Salesforce Tower in San Francisco. Photo: Jason Doiy/ALM

Cloud services provider Salesforce.com has been roped into a class action lawsuit filed in the wake of a data breach at children's clothing boutique Hanna Andersson, which affected an estimated 10,000 California customers.

Lawyers for the affected customers, including John Yanchunis of Morgan & Morgan, argue that the companies negligently or carelessly exposed personally identifiable information when malware attacked Hanna's e-commerce platform, and Salesforce "failed to detect the breach for almost three months," according to a complaint filed Monday in the U.S. District Court for the Northern District of California. 

The lawsuit asserts that the companies did not know about the breach that occurred from Sept. 16 to Nov. 11 until law enforcement found customers' stolen information on the dark web and warned the clothing chain in December. Hanna Andersson notified potential victims in January.

After the breach, Sacramento County resident Bernadette Barnes contends potential plaintiffs now face a "a lifetime risk of identity theft," according to the complaint.

"Hanna's customers' information was sold or is still for sale to criminals," the attorneys wrote. "This means that the breach was successful; unauthorized individuals accessed Hanna's customers' unencrypted, unredacted information, 'including name, shipping address, billing address, payment card number, CVV code, and expiration date,' and possibly more, without alerting Defendants, then offered the 'scraped' information for sale online where the FBI or similar agency ran across it on or about December 5, 2020."

A Salesforce spokesperson said the company does not comment on ongoing litigation, and  Hanna Andersson did not respond to a request for comment at the time of publication.

The lawsuit also alleges that Hanna began recruiting for a director of cybersecurity around the same time Salesforce removed the malware from the system, "indicating that the company may not have had an adequate internal security lead that could monitor the website's systems or implement safeguards," the complaint alleges.

Barnes is suing the companies for negligence, declaratory relief and violations under the California Unfair Competition Law.

Plaintiffs attorneys M. Anderson Berry and Leslie Guillon of Arnold Law Firm in Sacramento, California, declined to comment on the case, and Morgan & Morgan's Yachunis did not respond to a request for comment.