A class action lawsuit has been filed in U.S. District Court in the Northern District of Georgia against The Home Depot over the potential data breach the home improvement giant has been investigating this week.

The possible hack, which many security experts say could cost the company millions if confirmed, was revealed on Tuesday by blogger Brian Krebs of website KrebsonSecurity after banks began reporting the presence of credit cards used at Home Depot among cyber criminal networks.

Home Depot confirmed the report and said Friday its investigation is ongoing and that there is no timetable for its conclusion.

In the lawsuit filed late Thursday, Home Depot customers allege that the retailer failed to protect customers’ credit card and personal information and did not warn consumers in a timely manner.

The legal action claims the company was hacked in early April or late May, but did not acknowledge the potential security breach until Krebs’ report.

The lawsuit seeks injunctive relief and damages.

A Home Depot spokeswoman said it is “premature to comment.”