Victoria's Secret Data Breach Lawsuit: Customers Sue Over Exposed Info

Case Overview: A class action lawsuit alleges Victoria's Secret failed to implement basic security measures, leading to a data breach that exposed customers' personally identifiable information.

Consumers Affected: U.S. customers whose personal information was compromised in the Victoria's Secret data breach.

Court: U.S. District Court for the Southern District of Ohio, Eastern Division at Columbus

Victoria's Secret customers trusted the intimate apparel retailer with their personal information when shopping online and in stores, but a recent data breach has left many wondering if that trust was misplaced.

Susan Wardle-Burke filed a class action lawsuit against Victoria's Secret after a data breach on May 27, 2025, exposed customers' personally identifiable information. She claims the company failed to implement basic security measures that could have prevented hackers from accessing sensitive customer data.

The lawsuit seeks to represent customers nationwide whose personal information was compromised in what Wardle-Burke describes as a preventable security failure that puts millions of shoppers at risk of identity theft and fraud.

How Victoria's Secret Allegedly Failed Its Customers

According to the lawsuit, Victoria's Secret didn't follow industry standards for protecting customer data, leaving personal information vulnerable to cybercriminals who successfully breached the company's systems. The breach occurred despite years of high-profile data breaches at other retailers that should have served as warnings about the need for robust cybersecurity measures.

Wardle-Burke claims the company failed to encrypt sensitive data, which means customer information was stored in readable format that hackers could easily access and misuse. Encryption is considered a basic security requirement that scrambles data so it becomes useless even if criminals manage to steal it.

The retailer also allegedly failed to conduct regular security audits that could have identified vulnerabilities before hackers exploited them. These routine assessments help companies find and fix security weaknesses before they become major problems.

Employee training on data security was apparently inadequate, according to the lawsuit, suggesting that staff members may not have known how to properly handle customer information or recognize potential security threats. Human error often plays a role in data breaches, making proper employee education crucial for preventing incidents.

Customers Now Face Risk of Identity Theft

The data breach has created ongoing problems for Victoria's Secret customers who now must constantly monitor their credit reports and personal accounts for signs of identity theft or fraud. Many people don't realize their information has been compromised until they notice unauthorized transactions or discover new accounts opened in their names.

Wardle-Burke's lawsuit notes that affected customers must now educate themselves about security freezes, fraud alerts, and other protective measures they wouldn't have needed if Victoria's Secret had properly secured their data. These steps require time and effort that customers shouldn't have to invest because of a company's security failures.

The personal information exposed in the breach could be used by criminals for various fraudulent activities, including opening credit cards, taking out loans, filing false tax returns, or making purchases using stolen identities. The full scope of potential misuse may not become apparent for months or even years after the initial breach.

Some customers may also face emotional distress from knowing their private shopping habits and personal details are now in the hands of unknown criminals who could use this information for malicious purposes.

Multiple Laws Allegedly Violated by Retailer

Wardle-Burke's lawsuit claims Victoria's Secret violated both federal and state consumer protection laws through its inadequate data security practices. The Federal Trade Commission Act prohibits unfair and deceptive business practices, which could include failing to protect customer data despite promises of security.

The lawsuit argues that Victoria's Secret had a duty to protect customer information and breached that responsibility by failing to implement industry-standard security protocols. Companies that collect personal data have legal obligations to keep it safe, not just moral ones.

By not following established cybersecurity best practices, Victoria's Secret allegedly put its customers at unnecessary risk while continuing to collect and store their sensitive information for business purposes.

Growing Trend of Data Breach Lawsuits

The Victoria's Secret case joins a growing number of class action lawsuits filed against companies that have experienced data breaches, reflecting increasing awareness about the serious consequences of inadequate cybersecurity measures..

H&R Block faced similar litigation earlier this year after a data breach compromised customers' sensitive financial information, with plaintiffs claiming the tax preparation company failed to implement adequate cybersecurity measures. 

Christie's auction house also dealt with a major data breach lawsuit after hackers accessed personal information belonging to nearly half a million customers, including full names, passport numbers, and other identifying details. 

In the Victoria’s Secret data breach class action lawsuit, Wardle-Burke wants to represent all customers nationwide whose personal information was exposed in the Victoria's Secret data breach, potentially including millions of shoppers who trusted the retailer with their sensitive details. 

She's demanding a jury trial to determine whether Victoria's Secret's security practices violated federal and state laws designed to protect consumer information. The lawsuit seeks monetary damages to compensate customers for the time, effort, and costs associated with protecting themselves from identity theft and fraud following the breach. 

Case Details

• Lawsuit: Wardle-Burke v. Victoria’s Secret & Co.
• Case Number: 2:25-cv-00618
• Court: U.S. District Court for the Southern District of Ohio, Eastern Division at Columbus

Plaintiffs' Attorney:

• Brian D. Flick and Marc E. Dann (DannLaw)
• Thomas A. Zimmerman Jr. (Zimmerman Law Offices P.C.)

Were you affected by the Victoria's Secret data breach? Share your concerns about your personal information below.