Shopify Back in the Hot Seat Over 2020 Ledger Data Breach

Shopify, a global e-commerce platform, finds itself back in the hot seat for its alleged role in making the hacked Ledger user data available to malicious actors.

The cryptocurrency hardware wallet provider, Ledger, and Shopify face a massive legal hurdle as a group of Ledger users have filed a class-action lawsuit for the company’s inability to prevent a massive data breach in 2020.

The suit was filed on April 1 in the U.S. District Court of Delaware, and alleges that Shopify “repeatedly and profoundly failed to protect its customers’ identities.”

Shopify, together with its third-party data consultant, TaskUs, is being held responsible by complainants for leaking the personally identifiable information of Ledger buyers, despite their marketing campaign promising the full security of the Shopify platform.

According to the plaintiffs, Shopify and TaskUs were aware of the data breach for more than a week before notifying customers. The plaintiffs now want Ledger and Shopify to disclose the exact type of information that was leaked, as well as a monetary reward that covers actual and punitive damages.

Ledger is also a defendant in the case due to its marketing campaign that had promised customer security. According to the complaint, Ledger “initially denied that any compromise of personally identifiable information had occurred”. However, Ledger later had to backtrack and refer to the leak and to Shopify in an email sent out to Ledger users.

Lastly, the complaint alleges that Shopify had direct access to personally identifiable information of customers on Ledger’s database, since Ledger had used Shopify to run its website’s online store. TaskUs therefore also had access to the customer information since Shopify uses them to provide customer support services.