Class Action Lawsuit filed against Neopets for Data Breach

[I_royalty_I]

This is a joke of a class action lawsuit. It's a game, no serious information was disclosed from this breach. IIRC their NC purchases are handled via paypal or some other PCI compliant vendor. So financial information wasn't disclosed at all.

The only thing this will do is pull their attention away from things that really matter. I'm sure whoever put this together feels like they are some amazing white knight doing big things.. but really, it's not going to go anywhere. What kind of settlement could you hope to get? 10,000NC on your account?

[♥ GreyFaerie ♥]

This is real? There must be a way to verify the claim right? I think it's more believable that it's some kind of joke.

[Buizel]

This is real? There must be a way to verify the claim right? I think it's more believable that it's some kind of joke.

The full 26 page document is posted in the reddit comments, I just didn't want to post it here just in case lol, but yes, it's real.

Side note, but people are asking for an avatar over this already

[I_royalty_I]

The full 26 page document is posted in the reddit comments, I just didn't want to post it here just in case lol, but yes, it's real.

Side note, but people are asking for an avatar over this already

I scrolled through the comments a bit too and saw that. I think most people will take this as a joke. Imagine having to be the one to hear this case and make a decision lol

[Aero]

(you need an account to see links)

like same tho 💀

[oventoast]

Ah, this is sort of my wheel house. When the breaches were happening, I was wondering if some class action would be filed by a n00b firm haha.

Sorry for the rush on this post, just my stream of consciousness about this.

This is a joke of a class action lawsuit. It's a game, no serious information was disclosed from this breach. IIRC their NC purchases are handled via paypal or some other PCI compliant vendor. So financial information wasn't disclosed at all.

The only thing this will do is pull their attention away from things that really matter. I'm sure whoever put this together feels like they are some amazing white knight doing big things.. but really, it's not going to go anywhere. What kind of settlement could you hope to get? 10,000NC on your account?

Can agree with this. Some far more serious data breach class actions have been rejected by courts in the last few years, here the information "breached" wasn't disclosed and even if it was, most of it was identical to the past few leaks (i.e., no real "sensitive" or personal information). Since JS is in California, there might be some statutory causes of action there that would make this work, so perhaps they'll try to invoke those and succeed. Everyone wants to bring these in California recently, I have not looked into why (not a CA lawyer) but I'm sure it is a more plaintiff-friendly jurisdiction for these types of cases. I haven't read the complaint so I don't really know the chance of success this has, but generally these settle for very, very low amounts depending on the information that was compromised (like pennies per person affected).

Unfortunately I doubt its someone who feels like a white knight, moreso just a very opportunist plaintiffs law firm trying to extort a quick buck out of Jumpstart (as is the usual case for a lot of these, they're called strike-suits). It gives all plaintiffs law firms a bad name and bad reputation (as ambulance chasers, etc.) when we do this.

So what, a user seriously brought on a class action lawsuit because TNT gave their account away to some cheater due to the breach? It's fucking Neopets, who cares. Only if that breach leaked everything about you and cost you your job, your spouse, your house and your childhood gum collection, then I could see why you'd want to do this, but otherwise, I don't see it going anywhere either.

I think it's more likely seeking a payment for the breach itself (i.e., having the personal information breached) rather than for an account being compromised due to the breach, that is usually the course for these types of actions.

I don't know much about the law to know whether they have a leg to stand on or not.. but I can't imagine this being a worthy endeavor? Nobody likes loosing data but this is a little overboard imo
Wouldn't JS have a legal team or some form of insurance for exactly this sort of thing? I can't imagine how expensive this will get for the person pursuing the legal actions. Oof.

Usually the in-house legal team does not handle major litigation like this, but transactional/contract work. They will have to hire an external law firm to defend them in this matter, which yeah would likely be expensive. But insurance does pay for this (if they have insurance, some firms you'd be surprised do not have insurance).

It sucks that they will have to spend so much money defending themselves from a fairly meritless lawsuit (on its face). I am plaintiff-side to an ideological fault sometimes, but this is probably one of the first times where I have felt bad for the defendants in a class action (kind of? but then I remember how they ignored months of neotruths posting on reddit about the breach + they should probably have insurance and feel slightly less bad for them). At the same time, the US system of no adverse costs is a good system, and class actions are a good procedural tool of North American legal systems. So even if bad cases crop up, it's hard to fault the system.

Surely the amount they spent/are going to spend on this lawsuit costs way more than a Neopets account? Wth. Considering they've had multiple breaches, I guess it was inevitable. But like... its a struggling pet site...

Generally a plaintiff-side law firm will bring a class action lawsuit on behalf of a representative plaintiff on contingency - i.e., the person does not have to pay for the lawsuit itself, the firm works for free until a settlement is reached and takes a percentage of the settlement in its fees. So the "person" who brought this will not have to spend any money on this lawsuit or pay their lawyers unless it settles. Jumpstart will have to pay lawyers though.

I read through the meatier bits of the entire document and it doesn't really reference any "damages" they have incurred outside of the essential information that was made available in the older data breaches and that, in theory, their (and their children's) personal data could be sold off and endanger them or put their identity otherwise at risk. It's (I believe intentionally) vague about what did vs what could happen.

That is generally boilerplate language that accompanies most privacy breach class actions, where the damages alleged are the actual information being compromised (as opposed to anything that comes from the information being compromised).

[Buizel]

Question, shouldn't they go the parent company Netdragon instead of Jumpstart? I know JS is the one we see the most and all, but I wonder if ND will help JS?

Sorry if this sounds dumb, I'm not the greatest at laws lol

[oventoast]

Question, shouldn't they go the parent company Netdragon instead of Jumpstart? I know JS is the one we see the most and all, but I wonder if ND will help JS?

Sorry if this sounds dumb, I'm not the greatest at laws lol

They probably want to go after Jumpstart because it is HQ in California, which is generally seen as a plaintiff-friendly jurisdiction. Usually you name both, I am not sure why they didn't (could just be noobs)

Generally you would have to rope in the parent if they were involved in some capacity OR there are multiple subsidiaries and you need to connect them together OR you need deeper pockets.

[wushugushu]

Definitely looked like a joke

[kittyray]

I've ignored so many class action lawsuit emails from services I use for data breaches, and the payout is always like eight dollars or a 10% discount code off the next purchase. I can't imagine anything worth it coming of this.