Intuit class action lawsuit claims company failed to prevent TurboTax and Credit Karma data breach

Overview of the Intuit class action lawsuit:

• WHO: Plaintiff Joseph Garite has filed a class action lawsuit against Intuit Inc.
• Why: Intuit allegedly failed to adequately protect confidential data compromised in a data breach at TurboTax and Credit Karma disclosed in March 2024.
• Where: The TurboTax data breach class action lawsuit was filed in federal court in California.

A new class action lawsuit alleges that Intuit Inc. failed to adequately protect its computer systems, leaving sensitive data vulnerable in a data breach at TurboTax and Credit Karma earlier this year.

Plaintiff Joseph Garite alleges that Intuit, the maker of popular software services such as TurboTax, Credit Karma, Quickbooks and Mailchimp, failed to take adequate security precautions and did not adequately train its employees on cybersecurity.

Garite, a former TurboTax customer, claims these outages left Intuit’s systems vulnerable to cybercriminals who allegedly penetrated the networks and gained access to customers’ sensitive personally identifiable information (PII).

Victims of the Credit Karma and TurboTax data breach were reportedly notified of the cyberattack until March 2024. According to Garite, the data breach notification did not inform victims of relevant information, including when the data breach first occurred, how many people were affected, and how cybercriminals gained access to Intuit’s systems.

Intuit “had no effective means to prevent, detect, stop or mitigate security breaches in its systems – thereby allowing cybercriminals unrestricted access to the personal information of its current and former customers,” Garite claims.

Intuit’s class action lawsuit alleges that the TurboTax data breach occurred from December 23, 2023, to February 21, 2024, but the hack was not discovered until February 27. The breach may have compromised the following types of PII:

• Names
• Addresses
• Dates of birth
• Social Security Numbers
• Driver license numbers
• Additional information contained in the victims’ tax returns

Plaintiff claims to have been victim of fraud due to TurboTax data leak

Garite says he trusted Intuit with his PII and was committed to protecting his sensitive data. Because of the data theft at TurboTax and Credit Karma, his PII may soon be published on the dark web (if it hasn’t already been published), Intuit’s class action lawsuit says.

In fact, Garite claims he has already been a victim of identity theft and fraud. He says he received a letter in May 2024, supposedly from the IRS, that contained highly sensitive information, including his Social Security number and the exact amount he had to pay in taxes in 2023. The IRS has reportedly confirmed that the letter is fraudulent.

Garite filed the class action lawsuit against Intuit on behalf of all U.S. citizens whose personal information was compromised in the data breach.

The Intuit class action lawsuit asserts claims for negligence, negligence per se, breach of contract, invasion of privacy, unjust enrichment, breach of fiduciary duty, declaratory relief, and violation of the California Unfair Competition and Consumer Privacy Act.

Last year, Intuit agreed to pay $141 million to settle allegations that the company improperly charged some consumers for TurboTax when they were eligible to file taxes for free through the IRS’s Free File Program.

Were you affected by the TurboTax data breach or the Credit Karma data breach? Tell us about your experience in the comments.

Garite is represented by Andrew G. Gunem of Strauss Borrelli PLLC.

The Class action lawsuit against Intuit Is Joseph Garite v. Intuit Inc.Case No. 5:24-cv-03960, in the United States District Court for the Northern District of California, San Jose Division.

Read more about class action lawsuits and class action settlements: