The litigation focuses on Block’s statements about its subsidiary’s (Cash App Investing) customer privacy policies and controls.
The complaint alleges Defendants failed to disclose to investors that: (1) Block lacked adequate protocols restricting access to customers’ sensitive information; (2) as a result, a former employee was able to download certain reports of Cash App Investing that contained full customer names and brokerage account numbers, as well as brokerage portfolio values, holdings, and/or trading activity; and, (3) as a result, the company was reasonably likely to suffer significant damage, including reputational harm.
According to the complaint, investors learned the truth on Apr. 4, 2022, when Block announced that a former employee downloaded certain reports of Cash App Investing on Dec. 10, 2021, affecting as many as 8.2 million current and former Cash App Investing customers. The information in the reports included full customer names and brokerage account numbers. For some customers, the stolen reports also included brokerage portfolio value, brokerage portfolio holdings and/or stock trading activity.
This news sent the price of Block shares sharply lower on Apr. 5, 2022, wiping out over $4 billion of shareholder value.
The New York Times later quoted a security expert at KnowBe4, a cybersecurity training company: “Taking customers’ data and security seriously would require securing external access to employees’ accounts and disabling that access upon termination, preferably before the employee leaves.”
