Elemetal LLC is facing a data breach class action lawsuit stemming from its alleged failure to implement adequate security measures, which resulted in a 2023 breach of the personal information of approximately 13,000 customers. Elemetal is a Texas-based precious metals refiner that operates more than 45 locations in the US.

The subject breach occurred between Aug. 22 and Sept. 1, 2023, and affected the personal information of former and current customers, including names, government-issued identification numbers, and Social Security numbers, according to the March 1 customer notice. The complaint, filed in the U.S. District Court for the Northern District of Texas, alleges that Elemetal failed to follow industry standards, such as encrypting personal information or deleting data when it is no longer needed for business purposes.

The complaint further alleges that Elemetal failed to notify customers of the breach in a timely manner, which violates the California Unfair Competition Act and the California Consumer Privacy Act (CCPA). The CCPA is the only consumer privacy law in the country that includes a private right of action for damages resulting from a breach of personal information. The lead plaintiff claims he has received an increase in spam calls, texts and emails since the incident occurred. The complaint alleges negligence, breach of implied contract and unjust enrichment and seeks money damages as well as equitable and injunctive relief and attorneys’ fees and costs. Specifically, such waiver includes a requirement that Elemetal delete or destroy all Class Members’ personal information and implement a comprehensive data privacy and security program.