Aiken V. Credit Freedom and Restoration Corporation, Case No. 2:26-cv-01782

Primary Source: View Original Complaint (PDF)

Facts as Alleged in the Complaint

The following facts are taken directly from the complaint filed by Michael Aiken against Credit Freedom and Restoration Corporation in the United States District Court for the Eastern District of Pennsylvania on March 19, 2026. These are allegations only; no finding of fact has been made.

1. Plaintiff brings this class action against Defendant Credit Freedom for its failure to properly secure and safeguard Plaintiff’s and other similarly situated individuals’ (“Class Members”) personally identifying information, including driver’s license numbers, Social Security numbers, plaintext credit card data and card images, utility bills, and credit reports (collectively “PII” or “Private Information”).
2. Credit Freedom and Restoration Corporation is a nationwide credit repair service company that helps its customers identify credit report errors and dispute inaccurate items, with the goal of reaching lasting financial stability.
3. Plaintiff and Class Members are individuals who were required to indirectly and/or directly provide Defendant with their Private Information. By collecting, storing, and maintaining Plaintiff’s and Class Members’ Private Information, Credit Freedom has a resulting duty to secure, maintain, protect, and safeguard the Private Information that it collects and stores against unauthorized access and disclosure through reasonable and adequate data security measures.
4. Despite Credit Freedom’s duty to safeguard the Private Information of Plaintiff and Class Members, their Private Information in Defendant’s possession was compromised when an unauthorized party gained access to Defendant’s CRM software and exfiltrated sensitive data stored therein on or about March 12, 2026 (the “Data Breach”).
5. The Data Breach occurred when cybercriminals infiltrated Defendant’s inadequately protected network servers and accessed highly sensitive PII that was being kept.
6. As of yet, on information and belief, Defendant has not informed its customers of the Data Breach. Indeed, Plaintiff and Class Members were wholly unaware of the Data Breach before posts about it began appearing on the Dark Web.
7. Credit Freedom maintained the PII of Plaintiff and Class Members in a negligent and/or reckless manner. In particular, the PII was maintained on Credit Freedom’s computer system and network in a condition vulnerable to cyberattacks. Upon information and belief, the mechanism of the cyberattack and potential for improper disclosure of Plaintiff’s and Class Members’ PII was a known risk to Defendant, and thus Defendant was on notice that failing to take steps necessary to secure the PII from those risks left that property in a dangerous condition.
8. Defendant disregarded the rights of Plaintiff and Class Members by intentionally, willfully, recklessly, and/or negligently failing to implement adequate and reasonable measures to ensure that Plaintiff’s and Class Members’ PII was safeguarded, failing to take available steps to prevent unauthorized disclosure of data and failing to follow applicable, required and appropriate protocols, policies, and procedures regarding the encryption of data, even for internal use.
13. Plaintiff Michael Aiken is an adult, who at all relevant times, was a resident and citizen of the Commonwealth of Pennsylvania.
16. Defendant Credit Freedom and Restoration Corporation is a Pennsylvania corporation with its principal executive office located at 6000 Wismer Road, Pipersville, PA 18947.
42. On or about March 12, 2026, an unauthorized third-party, Loki, gained access to Defendant’s CRM software and successfully exfiltrated Private Information stored therein. The Private Information exfiltrated in the Data Breach includes driver’s license numbers, Social Security numbers, plaintext credit card data and card images, utility bills, and credit reports.
43. Defendant has yet to provide notice of the Data Breach to its customers or formally announce that the Data Breach has occurred.
44. On information and belief, the cyberattack was expressly designed to gain access to private and confidential data of specific individuals, including the PII of Plaintiff and the Class Members. The cybercriminals were successful in exfiltrating sensitive information from Defendant’s CRM software.
45. All in all, the Private Information of approximately 30,000 individuals was compromised in the Data Breach.
46. The Data Breach occurred as a direct result of Credit Freedom to implement and follow basic security procedures to protect its current and former customers’ Private Information that it had collected and stored.
59. Here, Credit Freedom has yet to notify impacted individuals about the Data Breach.
60. Plaintiff and Class Members remain in the dark about the identities of the perpetrators, the precise attack method of the breach, the full extent of the data stolen, and the steps are being taken to secure their PII in the future.

