Bitcoin: Drop Class Action Since Data Breach Didn't Lead to Harms
Bitcoin Depot suffered a data breach in June 2024, but since there were no concrete harms, a class-action against the company should be dismissed, Bitcoin argued in a motion Monday at the U.S. District Court for Northern Georgia.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
“Not every data breach should result in a complaint being filed,” but the plaintiffs appear to think a company that suffers a breach “must be put through the cost and burden of responding to a complaint and being potentially subject to improper exploratory discovery … even when there is no evidence of harm,” Bitcoin said in a memorandum.
The Aug. 1 class-action complaint in case 1:25-cv-04317 said that Bitcoin failed to adequately protect the personally identifiable information (PII) of more than 26,000 individuals (see 2508060051). Additionally, complainants mentioned impacted individuals were not notified of the breach until more than a year later, in July 2025.
Bitcoin said in its sample notification letter that it didn't inform customers earlier upon advisement of law enforcement. The company also included this in its court motion, saying “it was clear from the beginning” that customers “were not the target of the criminal hacker,” and that law enforcement investigating the breach “requested Bitcoin Depot not publicly reveal any information about the Incident.”
“At the time of the filing of the Complaint, the Incident was over thirteen months old,” the company added. “Despite this passage of time, Plaintiff does not allege a single occurrence of actual harm arising from the Incident.” This “absence of causation and harm is fatal” to plaintiffs' case, Bitcoin said.