• by Ray Schultz , December 22, 2017

Alteryx Inc., a data analytics firm, has been hit with two class-action lawsuits over an alleged data exposure affecting millions of consumers.

One complaint, on file with the U.S. District Court for the Central District of California, charges that the firm placed personally identifiable information on 123 million households in an Amazon Web Services (AWS) S3 cloud storage bucket. This potentially allowed over a million users with an AWS account to access the data.

This data consisted of 248 data fields, including financial information, telephone number, address, length of residence and “highly-granulated” consumer purchasing data. Presumably, it also included email addresses. 

An employee of cyber security firm UpGuard noticed the exposure, which was publicized on Tuesday of this week, the complaint continues.

The complaint, filed on Wednesday on behalf of David Kacur and other class members, states that some of the data is from Experian Information Solutions Inc. It charges that Alteryx failed to protect its data.

The UpGuard employee noticed a storage bucket in the subdomain “alteryxdownload,” the complaint continues. One of the files was entitled “ConsumerView_10_2013.yxdb.”

The complaint states that this was “an Experian ConsumerView product from October of 2013, and the file extension was an Alteryx database file format used for large data set analytics. The file contained 123 million rows, each signifying a different American household.” 

The filing contends that there is “a high likelihood that significant identity theft and fraud has not yet been discovered or reported,” and that personally identifiable information on the class members “will be offered for sale or actually sold in 'dark web' marketplaces.”

The action also charges that Alteryx is a consumer reporting agency, and therefore in violation of the Fair Credit Reporting Act -- and it states that the firm has violated the Ohio Consumer Sales Practices Act. It asks for punitive damages, statutory damages and payment of attorneys’ fees.   

Alteryx had not responded to a request for comment at deadline. Nor had Robert Green, the attorney who filed the case.

Similar charges are contained in another complaint, on file with the U.S. District Court for the District of Oregon, Portland. This case was filed on Wednesday on behalf of  Christopher Jackson and other class members.