The security failure involved the exposure of 11 gigabytes of sensitive files, according to data breach monitoring service Have I Been Pwned. Compromised records include names, physical addresses, dates of birth, phone numbers, password hashes, and detailed financial transaction histories. Because the platform failed to alert users to the exfiltration for several months, it may have breached multiple state and federal privacy regulations.

Legal representatives are now evaluating claims for damages and demanding court-ordered improvements to the company’s internal security infrastructure. Affected individuals are being urged to monitor their accounts for signs of fraud while the firm prepares potential class action litigation against the platform.