Case Study: Cash App’s Settlement After Data Breaches — Lessons for the Industry
By Carsten Krause, October 2, 2024
Cash App’s Turbulent History with Data Breaches
Cash App, a widely used mobile payment platform, has faced significant scrutiny after multiple data breaches exposed the sensitive information of millions of users. The most notable breach, which occurred in December 2021, involved a former employee who downloaded customer reports without authorization. This incident alone compromised the personal data of 8.2 million users—14% of Cash App’s user base at the time.
Over the next few years, further breaches were reported, leading to unauthorized access to user accounts and fraudulent transactions. These breaches spanned from August 2018 to August 2024, with significant lapses in security protocols. Users affected during this period are eligible for compensation under a class action settlement that will see Cash App pay up to $2,500 to each affected customer, amounting to a total settlement of $15 million.
(Source: https://www.eladelantado.com/cash-app-settlement/)
Unpacking the $2,500 Settlement: Why Such a High Payout?
Cash App’s decision to offer such a substantial settlement—up to $2,500 per customer—is unusual in the world of data breach settlements. Most companies opt for smaller amounts or credit monitoring services. However, Cash App’s breaches directly resulted in fraudulent transactions, severe privacy violations, and the leaking of financial and personal information. The company’s settlement is designed to compensate for these tangible harms, offering victims significant reparations to cover potential financial losses and emotional distress caused by the breaches.
(Source: https://www.eladelantado.com/cash-app-settlement/)
This approach reflects a trend toward higher compensation in cases where customer data is directly exploited, particularly when financial loss can be attributed to negligence. For Cash App, this move is also likely an attempt to regain trust and mitigate further damage to its reputation, despite not admitting fault. However, it sets a new benchmark for how companies might be held accountable for failing to secure user data.
What Companies Can Learn from Cash App’s Missteps
- Robust Employee Security Protocols: Cash App’s initial breach was caused by a former employee’s unauthorized access to sensitive information. To prevent similar incidents, companies must ensure that access to critical data is tightly controlled, even for employees who leave the organization. Implementing strong offboarding procedures, including immediate revocation of all access to company systems, is crucial.
- Continuous Monitoring for Unauthorized Access: The breaches continued even after the former employee’s incident. This points to weaknesses in Cash App’s internal monitoring systems. Regular audits and real-time monitoring of suspicious activity within user accounts are essential to detect and prevent unauthorized access promptly.
(Source: https://www.cyberdefensemagazine.com/top-10-ways-to-improve-cybersecurity/) - Prompt Disclosure and Transparency: One of the biggest criticisms of companies in the aftermath of data breaches is the delay in reporting the breach. Cash App’s delayed response eroded user trust. Companies must ensure that any breach is disclosed to affected customers immediately, along with a transparent plan for addressing the issue and providing compensation.
(Source: https://www.forbes.com/sites/forbestechcouncil/2022/06/14/why-transparency-is-key-for-security-breach-notifications/?sh=7e55872c5c59) - Proactive Compensation and Restoration: Instead of waiting for legal action, companies can follow Cash App’s lead by offering proactive compensation to affected users. However, ensuring that such settlements do not bankrupt the company requires careful financial planning and insurance coverage for cybersecurity breaches.
(Source: https://www.fitchsolutions.com/articles/cyber-insurance-protection-increasingly-vital-amid-global-threat-landscape) - Admitting Responsibility Without Admitting Fault: Cash App, like many other companies, denied any wrongdoing but still agreed to settle. This approach is common in corporate America but can still impact public trust. Companies must strike a balance between legal protections and genuine responsibility.
Preventative Steps to Avoid Being in the Headlines
To protect customer data and avoid the reputational damage Cash App has endured, companies should adopt the following best practices:
- Zero Trust Architecture: Implement a zero-trust security model that assumes no user, whether inside or outside the network, is trustworthy. This involves continuous verification of access requests and stringent encryption for all data.
(Source: https://www.zscaler.com/resources/security-terms-glossary/what-is-zero-trust-security) - Regular Security Audits: Conduct regular audits to assess vulnerabilities, especially after any significant changes in the company’s technology infrastructure. Third-party security assessments can help ensure objectivity.
(Source: https://www.sans.org/blog/the-importance-of-regular-cybersecurity-audits/) - Employee Training: Data breaches often result from human error or negligence. Regular cybersecurity training can help employees recognize phishing attempts, avoid data leaks, and follow security best practices.
(Source: https://www.cybersecurityguide.org/training/the-importance-of-employee-cybersecurity-training/) - Comprehensive Response Plans: Ensure your organization has a robust incident response plan in place. This plan should be tested regularly, and employees should know how to react in the event of a breach. Timely communication and action can prevent the situation from worsening.
(Source: https://www.cisa.gov/topics/cybersecurity-best-practices) - Cyber Insurance: Ensure your company has comprehensive cyber insurance that covers both data breaches and potential class action lawsuits. This can mitigate the financial impact of breaches while still allowing your company to offer restitution to affected users.