Claims for Relief

COUNT I — Negligence (On Behalf of Plaintiff and the Class): The complaint alleges Credit Freedom owed a duty to Plaintiff and Class Members to exercise reasonable care in securing, safeguarding, storing, and protecting the PII collected from them. The complaint alleges Defendant breached this duty by failing to adopt reasonable data security measures, failing to implement sufficient data security systems, storing PII longer than reasonably necessary, failing to comply with industry-standard data security measures, and failing to timely disclose critical information regarding the Data Breach.

COUNT II — Breach of Implied Contract (On Behalf of Plaintiff and the Class): The complaint alleges that by providing their PII as a condition of receiving services, Plaintiff and Class Members entered into implied contracts with Credit Freedom requiring the company to safeguard their information. The complaint alleges Credit Freedom breached these implied contracts by failing to implement and maintain reasonable security measures to protect PII and failing to timely and accurately disclose the Data Breach.

COUNT III — Breach of the Implied Covenant of Good Faith and Fair Dealing (On Behalf of Plaintiff and the Class): The complaint alleges Credit Freedom breached the implied covenant of good faith and fair dealing by failing to maintain adequate computer systems and data security practices to safeguard PII, failing to timely and accurately disclose the Data Breach, and continued acceptance of PII and storage of personal information after Defendant knew, or should have known, of the security vulnerabilities.

COUNT IV — Unjust Enrichment (On Behalf of Plaintiff and the Class): The complaint alleges Credit Freedom enriched itself by hoarding the costs it reasonably should have expended on data security measures. Instead of providing a reasonable level of security, the complaint alleges Defendant calculated to increase its own profit at the expense of Plaintiff and Class Members by utilizing cheap, ineffective security measures and diverting those funds to its own personal use.

COUNT V — Declaratory Judgment (On Behalf of Plaintiff and the Class): The complaint seeks a judgment declaring that Credit Freedom owes a legal duty to secure customers’ Private Information and to timely notify impacted individuals of a data breach under common law, and various state statutes, and that Credit Freedom continues to breach this legal duty by failing to employ reasonable measures to secure Private Information in its possession.

Remedies Sought

• An Order certifying this action as a class action, appointing Plaintiff as class representative, and appointing his counsel to represent the Class.
• Equitable relief enjoining Credit Freedom from engaging in the wrongful conduct pertaining to the misuse and/or disclosure of Plaintiff’s and Class Members’ PII, and from refusing to issue prompt, complete and accurate disclosures.
• Equitable relief compelling Credit Freedom to utilize appropriate methods and policies with respect to customer data collection, storage, and safety, and to disclose with specificity the types of PII compromised as a result of the Data Breach.
• Equitable relief requiring restitution and disgorgement of revenues wrongfully retained as a result of Credit Freedom’s wrongful conduct.
• Ordering Credit Freedom to pay for not less than ten years of credit monitoring services for all Class Members.
• An award of actual damages, compensatory damages, statutory damages, and statutory penalties, in an amount to be determined.
• An award of punitive damages, as allowable by law.
• An award of attorneys’ fees and costs.
• Pre- and post-judgment interest on any amounts awarded.

Frequently Asked Questions

Has Credit Freedom and Restoration Corporation been found liable in this case?

No. This is a complaint — a legal filing that contains allegations made by Michael Aiken. Credit Freedom and Restoration Corporation has not been found liable for any wrongdoing. A finding of liability requires a court proceeding where evidence is presented and evaluated by a judge or jury.

What data does the complaint allege was compromised?

The complaint alleges the following types of Private Information were exfiltrated: driver’s license numbers, Social Security numbers, plaintext credit card data and card images, utility bills, and credit reports. The complaint alleges approximately 30,000 individuals were affected.

What is the current status of this case?

This case was filed on March 19, 2026 in the United States District Court for the Eastern District of Pennsylvania. See the CourtListener docket linked at the bottom of this page for the complete filing record. This page is updated automatically when new documents are filed.

Who is included in the proposed class?

The complaint defines the proposed class as all individuals in the United States whose Private Information was compromised in the Data Breach. The complaint excludes Credit Freedom, its subsidiaries and affiliates, officers and directors, any entity in which Defendant has a controlling interest, and the judicial officer(s) to whom this action is assigned.

Where can I read the full complaint?

The full complaint is publicly available on CourtListener. The Facts as Alleged section above reproduces the complaint’s key factual allegations verbatim. The complete 34-page filing is available through the PDF link at the top of this page or through the docket link below.

Source: CourtListener — Aiken v. Credit Freedom and Restoration Corporation, Docket 72514092. Information on this page is taken from the court complaint. These are allegations; no finding of fact has been made.