Legal & Privacy Brief

2026-10-05

Today: Carhartt faces a class action after a ShinyHunters breach exposed PII for 13 million individuals. OneMain Financial is sued over unencrypted customer data exposed in a separate breach. Both cases highlight ongoing litigation over inadequate data security practices and failure to implement encryption controls.

Litigation Updates

Carhartt Class Action Following ShinyHunters Hack

Carhartt is facing a class action lawsuit after failing to properly secure the personally identifiable information of nearly 13 million individuals in a breach attributed to the ShinyHunters threat actor group. The lawsuit alleges inadequate security measures allowed unauthorized access to customer data. ShinyHunters is a known cybercrime group with a history of high-profile data breaches and credential theft operations.

• Compliance Action: Review vendor and third-party risk management programs. Verify implementation of multi-factor authentication, network segmentation, and intrusion detection systems. Document security controls and incident response procedures to demonstrate reasonable security practices in the event of future litigation.
• Source: Top Class Actions

OneMain Financial Sued Over Unencrypted PII in Data Breach

OneMain Financial faces a class action alleging the financial services company failed to secure sensitive personally identifiable information of customers, with the lawsuit specifically claiming exposed data was unencrypted. The complaint asserts OneMain Financial failed to implement adequate data security measures to protect customer information despite handling sensitive financial data.

• Compliance Action: Audit data-at-rest and data-in-transit encryption implementations. Verify compliance with PCI DSS encryption requirements for financial data. Review encryption key management procedures and ensure sensitive PII is encrypted using industry-standard algorithms (AES-256 or equivalent).
• Source: Top Class Actions

Target Colorado Wage Lawsuit

Target is defending a class action claim that the retailer failed to pay hourly employees in Colorado for all time worked. The lawsuit alleges wage and hour violations under Colorado labor law.

• Source: Top Class Actions

Compliance Takeaways

• Encrypt all PII at rest and in transit. The OneMain Financial lawsuit specifically alleges unencrypted data exposure. Ensure AES-256 encryption for stored customer data and TLS 1.2+ for data transmission. Document encryption implementations for regulatory audits and litigation defense.

• Assess third-party and supply chain cyber risk. The Carhartt breach involved the ShinyHunters group, a sophisticated threat actor. Require vendors handling customer data to demonstrate SOC 2 Type II compliance, maintain cyber insurance, and undergo annual penetration testing.

• Review breach notification procedures. Both data breach lawsuits highlight ongoing litigation risk following security incidents. Verify your organization can meet state breach notification deadlines (typically 30-60 days). Maintain updated contact lists and pre-approved notification templates.

• Implement defense-in-depth security controls. Deploy network segmentation to limit lateral movement, enable MFA for all system access, maintain EDR/XDR on endpoints, and conduct quarterly vulnerability scans. Document all security controls in a system security plan.

• Prepare for class action litigation following breaches. Data breach class actions routinely allege negligence, breach of contract, and violations of state consumer protection statutes. Maintain detailed security documentation, incident response logs, and evidence of reasonable security practices to support litigation defense.