Block is currently facing a class action lawsuit regarding a data breach involving Cash App Investing, which affected 8.2 million customers last year.
In April, Block notified the SEC that a former employee had improperly downloaded reports containing sensitive information about US Cash App users. These reports, accessed in December, included full names and brokerage account numbers of Cash App Investing users. In some instances, details such as brokerage portfolio values, holdings, and stock trading activity for specific trading days were also included.
The lawsuit alleges that Block’s delay in publicly disclosing the data breach for four months resulted in customer information being “accessed, viewed, exfiltrated, and fraudulently misused to their detriment.” Filed in Northern California, the complaint states that the notice of the data breach was not only untimely but also severely lacking in key details. This includes how the unauthorized employee gained access to the networks, whether the private information accessed was encrypted or secured, and how Block became aware of the breach. Furthermore, the defendants did not offer any credit or identity theft monitoring services to the affected customers and class members.