This is an archived article and the information in the article may be outdated. Please look at the time stamp on the story to see when it was last updated.

SAN DIEGO — City Attorney Mara Elliot announced a major lawsuit against the consumer credit agency Experian for failing to tell its customers a security lapse had exposed their personal information to identity thieves and other criminal in the Dark Web.

The breach occurred in 2015 over the course of a year and a half and claimed some 250,000 victims in San Diego alone, city officials said. The defendants are accused of exposing the confidential information of 3.1 million people across California.

Consumers’ social security numbers and credit card security codes were among the data compromised during the breach, which began in 2015 and lasted over an 18-month period, Elliott said.

Among other crimes resulting from the breach, the city attorney said that hackers obtained $65 million in fraudulent tax returns.

“Experian then broke the law by not telling these consumers the truth about what happened,” Elliott said.

The breached companies were aware of the security lapses for years and took no steps to notify consumers, which is required by city law, according to a city press release.

Officials said that they expected to meet in court on the matter for the first time on August 10.