“We use a variety of robust physical, technical, organizational, and administrative safeguards to protect your personal data from unauthorized access, loss or alteration.”

💡 This statement from MoneyGram’s privacy policy directly contradicts the reality that hackers easily breached their systems and stole unencrypted data.

“names, Social Security numbers, government identification information, transaction information, email addresses, postal addresses, names, phone numbers, utility bills, bank account information, MoneyGram Plus Rewards information, and some criminal investigation information for a limited number of customers”

💡 This comprehensive list of compromised data shows criminals obtained everything needed for complete identity theft and financial fraud.

“the Data Breach occurred through a social engineering attack on Defendant’s IT helpdesk wherein the malicious actors impersonated an employee to gain access to that employee’s account. The unauthorized actors then used the access given to it by IT helpdesk staff to remotely connect to Defendant’s information systems and target its Windows Active Directory systems directly.”

💡 This describes a preventable attack that basic employee training should have stopped, proving MoneyGram’s security failures were fundamental.

“the infiltration occurred between September 20 and September 22, 2024, but Defendant did not discovery the Data Breach until September 27, 2024.”

💡 The week-long gap between the breach and discovery reveals MoneyGram lacked basic monitoring systems to detect intruders in their network.

“Defendant did not initially recognize the cyberattack for what it was. Rather, it believed that it merely suffered a network outage rather than a data breach.”

💡 MoneyGram misled the public about the nature of the incident, preventing customers from taking protective action during the critical early period.

“Given that Defendant failed to identify the malicious activity until it was already concluded, Defendant likely lacks the appropriate logging, monitoring, and alerting systems necessary to enable it to identify such attacks. Indeed, these tools are critical components of any reasonable cybersecurity program and are expected industry standards that Defendant had a duty to implement and maintain.”

💡 This expert analysis explains why the breach went undetected for so long and identifies MoneyGram’s failure to meet basic industry standards.

“The guidelines also recommend that businesses use an intrusion detection system to expose a breach as soon as it occurs, monitor all incoming traffic for activity indicating someone is attempting to hack into the system, watch for large amounts of data being transmitted from the system, and have a response plan ready in the event of a breach.”

💡 The FTC explicitly told companies like MoneyGram what security measures to implement, and MoneyGram allegedly ignored all of them.

“Compared to credit card information, personally identifiable information . . . [is] worth more than 10x on the black market.”

💡 This quote from a cybersecurity expert proves the stolen MoneyGram data is extremely valuable to criminals and will be actively exploited.

“law enforcement officials told us that in some cases, stolen data may be held for up to a year or more before being used to commit identity theft. Further, once stolen data have been sold or posted on the Web, fraudulent use of that information may continue for years.”

💡 Government accountability office research shows breach victims face years of ongoing risk, not just immediate harm.

“Plaintiff Reyes attempted to send a money transfer using MoneyGram, but the funds were delayed for eight days because of Defendant’s systems outages that occurred because of the Data Breach. The delay was particularly harmful because it caused Mr. Reyes to be incur late fees for the bills the transfer was meant to pay.”

💡 This concrete example shows the breach caused immediate, measurable financial harm beyond the identity theft risk.

“The information held by Defendant in its computer systems at the time of the Data Breach included the unencrypted PII of Plaintiff and Class Members.”

💡 Storing sensitive data without encryption violates basic security standards and made the stolen information immediately usable by criminals.

“the continued risk to their PII, which remains in the possession of Defendant, and which is subject to further breaches, so long as Defendant fails to undertake appropriate and adequate measures to protect Plaintiff’s and Class Members’ PII.”

💡 MoneyGram still holds victims’ data in allegedly insecure systems, meaning the risk of future breaches continues.

“Defendant failed to meet the minimum standards of one or more of the following frameworks: the NIST Cybersecurity Framework Version 1.1 (including without limitation PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.AT-1, PR.DS-1, PR.DS-5, PR.PT-1, PR.PT-3, DE.CM-1, DE.CM-4, DE.CM-7, DE.CM-8, and RS.CO-2), and the Center for Internet Security’s Critical Security Controls (CIS CSC)”

💡 This detailed list shows MoneyGram failed to implement multiple specific security controls that are standard in the industry.

“Data thieves regularly target institutions like Defendant due to the highly sensitive information in their custody. Defendant knew and understood that unprotected PII is valuable and highly sought after by criminal parties who seek to illegally monetize that PII through unauthorized access.”

💡 MoneyGram knew it was a target for cyberattacks and knew the value of the data it held, making its security failures even more inexcusable.

“Plaintiff suffered lost time, interference, and inconvenience because of the Data Breach and has experienced stress and anxiety due to increased concerns for the loss of his privacy.”

💡 The breach caused real emotional and psychological harm, not just theoretical future risk or financial loss.