Fidelity sued for hacking disclosure of 77,000 customers' financial data (1)

Fidelity Investments' failure to adequately secure its computer systems led to a data breach in August that exposed the sensitive personal and financial information of more than 75,000 customers, a proposed class action lawsuit says.

The company, also known as Fidelity Management & Research, did not follow standard cybersecurity practices such as encrypting customer information and providing sufficient employee training, according to a complaint filed Tuesday in the U.S. District Court for the District of Massachusetts.

Massachusetts-based Fidelity is “one of the world’s largest asset managers,” the complaint says, “with over $5.4 trillion in assets under management as of June 2024.”

According to the complaint, between August 17 and August 19, cybercriminals accessed the asset manager's computer network and gained access to names, social security numbers, financial account information and driver's license information.

The hack affected 77,099 people, according to an Oct. 9 data breach notification to Maine's attorney general.

Plaintiff Peggie Little, a Tennessee resident, also accused Fidelity of failing to notify customers of the breach in a timely manner. The complaint said the company failed to disclose the matter for “several weeks” after the incident.

The proposed class action lawsuit alleged negligence, breach of contract and unjust enrichment. She is demanding reimbursement of the legal costs and financial relief.

The lawsuit's demands also include asking the court to require Fidelity to segment customer data, stop sending personal data via unencrypted email, hire third-party auditors and employ internal security staff to conduct testing.

Fidelity representatives did not immediately respond to a request for comment.

Siri & Glimstad LLP and Murphy Law Firm represent the plaintiff.

The case is Little v. FIDELITY INVESTMENTS a/k/a FMR LLC, D. Mass., No. 1:24-cv-12625, complaint filed 10/15/24.