Ala. Customer Sues Planet Home Lending, Citrix Over Data Breach

Fort Lauderdale. Co-defendant Planet Home Lending informed plaintiff Cole, an Alabama resident, of the incident on Jan. 25, telling him his name, Social Security number, loan and financial account numbers were compromised in a Nov. 15 cyberattack that Planet became aware of that day, the complaint said. On Feb. 13, Cole’s bank informed him about unauthorized charges on his debit/credit card, forcing him to freeze and close that account, and change his autopay information with several vendors. Following the breach, Cole noticed an increase in spam emails, texts and phone calls, it said. Cole has spent about four hours consulting his bank about the fraudulent charges and six hours dealing with consequences of the breach, it said. On Nov. 28, Planet determined “with reasonable certainty” that the threat actor accessed a read-only data folder with copies of loan files containing the PII of some of its customers. The notice said Planet has not paid, and doesn’t anticipate paying, a ransom to the threat actor. The mortgage company was in the process of retaining a third-party consultant to do an audit and risk assessment of its information security technology, controls and processes, it said. Planet offered affected individuals credit monitoring and identity protection services via Experian Identity Works for 24 months, it said. The class action asserts claims of negligence, breach of express and implied contract, and unjust enrichment. Cole seeks for himself and the class actual and statutory damages, equitable relief, restitution, disgorgement and statutory costs; an order requiring defendants to purchase funds for lifetime credit monitoring and identity theft insurance; attorneys’ fees and legal costs; and pre- and post-judgment interest.