Los Angeles, CA: Backblaze Inc, an online data recovery provider, is facing a consumer fraud class action lawsuit alleging the company failed to adequately protect users' personal information. Specifically, the complaint, filed by lead plaintif Scott Hellervik, claims that when customers requested their backup files the company sent them unencrypted hard drives through the mail.
According to the complaint, in its marketing Backblaze promises to keep its customers' data secure, from the initial backup stage through the retrieval process, and does so for customers who restore small amounts of data by using the company' website. However, for those customers who need to recover large amounts of data after "catastrophic"data loss, an external storage device is used, which Backblaze mails to the customer, unsecured and unencrypted, according to the lawsuit.
"Had Backblaze informed its customers that it would use inadequate security measures to protect their data, customers (like plaintiff Hellervik) would not have been willing to purchase its services at the price charged, if at all,"the plaintiff said.
Hellervik asserts that he was unaware of the alleged discrepancy between Backblaze' claims and the services it provides until after he had subscribed to the company' services for $5 per month and later purchased a USB drive containing all of his backup files for $189.
Hellervik states that shortly after placing his order, he received a phone call from a person unknown to him but who was in possession of this hard drive. It had been delivered to the wrong address by mistake. The person had opened the package and obtained his phone number by "easily"accessing the plaintiff' files, according to the complaint.
"To make matters worse, Backblaze needlessly increases the security risks imposed by its inadequate data security practices by broadcasting certain sensitive information on the physical packaging labels it uses when sending its customers' unencrypted data through the mail,"the complaint states.
Hellervik contends that the mailed storage devices are clear targets for "nefarious parties"who could pick out packages from Backblaze. According to the lawsuit, the shipping labels on the package intended for Hellervik featured the prominent data recovery company' name as well as the plaintiff' name, phone number, address, email address and a "USB Restore" tag, revealing the contents of the package.
Hellervik assertst his sensitive information was disseminated without his knowledge or consent and that he was deprived of control over that information, and he is requesting damages to cover the difference in the value of the services he paid for and those that Backblaze delivered, as well as the value of his personal data.
A nationwide class is proposed, covering all Backblaze subscribers as well as a subclass to include those who purchased external storage devices from the company, which he accused of a breach of contract as well as violating California's Unfair Competition Law and False Advertising Law.
Hellervik is represented by Samuel M. Lasser, Rafey S. Balabanian, Benjamin H. Richman and J. Dominick Larry of Edelson PC. The case is Hellervik v. Backblaze Inc., case no. 3:15-cv-03956, in the U.S. District Court for California' Northern District.
