A Missouri woman has filed a proposed class action against Bank of America, JPMorgan Chase, and London-based Finastra Technology Inc., accusing them of failing to safeguard sensitive personal data stolen in a cyberattack and later spotted on the dark web.

Filed Tuesday in federal court in Orlando, Florida, the complaint from plaintiff T.H., identified only by her initials, paints a damning picture of corporate negligence. T.H., a customer of both BofA and Chase, says her personal information was snatched from Finastra’s file transfer system, then exploited in fraudulent transactions tied to her bank accounts.

Breach Discovered Months After Attack

According to the lawsuit, Finastra uncovered the breach in early November, roughly a week after hackers gained unauthorized access to its secure file transfer platform used for customer and technical support. Yet, T.H. claims she didn’t receive notice until June 30 — nearly nine months later.

The compromised files contained a trove of unencrypted customer data: names, Social Security numbers, dates of birth, and bank account numbers. The complaint argues that by failing to secure such information or notify victims promptly, Finastra and its banking partners exposed customers to identity theft and financial harm.

“A Cascade of Failures”

The suit accuses Finastra of “failing to implement adequate and reasonable measures” to protect private information, failing to detect and stop the breach quickly, and failing to warn affected customers in a timely fashion. T.H. also claims Bank of America and Chase should be held responsible for not ensuring that their vendor’s systems met industry security standards.

Company Response: “Limited Impact”

A Finastra spokesperson acknowledged the lawsuit in a statement Wednesday, stressing that a forensic investigation confirmed “only a limited number of customers were affected.” The company said it had already completed all necessary notifications and regulatory filings.

“While there is no indication that any data has been misused,” the spokesperson added, “we proactively offered 24 months of credit monitoring to those potentially impacted individuals and continue to cooperate with law enforcement.”

Representatives for Bank of America and JPMorgan Chase declined to comment. Counsel for T.H. did not immediately respond to requests.

A Growing Wave of Cybersecurity Litigation

The case underscores rising tensions between consumers, financial institutions, and fintech providers as cyberattacks grow more sophisticated. Plaintiffs’ counsel argued that Finastra’s delay in notification, combined with unencrypted files and insufficient safeguards, left customers exposed long before they knew they were at risk.

If certified, the lawsuit could encompass thousands of banking customers across the United States who used Finastra-powered services through BofA and JPMorgan.