A class action lawsuit has been filed against payments giant PayPal after a cyberattack compromised the personal and financial information of 35,000 customers last year.

PayPal determined the attack took place between December 6 and December 8, but claimed their was “no evidence” that any data was stolen.

Plaintiffs in the civil suit Ashley Pillard and Destiny Rucker argue otherwise, alleging that PayPal breached FTC guidelines by failing to implement basic security practices or comply with industry data-protection standards.

The information exposed included names, addresses, Social Security numbers, tax identification numbers, and dates of birth, according to the complaint filed last week in California.

The suit is claiming negligence, breach of contract, unjust enrichment, and the violation of numerous state consumer protection laws.