AT&T Sued for $224 Million after Cryptocurrency Theft
Recent lawsuit by cryptocurrency investor seeking $200 million in damages highlights the importance of data protection policies and the potential risk exposure to litigation in the cryptocurrency sector.
On August 15, 2018, in Terpin v. AT&T, et al., Case No. 18-cv-6975 (C.D. Cal), Michael Terpin, a cryptocurrency investor, filed suit against AT&T, claiming the cell phone provider failed to protect his personal information. Terpin’s accounts were recently hacked, causing him to lose nearly $24 million in cryptocurrency. In the lawsuit, Terpin blames AT&T for the hack because it allegedly provided hackers with access to Terpin’s telephone number without adhering to its security procedures by enabling SIM swapping, a fraud by which hackers trick a cell phone provider into transferring the target’s phone number to a SIM card controlled by the criminal so the criminal can reset the target’s passwords and break into accounts. According to Terpin, AT&T knew SIM swapping fraud was widespread—and that its own employees were sometimes involved—and yet has done nothing to protect customers’ private information. It was through SIM swapping that hackers were able to drain Terpin’s cryptocurrency accounts.
Businesses that collect and store individual’s personal information should be mindful that it is increasingly more important to keep that information secure. As the technological landscape changes and cryptocurrencies gain popularity, data breaches may become even more expensive for businesses if they enable hackers to steal cryptocurrencies. If you have questions about your data protection polices, you should contact an attorney.
© 2018 Blank Rome LLP. All rights reserved. Please contact Blank Rome for permission to reprint. Notice: The purpose of this update is to identify select developments that may be of interest to readers. The information contained herein is abridged and summarized from various sources, the accuracy and completeness of which cannot be assured. This update should not be construed as legal advice or opinion, and is not a substitute for the advice of counsel.