A putative class action has been filed against SunTrust Bank on behalf of an estimated 1.5 million customers whose private information the bank said may have been disclosed in a data breach.

The lawsuit comes after SunTrust's public revelation that a former employee accessed its customers' names, addresses, phone numbers and account balances.

“SunTrust has acknowledged that approximately 1.5 million customers' PII [personally identifiable information] were compromised; what is presently unknown is for what period of time this information was compromised and being taken for malicious purposes,” said the complaint filed in the U.S. District Court for the Northern District of Georgia by John Yanchunis and Ryan McGee of Morgan & Morgan's Tampa office.

In a prepared statement, Yanchunis said the lawsuit “seeks to hold SunTrust accountable from its acknowledged failure to keep safe the information entrusted to it. In effect, SunTrust acted as the trustee for its customers, and it was the responsibility of SunTrust to ensure the security of customers' information.”

The complaint seeks unenumerated “actual and consequential damages, exemplary damages and attorneys' fees” and other damages.

In an email, SunTrust's chief communications officer Sue Mallino said “SunTrust cares deeply about the security of client information, and we promptly and proactively notified individuals that may have been affected. We have heightened our monitoring of accounts, increased other security measures, and are offering identity theft protection services at no cost to our consumer banking clients.”

The breach became public on April 20, when SunTrust announced it “became aware of potential theft by a former employee of information from some of its contact lists. Although the investigation is ongoing, SunTrust is proactively notifying approximately 1.5 million clients that certain information, such as name, address, phone number and certain account balances may have been exposed.”

The bank said the contact lists did not include information information such as Social Security numbers, account numbers, PINs or passwords.

The bank said that, in addition to offering free credit monitoring, it was “working with outside experts and coordinating with law enforcement.”

The complaint named three class plaintiffs, and said that Suntrust's failure to timely disclose the breach prevented meant its customers were delayed in trying to mitigate the consequences of the breach “and the damage which might follow.”

The breach “was the inevitable result of SunTrust's inadequate approach to data security and the protection of the [personally identifiable information] that it collected during the course of its business,” it said.

Among the claimed damages are the plaintiffs' time spent “searching for fraudulent activity, taking the time to secure or purchasing credit monitoring and identity theft protection services, and the stress, nuisance and annoyance” of dealing with the data theft.

The suit also cited “the imminent and certainly impending injury” the plaintiffs will likely suffer “as a result of their personal information being placed in the hands of criminals and already misused via the sale of plaintiffs' and class members' information on the Internet black market.”

Read the lawsuit:

|