Belk hit with three lawsuits over data breach and notification failure
Editor’s note: This story was updated on June 24, 2025, to reflect that a third suit was filed against Belk
Three lawsuits were filed in one week in federal court against Belk for a data breach and then for allegedly concealing the cyberattack.
In all of the cases, the plaintiffs are also seeking certification for class-action suits.
Belk failed to protect sensitive personal current and former employee and customer information, according to the lawsuits, and has yet to provide information or details about the data breach that occurred sometime between May 7 and May 11.
In the three cases, the plaintiffs seek monetary damages and demand a jury trial.
Belk did not respond to requests for comment about the lawsuits.
Last month, all Belk department stores had a computer “system shutdown,” The Charlotte Observer reported on May 19. Belk had not publicly shared information about the system problems, and company officials have not respond to repeated requests for comment.
The 136-year-old Charlotte-based department store chain has nearly 300 stores in 16 Southeast states.
Claims in the first lawsuit
The first case was filed Monday, June 16, by Andrew Davis of Kings Mountain and a former employee related to the data breach.
Cyber criminals accessed and stole internal documents from Belk’s systems, including names and Social Security numbers, according to the lawsuit.
Belk disclosed the breach in a June, 5, 2025, letter to the New Hampshire Attorney General, but has “failed to notify victims in a timely and transparent way,” according to the lawsuit.
Personal information for one New Hampshire resident was accessed by an unauthorized third party, Belk’s attorney Peter Carey said in a letter attached to the lawsuit.
Belk discovered the incident on May 8, according to a notice of data breach that would be sent to the resident.
“Belk was the victim of a cyber incident in which an unauthorized third party gained access to certain corporate systems,” the company said in the notice. “We took immediate steps in response to the incident to stop the unauthorized access and secure our systems. We also conducted a thorough investigation, which included our full cooperation with law enforcement.”
Belk also said “the investigation of the potentially affected data is ongoing.”
Attorneys with Milberg Coleman Bryson Phillips Grossman in Raleigh and Coral Gables, Florida, and Federman and Sherwood in Oklahoma City and Dallas represent the plaintiff.
Claims in the second lawsuit
The second case was filed Tuesday, June 17, by Andrea Larson of Charlotte related to a data breach exposing Social Security numbers of Belk’s employees due to “inadequate cybersecurity measures,” according to the lawsuit.
Owens says her data was among the stolen and that she has since been targeted with phishing attempts and suspicious account alerts, including attempts to access a Coinbase account that she did not open, according to the lawsuit.
Attorneys with Milberg Coleman Bryson Phillips Grossman in Raleigh, and Stranch, Jennings and Garvey in Nashville, Tennessee, represent the plaintiff.
According to both lawsuits, Belk failed to follow Federal Trade Commission guidelines and did not implement reasonable cybersecurity safeguards, left data unencrypted and vulnerable, and knew about cybersecurity threats and failed to act responsibly.
As a result, the plaintiffs and potential class members must closely monitor their financial accounts long-term for fraud and identity theft, according to the lawsuits.
Claims in a third lawsuit
A third lawsuit was filed Friday, June 20, by Annie McBride of Georgia, claiming Belk admitted information in its system was accessed by unauthorized individuals, but has provided little information regarding how the data breach occurred and failed to take precautions to keep private information safe.
“Individuals affected by the data breach are, and remain, at risk that their data will be sold or listed on the dark web and, ultimately, illegally used in the future,” the lawsuit stated.
As a result, the plaintiff and class members have suffered damages including theft of private information, costs associated with identity theft prevention and detection, emotional stress and other risks, according to the lawsuit.
Attorneys with Milberg Coleman Bryson Phillips Grossman in Raleigh, and Levi & Korsinsky in New York, N.Y., represent the plaintiff.
This story was originally published June 19, 2025 at 12:43 PM with the headline "Belk hit with three lawsuits over data breach and notification failure."
