Shopify Data Breach Exposes Ledger Wallet-Related PII Class Action

This class action concerns a data breach that impacted cryptocurrency hardware ledger wallets. The complaint brings suit against Shopify, Inc., two other related Shopify companies, and TaskUS, Inc., claiming that the companies did not take reasonable care to properly secure and safeguard consumer information. The complaint claims that this lack of care resulted in “a massive 2020 data breach” affecting Ledger SAS wallets.

The Nationwide Class for this action is all persons living in the US who gave Shopify or TaskUS personal information through the use of a Ledger Wallet that was accessed, compromised, stolen, or exposed in the data breach. The complaint also defines Arizona, Florida, Kentucky, and North Carolina Subclasses for those in the above class living in those states.

The wallets at issue are sold through Ledger’s e-commerce site which runs on Shopify’s platform.

Ledger Wallets store keys to individuals’ cryptocurrency and other crypto assets that are similar to the passwords used for bank accounts. They permit individuals to transfer money or other assets out of a cryptocurrency account. The complaint alleges, “Unlike a bank account transaction, however, cryptocurrency transactions are non-reversible—once assets are transferred out of a cryptocurrency account, they are able to be distributed or spent with little information about where they could have gone.”

The complaint claims that Ledger promotes itself by claiming it has “the highest security standards,” and that it “continuously look[s] for vulnerabilities on Ledger products as well as [its] providers’ products in an effort to analyze and improve the security…”

Ledger, the complaint alleges, has promoted its platform as offering the best security for storing cryptocurrency, the complaint says, “because they hold password information in a physical form and restrict transfer of crypto-assets in an individual’s account unless the physical device is mounted to a computer and a twenty-four-word passphrase is entered.”

But the complaint alleges that this is not that secure. “When hackers know the identity of a cryptocurrency owner and know what platform that customer is storing their crypto-assets on, the hacker can work backwards to create a targeted attack aimed at luring hardware wallet owners into mounting their hardware device to a computer and entering their passphrase, allowing unfettered access and transfer authority over their crypto-assets.”

The complaint claims that this makes the Ledger customer list, which Shopify was holding at the time of the data breach, very valuable. The personally identifiable information (PII) obtained in the data breach permits to undertake phishing attacks, designed to make customers unlock their wallets and make irreversible transfers into the hackers’ accounts. The complaint therefore alleges that Ledger customers’ cryptocurrency accounts are therefore no longer secure.

Article Type: Lawsuit
Topic: Privacy
Tags: Exposing Private Information, Exposure to cyber crime, Your Privacy