A Utah law firm has filed a class action lawsuit against Target, alleging the discount retailer owes no less than $5 million in damages for its recent data breach.

Christensen Young and Associates filed the lawsuit in Utah’s U.S. District Court on Dec. 31 on behalf of Nellie Christensen, Stephanie Wright, Jennifer Christensen and Zachary Christensen, alleging the four were among more than 40 million Target customers whose data was stolen between Nov. 27 and Dec. 15, said the Salt Lake Tribune.

The firm said it has also requested a class action certification to cover additional Target customers whose data might have been stolen or compromised, said the Salt Lake Tribune.

The lawsuit’s allegations include that Target failed to disclose information concerning the breach promptly to affected customers, which violates the Utah Unfair Competition Laws, and that plaintiffs have suffered injury, and lost property and money as a result, said the Salt Lake Tribune.

The attorneys also allege that Target has offered to provide credit-monitoring services to affected individuals but has not identified those they believe was affected by the breach.