(Source: https://www.forbes.com/sites/forbestechcouncil/2021/08/19/the-role-of-cyber-insurance-in-protecting-against-data-breaches/?sh=67465c4657b1)
Comparison of Breach Settlements: Cash App vs. Industry Peers
| Company | Breach Year | Settlement Amount | Number of Affected Users | Compensation per User | Notable Lessons |
|---|---|---|---|---|---|
| Cash App | 2021-2024 | $15 Million | 2 Million | Up to $2,500 | High compensation shows an effort to restore trust. |
| Equifax | 2017 | $700 Million | 147 Million | Up to $125 (or credit monitoring) | Major breach led to heavy regulatory and financial consequences. |
| Yahoo | 2013-2016 | $117.5 Million | 3 Billion | $100 or credit monitoring | Largest breach settlement, but per-user compensation was relatively low. |
| Target | 2013 | $18.5 Million | 41 Million | Varies by state | Focus on security upgrades and monitoring. |
| Home Depot | 2014 | $25 Million | 56 Million | Varies, mainly credit monitoring | Highlighted need for faster breach response and better security systems. |
How to get your money:
If you have been affected by the breach (you can look up your ID in the official website link): Some of the documents that can be used as evidence include: Communications with Cash App reporting the breach, police reports; correspondence with consumer protection entities, such as the Federal Trade Commission; and reports to financial institutions or government agencies.
Remember: all claims must be filed by November 18, 2024, through the settlement’s official website.
If a user prefers not to participate in the settlement and wishes to retain the right to take independent legal action against Cash App in the future, they can file an exclusion claim. This type of claim allows individuals to opt out of the settlement, thereby reserving the option to pursue further legal recourse. The deadline to file an exclusion claim or to object to the settlement is November 1, 2024.
The CDO TIMES Bottom Line
Cash App’s handling of its data breaches serves as a critical case study for other companies in today’s data-driven world. The large-scale breaches exposed significant gaps in the company’s security protocols and user protection mechanisms. The $15 million settlement—up to $2,500 per user—sets a new precedent for compensating victims of cybersecurity failures, especially in the financial services industry.
Companies must take heed of these lessons:
- Invest in Employee Security Training: Proper offboarding procedures could have prevented Cash App’s initial breach.
- Enhance Monitoring and Detection Systems: Multiple breaches went undetected for extended periods, highlighting the need for real-time monitoring and regular security audits.
- Communicate Transparently with Customers: Companies must be transparent about breaches and offer timely, effective solutions to affected users.
- Prepare Financially for Cyber Threats: Cyber insurance and a strong incident response plan can mitigate the financial and reputational damage caused by breaches.
Ultimately, businesses must learn from Cash App’s failures to prevent devastating breaches of their own, or risk facing the same costly and reputation-damaging consequences. By proactively adopting strong security practices, they can avoid costly settlements and, most importantly, protect the trust and data of their customers.
Love this article? Embrace the full potential and become an esteemed full access member, experiencing the exhilaration of unlimited access to captivating articles, exclusive non-public content, empowering hands-on guides, and transformative training material. Unleash your true potential today!
Order the AI + HI = ECI book by Carsten Krause today! at cdotimes.com/book
Subscribe on LinkedIn: Digital Insider
Become a paid subscriber for unlimited access, exclusive content, no ads: CDO TIMES
Do You Need Help?
Consider bringing on a fractional CIO, CISO, CDO or CAIO from CDO TIMES Leadership as a Service. The expertise of CDO TIMES becomes indispensable for organizations striving to stay ahead in the digital transformation journey. Here are some compelling reasons to engage their experts:
- Deep Expertise: CDO TIMES has a team of experts with deep expertise in the field of Cybersecurity, Digital, Data and AI and its integration into business processes. This knowledge ensures that your organization can leverage digital and AI in the most optimal and innovative ways.
- Strategic Insight: Not only can the CDO TIMES team help develop a Digital & AI strategy, but they can also provide insights into how this strategy fits into your overall business model and objectives. They understand that every business is unique, and so should be its Digital & AI strategy.
- Future-Proofing: With CDO TIMES, organizations can ensure they are future-proofed against rapid technological changes. Our experts stay abreast of the latest AI, Data and digital advancements and can guide your organization to adapt and evolve as the technology does.
- Risk Management: Implementing a Digital & AI strategy is not without its risks. The CDO TIMES can help identify potential pitfalls and develop mitigation strategies, helping you avoid costly mistakes and ensuring a smooth transition with fractional CISO services.
- Competitive Advantage: Finally, by hiring CDO TIMES experts, you are investing in a competitive advantage. Their expertise can help you speed up your innovation processes, bring products to market faster, and stay ahead of your competitors.
By employing the expertise of CDO TIMES, organizations can navigate the complexities of digital innovation with greater confidence and foresight, setting themselves up for success in the rapidly evolving digital economy. The future is digital, and with CDO TIMES, you’ll be well-equipped to lead in this new frontier.
Do you need help with your digital transformation initiatives? We provide fractional CAIO, CDO, CISO and CIO services, do a Preliminary ECI and Tech Navigator Assessment and we will help you drive results and deliver winning digital and AI strategies for you!
Subscribe now for free and never miss out on digital insights delivered right to your inbox!
