A shopper has filed a class-action lawsuit seeking at least $5 million in damages for a data breach that affected Saks Fifth Avenue and Lord & Taylor.
According to Women's Wear Daily, shopper Antranik Mekerdijian filed a class action lawsuit against Hudson's Bay Company, owner of the two luxury department stores, in a California federal court on 3 April. Represented by Bobby Saadian of Wilshire Law Firm, Mekerdijian wrote in the complaint that HBC failed to "properly safeguard and protect plaintiff's and class members' [private identifiable information] from unauthorized access, use, and disclosure." In so doing, the Canadian real estate firm violated state and federal regulations along with industry practices, he alleged in the motion. The shopper didn't stop there in placing the blame squarely on HBC in the lawsuit. As quoted by Women's Wear Daily:
The data breach was also a result of defendants’ failure to establish and implement appropriate administrative, technical and physical safeguards to ensure the security and confidentiality of plaintiffs' and class members' [information] to protect against reasonably foreseeable threats to the security or integrity of such information.
Per an analysis conducted by Gemini Advisory, the data breach became public on 28 March when the financial threat actor FIN7 announced a sale of 5 million payment card details on its Joker's Stash underground market hub. The security firm ultimately traced the compromised records back to Saks Fifth Avenue and Lord & Taylor with the help of affected financial institutions. It's believed the breach occurred in May 2017. HBC confirmed the data security incident in a statement on 1 April, announcing its intention to notify affected customers and provide them with free identity protection services. But that's not enough for Mekerdijian. As reported by Top Class Actions, he wrote in his complaint that the loss of his payment information exceeded the financial costs he incurred from attackers making fraudulent purchases on his account. The shopper went on to say that he and other individuals affected by the breach would need to invest time and money in recovering from the theft of their data. For that reason, he demanded $5 million in damages. Mekerdijian announced his complaint at the same time that law firm Abington Cole + Ellery launched a separate class action investigation into the Saks Fifth Avenue and Lord & Taylor data breach.
