says. The plaintiffs claim Zoosk failed to maintain reasonable security controls as required by the CCPA and other laws, and failed to take proper precautions against hacking and other intrusions.

The Zoosk app breach has resulted in the necessity for the plaintiffs and Class Members to constantly monitor their financial and personal records, and has caused a loss of rights, the complaint says. 

The plaintiffs also say they and the Class are now at higher risk of phishing and pharming attacks.

Indeed, the data stolen by ShinyHunters doesn’t give scammers a direct route to fraud, but it does expand criminals’s options, Wired reported. 

The plaintiffs do not believe Zoosk is taking the breach seriously enough.

The company has not offered customers credit monitoring or other measures beyond what is publicly available, the complaint says. 

Zoosk’s notice to affected customers makes it the user’s responsibility to change their password and states the company is “providing the contact details for the national consumer reporting agencies and a reminder to remain vigilant for incidents for fraud and identity theft by reviewing account statements and monitoring credit reports,” the Zoosk app class action lawsuit states.

In addition to violating the CCPA, the Zoosk app also allegedly violated California’s Unfair Competition Law when the company established substandard security practices and procedures, by soliciting and collecting the plaintiffs’ and California Subclass Members’ personal identifying information knowing the information wouldn’t be adequately protected; and by storing that information in an “unsecure electronic environment.”

Flores-Mendez’s class action lawsuit seeks to certify a Class of individuals whose personal information was compromised in the breach, as well as a Subclass of affected California residents. 

The plaintiffs seek compensatory and punitive damages; statutory or civil penalties as warranted by law; an order instructing Zoosk to provide or purchase credit monitoring services for the Class; injunctive relief directing the defendants to implement reasonable security measures to protect user information according to state and federal guidelines and industry norms; court costs and fees; and any other relief deemed appropriate by the Court.

The plaintiffs plan to seek civil penalties at a later time.

Are you a Zoosk user who thinks your personal information may have been compromised by the ShinyHunters hack? Let us know in the comments.

The plaintiff is represented by Marcus J. Bradley, Kiley L. Grombacher, Lirit A. King and Robert N. Fisher of Bradley/Grombacher LLP.

The Zoosk Dating App Data Breach Class Action Lawsuit is Juan Flores-Mendez, et al. v. Zoosk Inc., et al., Case No. 3:20-cv-04929, in the U.S. District Court for the Northern District of California.

Read About More Class Action Lawsuits & Class Action Settlements:

Walmart Class Action Lawsuit Says Customers Subjected to Data Breach

Former McDonald’s Employee Files Fingerprint Privacy Class Action Lawsuit

Exxon and PBF Energy Reach $4.4M California Wage and Hour Settlement

What Does the California Coalition Against Sexual Assault Do?