Recent lawsuit by cryptocurrency investor seeking $200 million in damages highlights the importance of data protection policies and the potential risk exposure to litigation in the cryptocurrency sector.

On August 15, 2018, in Terpin v. AT&T, et al., Case No. 18-cv-6975 (C.D. Cal), Michael Terpin, a cryptocurrency investor, filed suit against AT&T, claiming the cell phone provider failed to protect his personal information. Terpin’s accounts were recently hacked, causing him to lose nearly $24 million in cryptocurrency. In the lawsuit, Terpin blames AT&T for the hack because it allegedly provided hackers with access to Terpin’s telephone number without adhering to its security procedures by enabling SIM swapping, a fraud by which hackers trick a cell phone provider into transferring the target’s phone number to a SIM card controlled by the criminal so the criminal can reset the target’s passwords and break into accounts. According to Terpin, AT&T knew SIM swapping fraud was widespread—and that its own employees were sometimes involved—and yet has done nothing to protect customers’ private information. It was through SIM swapping that hackers were able to drain Terpin’s cryptocurrency accounts.

The complaint against AT&T brings 16 counts, including violations of the Federal Communication Act, breach of the AT&T privacy policy, negligence, and unfair competition. Terpin seeks $24 million in compensatory damages and a whopping $200 million in punitive damages.

Businesses that collect and store individual’s personal information should be mindful that it is increasingly more important to keep that information secure. As the technological landscape changes and cryptocurrencies gain popularity, data breaches may become even more expensive for businesses if they enable hackers to steal cryptocurrencies. If you have questions about your data protection polices, you should contact an attorney.