TikTok Faces Class Action Over Massive Data Breach Affecting 2.4 Billion Users
On June 11, 2026, California resident Sean Mortazi filed a class action lawsuit against TikTok Inc., alleging a data breach exposed the personal information of over 2.4 billion users worldwide. The complaint, submitted to the U.S. District Court for the Central District of California, claims cybercriminals accessed an unencrypted TikTok database, compromising names, usernames, email addresses, phone numbers, dates of birth, gender, language preferences, and location data.
The breach was reportedly disclosed by a hacker group on the same day, which shared sample records to verify the claim. The lawsuit argues TikTok failed to implement basic security measures, including encryption, multifactor authentication, and proper access controls. It also alleges the company neglected intrusion detection, network monitoring, and tools to detect large-scale data exfiltration.
The complaint highlights TikTok’s privacy policy, which states, "Your privacy is a top priority at TikTok," and accuses the company of breaching an implied contract with users by failing to uphold its security promises. Despite reporting a smaller breach in April 2025 exposing nearly 1 million user passwords TikTok allegedly did not address the vulnerabilities, leaving its systems exposed.
The lawsuit includes 10 counts, such as negligence, breach of implied contract, invasion of privacy, unjust enrichment, and violations of the California Consumer Privacy Act, California Customer Records Act, and California Unfair Competition Law. Mortazi seeks monetary damages, a court order to enforce stronger security measures, and a legal declaration of TikTok’s alleged failures.
The proposed class action covers affected users nationwide, with a subclass for California residents. No settlement or claims process has been established, and the allegations remain unproven in court. TikTok, which reported $50 billion in profit for 2025, is accused of prioritizing data monetization over adequate security protections.
Source: https://www.claimdepot.com/cases/tiktok-data-breach-lawsuit-claims-24b-users-info-stolen
TikTok cybersecurity rating report: https://www.rankiteo.com/company/tiktok
"id": "TIK1783722430",
"linkid": "tiktok",
"type": "Breach",
"date": "6/2026",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '2.4 billion users',
'industry': 'Social Media',
'location': 'Global',
'name': 'TikTok Inc.',
'size': '2.4 billion users',
'type': 'Company'}],
'attack_vector': 'Unauthorized database access',
'data_breach': {'data_encryption': 'No (unencrypted database)',
'data_exfiltration': 'Yes (sample records shared by hackers)',
'number_of_records_exposed': '2.4 billion',
'personally_identifiable_information': 'Names, usernames, '
'email addresses, '
'phone numbers, dates '
'of birth, gender, '
'language preferences, '
'location data',
'sensitivity_of_data': 'High (PII including names, emails, '
'phone numbers, dates of birth, '
'location data)',
'type_of_data_compromised': 'Personal information'},
'date_detected': '2026-06-11',
'date_publicly_disclosed': '2026-06-11',
'description': 'On June 11, 2026, California resident Sean Mortazi filed a '
'class action lawsuit against TikTok Inc., alleging a data '
'breach exposed the personal information of over 2.4 billion '
'users worldwide. The complaint claims cybercriminals accessed '
'an unencrypted TikTok database, compromising names, '
'usernames, email addresses, phone numbers, dates of birth, '
'gender, language preferences, and location data. The breach '
'was reportedly disclosed by a hacker group on the same day, '
'which shared sample records to verify the claim. The lawsuit '
'argues TikTok failed to implement basic security measures, '
'including encryption, multifactor authentication, and proper '
'access controls.',
'impact': {'brand_reputation_impact': 'Accusations of prioritizing data '
'monetization over security, breach of '
'privacy promises',
'data_compromised': 'Names, usernames, email addresses, phone '
'numbers, dates of birth, gender, language '
'preferences, location data',
'identity_theft_risk': 'High',
'legal_liabilities': 'Class action lawsuit, potential fines under '
'California Consumer Privacy Act, California '
'Customer Records Act, and California Unfair '
'Competition Law',
'systems_affected': 'TikTok user database'},
'investigation_status': 'Ongoing (allegations unproven in court)',
'post_incident_analysis': {'root_causes': 'Failure to implement encryption, '
'multifactor authentication, proper '
'access controls, intrusion '
'detection, and network monitoring'},
'references': [{'source': 'Class action lawsuit filed by Sean Mortazi'}],
'regulatory_compliance': {'legal_actions': 'Class action lawsuit',
'regulations_violated': ['California Consumer '
'Privacy Act',
'California Customer '
'Records Act',
'California Unfair '
'Competition Law']},
'threat_actor': 'Hacker group',
'title': 'TikTok Faces Class Action Over Massive Data Breach Affecting 2.4 '
'Billion Users',
'type': 'Data Breach',
'vulnerability_exploited': 'Lack of encryption, inadequate access controls, '
'no multifactor authentication, insufficient '
'intrusion detection and network monitoring'}