2025 Daytona 500 (photo by JazzyJoeyD)
JACKSONVILLE, Fla. – A Texas man has filed a class action complaint against his former employer, NASCAR, for allegedly failing to protect his and others’ “highly sensitive data.”
Keaton Hargett, a resident of Keller, Texas, filed his class action complaint in the U.S. District Court for the Middle District of Florida. Judge Wendy Berger has been assigned the case.
Hargett’s proposed class action against NASCAR Enterprises LLC comes months after it – the sanctioning body for stock car motorsports racing – was the target of a cyberattack in April.
Hargett’s filing alleges NASCAR, based in Daytona Beach, stores a “litany of highly sensitive personal identifiable information,” or PII, about its customers, and current and former employees.
He claims NASCAR “lost control” over that data due to its “insufficiently protected computer systems.”
“From on or about March 31, 2025 to on or about April 3, 2025, Defendant was hacked by a cybercriminal group,” the 37-page complaint states. “In other words, NASCAR had no effective means to prevent, detect, stop, or mitigate breaches of its systems – thereby allowing cybercriminals unrestricted access to its customers’ and current and former employees’ PII for four days.
“On information and belief, cybercriminals were able to breach NASCAR’s systems because defendant failed to adequately train its employees on cybersecurity and failed to maintain reasonable security safeguards or protocols to protect the Class’s PII.”
Hargett contends NASCAR’s failures placed the proposed class’s information in a “vulnerable position.”
“The exposure of one’s PII to cybercriminals is a bell that cannot be unrung,” the complaint states. “Before this data breach, its customers and current and former employees' private information was exactly that – private. Not anymore. Now, their private information is forever exposed and unsecure.”
According to the filing, the amount in controversy exceeds $5 million, exclusive of interest and costs, and there are more than 100 putative class members.
The data breach occurred between March 31 and April 3, but NASCAR didn’t confirm that sensitive personal information had been compromised until June 25. Notification letters weren’t sent to affected individuals until July.
According to various state attorneys general, the files affected are believed to contain names and Social Security numbers.
“Notice is ongoing, with many breach victims, including plaintiff, yet to receive individual notice,” the complaint states. “Thus, NASCAR kept the class in the dark – thereby depriving the class of the opportunity to try and mitigate their injuries in a timely manner.”
Since the data breach, Hargett notes that NASCAR claims it has taken steps to “enhance the security” of its network environment.
“But such simple declarations are insufficient to ensure that plaintiff’s and class members’ PII will be protected from additional exposure in a subsequent data breach,” the complaint states, noting that such stolen sensitive information is one of the “most valuable commodities” on the criminal information black market.
According to Experian, a credit-monitoring service, stolen PII alone can be worth up to $1,000 depending on the type of information obtained.
“The value of plaintiff’s and the class’s sensitive information on the black market is considerable,” the filing states. “Stolen sensitive information trades on the black market for years, and criminals frequently post stolen sensitive information openly and directly on various ‘dark web’ internet websites, making the information publicly available, for a substantial fee of course.
“It can take victims years to spot identity theft, giving criminals plenty of time to use that information to commit acts of identity theft and fraud.”
Affected individuals have been provided with one or two years of free credit and identity monitoring services, NASCAR noted in regulatory filings with the attorneys general of Maine, Massachusetts, and New Hampshire.
Chicago-based Strauss Borrelli PLLC, a leading data breach law firm, and Milberg Coleman Bryson Phillips Grossman PLLC in Miami are representing Hargett and the proposed class.
