“On December 10, 2021, a former employee of Cash App Investing downloaded internal reports containing the sensitive personal information of approximately 8.2 million current and former customers.”

💡 This shows Block failed to prevent a departed employee from accessing massive amounts of sensitive customer data.

“The stolen information included customers’ full names, brokerage account numbers, and for some, the value and holdings of their investment portfolios and stock trading activity.”

💡 The breach exposed highly sensitive financial information that could be used for identity theft and targeted fraud.

“For nearly four months, Block, Inc. remained silent. The company did not publicly disclose the breach until April 4, 2022, giving those who stole the data a significant head start to exploit it.”

💡 Block prioritized managing its public image over immediately warning endangered customers who could have taken protective action.

“Between January and June of 2023, unauthorized users gained access to customer accounts by using recycled phone numbers. Block’s system allegedly allowed these new phone number owners to log into the previous owner’s Cash App account, granting them access to account numbers, routing numbers, and Cash App Card details, including the expiration date and CVV.”

💡 This was a known, preventable vulnerability that Block failed to address, enabling a second wave of unauthorized access.

“Once again, the company failed to provide timely notice. Users were not informed about this breach until at least six months after the initial unauthorized access began.”

💡 Block established a pattern of hiding security failures from users, preventing them from protecting themselves.

“Individuals reported losing as much as $40,000. For many, the stolen funds were essential for survival. Users reported that money needed for rent, food, and other basic obligations vanished from their accounts. Tax refunds, stimulus checks, and even military disability payments were allegedly siphoned off by criminals.”

💡 These were not abstract data points but real people who lost their ability to meet basic needs because of Block’s failures.

“In many cases, the theft was not a one-time event. Some users reported dozens of fraudulent transactions occurring over a period of up to a year. Even after informing Cash App that their account was compromised, some users saw money continue to be taken.”

💡 Block failed to stop ongoing theft even after being directly notified by victims that their accounts were compromised.

“One veteran reported that Cash App had ‘completely wiped out my military account stealing everything from me,’ causing them to lose their home and fall behind on all their bills.”

💡 This illustrates the life-altering, cascading consequences of Block’s security failures on vulnerable users.

“The complaint explicitly accuses Block of failing to implement and maintain reasonable security procedures, a violation of the spirit, if not the letter, of the FTC Act, which prohibits ‘unfair or deceptive acts or practices.'”

💡 Block violated basic security standards and made false promises about protecting user information.

“The company’s own privacy notice claimed it took ‘reasonable measures… to protect your information,’ a statement that the lawsuit argues was demonstrably false.”

💡 Block actively misled users about the level of security protecting their financial data and accounts.

“The lawsuit argues the company disregarded the rights of its users by ‘intentionally, willfully, recklessly, and/or negligently’ failing to implement adequate security measures.”

💡 Block made a deliberate choice to underfund security, treating user protection as optional.

“Block, Inc. agreed to pay $15 million to a settlement fund but officially admitted no wrongdoing. This is a standard and insidious feature of corporate settlements under late-stage capitalism.”

💡 Block escapes legal accountability and can publicly deny any fault despite overwhelming evidence of harm.

“The settlement offers reimbursement for ‘Lost Time’ at a rate of $25 per hour (up to three hours) and up to $2,500 for documented ‘Out-of-Pocket Losses.’ However, for those who lost tens of thousands of dollars, these figures are a pittance.”

💡 Users who lost $40,000 will receive a fraction of what they lost, while Block pays a negligible fine relative to its size.

“In the event that the Net Settlement Fund is not sufficient to make payment for all Approved Claims at the full amounts otherwise approved, then the value of the payments for Approved Claims shall be reduced on a pro rata basis.”

💡 Even the inadequate settlement amounts may be further reduced, ensuring victims are not made whole.

“When Cash App can ignore years of security warnings, allow two massive data breaches to occur through basic negligence, delay informing its customers for months, and then resolve the resulting legal action with a settlement that includes no admission of wrongdoing, the system is not broken. It is functioning to shield corporate actors from meaningful consequences.”

💡 This case exposes how the legal and economic system is designed to protect corporations, not the people they harm.