Crippling Patelco ransomware attack leads to two class action lawsuits

“There are many people in the state of California who are suffering because of what we believe to be severe negligence on the part of the organization,” Cole told KQED.

The lawsuit was filed on July 1, a day after Patelco’s 450,000 customers were notified of the ransomware attack. On July 3, San Diego law firm Wolf Haldenstein Adler Freeman & Herz filed a similar lawsuit on behalf of Livermore resident Josh Warren.

In both cases, the company is accused of failing to protect the personal information of its customers, which they were required to provide in order to access Patelco’s services.

Cole could not say how much personal information may have been exposed, but he said, “In extreme cases… (it could include) Social Security numbers, things like the types of transactions they conducted through the Patelco system, and various historical information about people’s finances.”

Poluck and other customers suffered “loss of time, annoyance, disruption and inconvenience” as well as “anxiety and increasing concern about the loss of their privacy,” the complaint states.

“I’ve probably received no less than 100 calls and emails today from people telling stories ranging from trying to get money to close mortgage loans, buy homes, or get their money so they can pay basic bills to survive,” Cole told KQED.

Warren’s case also states that the credit union “knew or should have known that these attacks were common and foreseeable,” and points out that Patelco was the target of a “similar data breach” in 2023.

Cole said the two companies have been in contact regarding the lawsuits and that similar cases often involve consolidation of senior management.

“I am very confident that the attorneys from both firms will work cooperatively and vigorously in litigating this case,” he told KQED.

Rina Johnson, vice president of marketing for Patelco, told KQED on Wednesday that the company does not comment on litigation matters.

“We are fully focused on resuming operations and ensuring our members are supported throughout the process,” Johnson said via email.

In an update sent to customers on Tuesday, Patelco President and CEO Erin Mendez said that while the company does not yet know when online banking and access to account information will be fully functional again, the “infrastructure is stable and secure and there is positive progress being made daily” to restore services.

Mendez said the credit union expects to finish processing transactions by the end of the week, at which time it will be able to confirm when account access will be restored.

KQED’s Juan Carlos Lara contributed to this report.