Samsung Electronics Customer Info Data Breaches Class Action

The complaint for this class action describes Samsung as “among the top five largest technology companies in the world, and the second largest in 2021,” making things like smartphones, televisions, semiconductor chips, and so on. Unfortunately, the complaint alleges that Samsung Electronics America, Inc. failed to protect the personally identifiable information (PII) it keeps on file about its customers, suffering a data breach that it announced on September 2, 2022.

A class and two subclasses have been proposed for this action:

• The Class is all persons who bought or used Samsung products and services in the US and whose PII was accessed, compromised, or stolen in the data breach announced by Samsung on September 2, 2022.
• The California and Michigan Subclasses are all persons who bought or used Samsung products and services in those respective states and whose PII was accessed, compromised, or stolen in the data breach announced by Samsung on September 2, 2022.

The complaint quotes Samsung as saying, “[O]ur dedicated security team continuously audits Samsung devices and services so that users can have peace in mind with Samsung’s industry-leading security” and “[S]ecurity and privacy are at the core of what we do and what we think about every day.”

The two plaintiffs in this case bought Samsung items, and the complaint alleges they were required to create a Samsung account and register the devices to gain access to all the devices’ features. According to the complaint, they were required to give Samsung their names, dates of birth, postal and email addresses, and other information to create the accounts.

In addition, the complaint alleges that Samsung “collects and processes the personal data of millions of consumers, including personal information obtained across all of Samsung’s Internet-connected Samsung devices and services[.]”

A startling allegation made by the complaint is that Samsung experienced not one but two data breaches. In April 2022, the complaint alleges, a group named Lapsus$ accessed the company’s systems and stole data, later publishing 190GB of it online. According to the complaint, Samsung “minimized entirely the impact of this first data breach, failing to warn consumers[] and implement the proper measures to prepare for the second attack.”

In spite of its knowledge the sensitive technical data that had been stolen the first time, the complaint alleges, Samsung did not take sufficient measures to keep hackers from entering its systems again. The second data breach took place in July 2022, the complaint alleges, “an undisclosed but large quantity of the PII entrusted to [Samsung] was exfiltrated and stolen by an ‘unauthorized third party.’”

According to the complaint, Samsung claims to have learned about the breach only on August 4, 2022 and released a statement on September 2, 2022. “To date,” the complaint alleges, Samsung “fails to explain the scope of this breach, or to notify all affected customers.”

Article Type: Lawsuit
Topic: Privacy
Tags: Exposing Private Information, Exposure to cyber crime, Your Privacy