Federal, state lawsuits stack up against Patelco following cyber attack, seeking billions

DUBLIN — A crush of local and federal lawsuits continue to pile up against Patelco Credit Union following a devastating cyber attack that crippled the Dublin-based company’s online databases and left about half a million customers locked out of their accounts.

If the suits are successful, Patelco could be facing damage payouts of as much as $5 billion, which equals half of the assets managed by the company.

So far, at least six federal and four state lawsuits, some of which seek class-action status, have been filed against Patelco since the June 29 attack — and more are likely. Lawyers representing credit union members are arguing in court papers that Patelco failed to protect their personal information and negligently allowed an outside hacker to steal and abuse internal confidential information.

Other allegations include breach of contract and invasion of privacy, according to the lawsuits.

Patelco first announced the attack in an email and web post to customers on June 29, at the same time locking customers out of their online bank accounts. This barred anyone, even Patelco tellers and administrators, from checking customer balances, sending or receiving online payments or even logging into their online accounts.

Throughout the two-week ordeal, Patelco continued to push out updates on a dedicated website to notify customers of service updates, such as when online payments through Zelle and PayPal were available. The lockout ended on July 15.

A request for comment about the lawsuits sent to Patelco spokespeople and CEO Erin Mendez was not immediately returned.

Mendez, in a message to customers on July 18, said their “patience and loyalty during this incredibly difficult situation is deeply valued and appreciated by the entire Patelco team.”

Mendez called the restoration of online banking services “a positive step forward” and added “we continue to work around the clock to support our members extending Patelco fee waivers in July and August, reimbursing fees, and providing late payment support.”

Patelco continues to offer fee waivers and reimbursements online and vowed to write letters in support of customers to various entities in the case of late fees on credit cards and other bills.

Several customers, however, are now taking the matter to court. Two of the latest lawsuits against the credit union have come from the same man, Demetrio Abenoja, of Discovery Bay. He filed a lawsuit in Alameda County Superior Court on Wednesday seeking class-action status and one on Monday in the U.S. District Court for the Northern District of California.

In state court documents, Abenoja’s attorneys allege “Patelco’s unfair and deceptive conduct” caused customers “to unfairly incur substantial time and/or costs to mitigate and monitor” their private information. Attorneys allege Patelco’s handling of the cyber attack was “unlawful and in violation of” the Federal Trade Commission’s regulations and laws.

Other state lawsuits came from residents Shawn Kent, Anand Chaudry, Avishalom Klammer and Tangie Strong. Federal lawsuits were filed by residents Josh Warren, Eileen Poluk, Siobhan Gallagher, Sean McGinity and Darren Van Antwerp and Bradley Tanzman.

The earliest lawsuits came on July 1 from Poluk, who filed in federal court.

Poluk seeks to hold Patelco “responsible for the harms it caused” customers in the “massive and preventable” cyber attack, according to court documents.

Her attorneys write that Poluk “suffered lost time, annoyance, interference and inconvenience” due to the attack. And she “has anxiety and increased concerns for the loss of privacy, as well as anxiety over the impact of cybercriminals accessing, using and selling” her information, the documents say.