Payment System Breach Leaked Data of 1.7 Million, Lawsuit Says

Payment processor Slim CD Inc. failed to follow state and federal requirements to protect customers’ personal data, resulting in a breach that exposed the information of 1.7 million people, a proposed class action said.

The Florida-based provider didn’t take reasonable steps to protect its merchants’ clients’ data by implementing administrative, technical, or physical controls consistent with industry best practices, according to a complaint filed Tuesday in the US District Court for the Southern District of Florida.

The complaint claims Slim CD violated Florida’s Information Protection Act and the Florida Deceptive and Unfair Trade Practices Act.

The credit card-processing company handles electronic payments for US-based entities including retail, hospitality, and restaurants, it said.

On Sept. 6, Slim CD announced an unauthorized party gained access to its computer systems between Aug. 17, 2023, and June 15, 2024, which “may have enabled” cybercriminals to “view and obtain” consumers’ information including names, addresses, credit card numbers, card expiration dates, and unencrypted Social Security numbers, the filing said.

As of the complaint’s date, the provider hasn’t send data breach notice letters to affected individuals describing the cause of the breach or the remedies taken afterwards, the complaint said.

Named plaintiff Lindley Murray, a Washington, D.C., resident, accused the provider of negligence, unjust enrichment, and invasion of privacy.

The complaint asks the court to order Slim CD to pay for lifetime credit monitoring and dark web scanning services for the class members. It also seeks compensatory, statutory, and punitive damages.

Representatives for Slim CD didn’t immediately respond to a request for comment.

Poulin Willey Anastopoulo LLC and Aylstock, Witkin, Kreis & Overholtz PLLC represent the plaintiff and class.

This case is Murray v. Slim CD Inc., S.D. Fla., No. 0:24-cv-61880, complaint filed 10/8/24.