Block confirms Cash App breach after former employee accessed US customer dataBlock confirms Cash App breach after former employee accessed US customer data

In an April 2022 filing with the U.S. Securities and Exchange Commission, Block, the payments company formerly known as Square, disclosed that a former employee had downloaded internal reports containing information on Cash App Investing customers. The download took place on December 10, 2021, and Block said it began contacting about 8.2 million current and former customers in April 2022, roughly four months later.

Block said the individual had regularly accessed the reports as part of their job, but that this download occurred without permission after their employment had ended. The company did not explain why the person still had access to the systems, and declined to answer questions on that point. The episode is a clear example of insider risk, in which the threat comes not from an outside hacker but from someone who was once trusted. It also exposed a gap between human resources processes and technical access controls, since the person's departure evidently did not trigger removal of their data permissions.

The reports contained customers' full names and brokerage account numbers, the unique identifiers tied to their Cash App stock trading accounts. For some customers they also included portfolio value, holdings and stock trading activity for a single trading day. Block said the files did not include usernames or passwords, Social Security numbers, dates of birth, payment card information, addresses or bank account information.

Block said it had notified law enforcement and regulators and launched an investigation with the help of an outside forensics firm. Class-action lawsuits followed, arguing that the company failed to revoke access promptly and delayed notifying customers. In 2024, Block agreed to a settlement of about $15 million to resolve claims related to the breach and other unauthorized access to Cash App accounts, offering reimbursement to eligible users for out-of-pocket losses and lost time.

The breach highlighted a basic control that many organizations still struggle with: promptly removing access when employees leave. It also showed that data seen as low-sensitivity, such as account numbers and holdings without Social Security numbers, can still harm consumers by making phishing messages more convincing. For fintech companies that have grown quickly, the case underlined the need for strong offboarding processes, access reviews and monitoring of bulk data exports.