Capital One Bank branch. Capital One Bank branch. Photo: Shutterstock

Capital One is facing class action lawsuits over a major data breach said to have exposed sensitive information of more than 100 million customers and card applicants.

By Tuesday afternoon at least two lawsuits had been filed against the company in federal courts along the East Coast. The suits both contend that the bank failed to properly secure and monitor the data of its customers, and seek to bring claims on behalf of the estimated 106 million people affected.

Kevin Zosiak, a Connecticut resident, filed a lawsuit against the banking company Tuesday morning in the U.S. District Court for the District of Columbia. Manhattan attorney Linda Nussbaum of the Nussbaum Law Group filed the lawsuit, along with Greenwich, Connecticut, attorney Adam Frankel of Greenwich Legal Associates.

READ ZOSIAK'S COMPLAINT:

The 15-page complaint contends that Capital One, which is estimated to have more than $373 billion in assets, should have been aware of data vulnerabilities, since it has, allegedly, been the subject of security breaches previously. Capital One is headquartered in McLean, Virginia, and incorporated in Delaware.

“Defendants' data security obligations and promises were particularly important given the substantial increase in data breaches, which were widely known to the public and to anyone in defendants' industries,” Zosiak said in the complaint.

DuWayne Baird, an Ohio resident, filed his class action over the breach in the U.S. District Court for the Eastern District of Virginia. Attorneys from Tampa, Florida's Morgan & Morgan and Baltimore's Murphy, Falcon & Murphy filed the suit on behalf of Baird.

Baird's 49-page complaint alleges that not only was the company negligent in protecting the data, it also failed to comply with federal requirements about maintaining and disposing of data. Along with alleging negligence and breach of implied contract, Baird raises claims of unjust enrichment, invasion of privacy and several claims under Ohio's consumer protection statutes.

In an emailed statement, John Yanchunis of Morgan & Morgan said, “Like so many others, Capital One knew the risks of a security breach and, we allege, did not take the proper steps to protect the personal information applicants and customers trusted the company to safeguard. You'd think with one data breach after another, companies would wise up and take responsibility for the data it collects from consumers, but unfortunately, they continue to shirk that responsibility.”

READ BAIRD'S COMPLAINT:

New York Attorney General Letitia James also announced Tuesday morning her office was launching an investigation into the possible data breach.

The press office of Capital One did not immediately return a message seeking comment.

The proposed class action comes a day after the company announced the breach and the feds charged a Seattle woman for allegedly perpetrating the breach.

The bank announced the breach Monday, saying it likely affected an estimated 100 million American customers and 6 million Canadian customers, and that the largest cache of data came from consumers and small businesses that applied for card products from 2005 through early 2019. The information that was exposed included names, address, phone numbers, emails, dates of birth, as well as fragments of transaction data and Social Security and bank account numbers for some customers.

According to the company, no credit card account numbers or log-in credentials were compromised.

Both complaints said the breach occurred in late March and continued through late April, but the company only learned about the breach July 19. The complaints further contended that the financial services company only learned about the breach after an unnamed person sent the company a link to a file containing the leaked information.

Also on Monday, the U.S. Attorney's Office for the Western District of Washington announced it had arrested a 33-year-old software engineer named Paige Thompson in connection with the breach. According to the feds, Thompson breached the bank's security through a reconfigured firewall on an app, and later posted the information on the software development site GitHub. The feds said a GitHub user later saw Thompson's post, and then alerted Capital One about the breach.

The company's statement announcing the breach said that, based on the company's analysis, it was unlikely the information had been disseminated, or used for fraud, but that it would continue to investigate.