Lawsuit filed against Shopify over Ledger data breach

Shopify and its third-party data consultant TaskUs are being held responsible by complainants for leaking personally identifiable information of Ledger buyers

Global e-commerce platform Shopify and hardware wallet maker Ledger face a major legal hurdle as a group of Ledger users have filed a class-action lawsuit for its part in failing to prevent a massive data breach in 2020.

The suit was filed in the United States District Court of Delaware on Friday and alleges that Shopify ‘repeatedly and profoundly failed to protect its customers’ identities.’

Shopify and its third-party data consultant TaskUs are being held responsible by complainants for leaking personally identifiable information (PII) of Ledger buyers despite marketing promises assuring the full security of the Shopify platform.

The plaintiffs claim Shopify and TaskUs were aware of the data breach for over a week before notifying customers.

They are asking for the exact type of information leaked to be disclosed by Ledger and Shopify and for a monetary reward that covers actual and punitive damages.

France-based Ledger is also included as a defendant in the case for its marketing claims promising customer security. The complaint states that Ledger ‘initially denied that any compromise of PII had occurred,’ but later had to backtrack and refer to the leak and to Shopify in an email notification.

The complaint stated: Despite the repeated promises and worldwide advertising campaign touting unmatched security for its customers, Ledger—and its data processing vendors, Shopify and TaskUs—repeatedly and profoundly failed to protect its customers’ identities, causing targeted attacks on thousands of customers’ crypto-assets and causing Class members to receive far less security than they thought they had purchased with their Ledger Wallets.

As the complaint alleges, Ledger used Shopify to run its website’s online store. As a result, Shopify had direct access to the PII of customers on Ledger’s database. Shopify uses TaskUs to provide customer support services and, therefore, it also had access to Ledger’s customer data.

Hackers made off with personal information from about 272,000 Ledger users and over 1 million email subscribers to Ledger’s newsletter in 2020. A massive phishing and intimidation campaign targeting Ledger owners followed resulting in some victims losing crypto assets.