Mortgage Company and Call Center Vendor Sued for Data Breach

A mortgage company and its call center vendor were recently sued in the U.S. District Court for the District of Massachusetts in a class action lawsuit related to a March 2023 data breach. 

The action was brought by a class of customers alleging that the mortgage company failed to properly safeguard customers’ personally identifiable information by continuing to use the call center vendor despite having knowledge of an earlier data breach, and a general awareness that data breaches are a “known risk,” given the increasing frequency of such attacks.  Specifically, the complaint asserts that the Defendants’ failure to implement and maintain adequate measures to protect against unauthorized access to plaintiffs’ private information was an “unfair practice” in violation of Section 5 of the Federal Trade Commission Act, and violated Illinois state law, with respect to putative class members located in Illinois.  The complaint also alleges that the Defendants were negligent and/or breached their contracts with the putative class members by failing to provide adequate security measures, including failing to implement multi-factor authentication and failing to train staff.

The plaintiffs seek monetary damages, and injunctive relief that would require the Defendants to provide lifetime credit monitoring to class members, and to disclose the nature of the information compromised in the data breach, and to implement adequate measures safeguarding against such breaches from occurring again in the future.

The case is Smith v. Alvaria, Inc., 1:23-cv-11205 (Mass. Dist. Ct. May 30, 2023).