AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
Last Update: 10/27/2026 at 6:00 AM EST
Data Breach Litigation
Coverage from Reuters, WTVB, and others
Data breach litigation examines when people can pursue civil claims after personal, financial, or health information is exposed.
Courts assess whether plaintiffs can connect the breach to concrete harm such as fraud, identity theft, or remediation costs, and whether the alleged injury supports Article III standing. Cases also address negligence and contract theories, class-action requirements, venue and personal jurisdiction, arbitration, and the adequacy of pleadings. Decisions involving Bayamon Medical Center, A-Line Staffing Solutions, healthcare providers, laboratories, and insurers illustrate how timing, the specific data exposed, and evidence linking misuse to an incident can determine whether a case proceeds or is dismissed.
Looking Back
1959 Day Timeline
May '21
Mar '22
Mar '23
Jan '24
Nov '24
Nov '25
Sep '26
All Articles94 articles
Important
U.S. Bankruptcy Judge Brian Walsh ruled in St. Louis that California cannot seek damages against Chrome Holding Co. over a 2023 23andMe genetic data breach affecting about 6.9 million customers.
7/10/2026 • Data Breaches & Exposure Events • General
Bankruptcy Judge Brian Walsh ruled California cannot pursue monetary damages tied to the 2023 23andMe breach, requiring lawsuit amendment or dismissal within 14 days.
7/10/2026 • Regulation, Law & Enforcement • General
The U.S. Supreme Court held in 2021 that concrete injury generally supports federal standing after data exposure, while FTC and EU rules can impose additional breach obligations.
9/7/2026 • Regulation, Law & Enforcement • General
Federal appellate courts in 2025 emphasize concrete injury and class waiver defenses in data breach lawsuits, limiting claims based on speculative risk.
7/28/2026 • Regulation, Law & Enforcement • General
Bankruptcy Judge Brian Walsh in St. Louis blocked California monetary damages against 23andMe after a 2023 genetic data breach, while allowing non-monetary remedies.
7/13/2026 • Regulation, Law & Enforcement • General
Brian Walsh ruled California cannot seek monetary damages tied to a 2023 23andMe genetic data breach during the Chapter 11 process in St. Louis.
7/10/2026 • Regulation, Law & Enforcement • General
Brian Walsh in St. Louis limited California to non-monetary remedies over a 2023 23andMe genetic-data breach tied to Chapter 11 restructuring.
7/10/2026 • Regulation, Law & Enforcement • General
A St. Louis bankruptcy judge ruled California cannot seek damages over a 2023 23andMe genetic-data breach under the Chapter 11 plan.
7/10/2026 • Regulation, Law & Enforcement • General
Judge Julianna Earp in North Carolina Business Court allowed most claims to proceed in a class-action over Bojangles employee data exposed in a 2024 breach.
7/7/2026 • Data Breaches & Exposure Events • General
The First Circuit on June 11, 2026 affirmed dismissal of a Bayamon Medical Center class action over a 2019 ransomware incident for failure to plausibly plead Article III traceability.
6/30/2026 • Cybersecurity Tech (Privacy-Relevant) • General
The First Circuit affirmed dismissal of a ransomware breach class action against Bayamón Medical Center when alleged identity harm lacked plausible traceability to the May 2019 incident.
6/24/2026 • Regulation, Law & Enforcement • General
On June 16, a Northern District of California court denied class certification in Ingraham v. Capital One over alleged website tracking, citing individualized transmission, consent, and standing issues.
6/23/2026 • Regulation, Law & Enforcement • General
A June 22 ruling by U.S. District Judge Beth Phillips in Missouri allowed Oracle Health and eight health systems to face key ransomware-breach claims after a January 2025 Cerner incident.
6/22/2026 • Data Breaches & Exposure Events • General
A California Supreme Court ruling in J.M. v. Illuminate Education Inc. uses a relaxed data breach pleading standard based on risk of unauthorized access.
6/17/2026 • Regulation, Law & Enforcement • General
On May 14, 2024, the California Supreme Court ruled medical-record breach lawsuits can proceed without proof of actual viewing, focusing on significant risk of unauthorized access.
5/20/2026 • Regulation, Law & Enforcement • General
On May 14, 2026, the California Supreme Court ruled in J.M. v. Illuminate Education, Inc. that CMIA breach pleading can rely on significant risk, while narrowing covered healthcare providers.
5/15/2026 • Regulation, Law & Enforcement • General
A U.S. District Court in Northern District of Georgia dismissed a June 2024 data-breach class action on April 23, citing failure to plead actual misuse for Article III standing.
5/1/2026 • Data Breaches & Exposure Events • General
Brian Walsh ruled in St. Louis that California cannot seek monetary damages against 23andMe over a 2023 breach exposing genetic data for about 6.9 million customers.
7/13/2026 • Regulation, Law & Enforcement • General
Christina Collinss data breach claims against Eckerd Connects were dismissed in 2020 by Judge Steven D. Merryday in the Middle District of Florida.
7/10/2026 • Regulation, Law & Enforcement • General
As data breaches surged in 2023 and 2024, courts increasingly assess standing and class certification using dark-web evidence of prior data exposures.
6/9/2026 • Data Breaches & Exposure Events • General
A Northern District of Georgia court dismissed a crypto ATM data-breach class action on April 23, citing insufficient evidence of data misuse for Article III standing.
5/4/2026 • Data Breaches & Exposure Events • General
In Southern District of California litigation, a federal judge on March 18, 2026 allowed claims against Bain Capital related to a PowerSchool breach discovered December 28, 2024.
4/30/2026 • Data Breaches & Exposure Events • General
Judge Nina Y. Wang ruled in the District of Colorado that a patient-data class action may proceed after a 2024 breach exposed about 80,000 records.
4/29/2026 • Data Breaches & Exposure Events • General
The Second Circuit affirmed dismissal for lack of Article III standing in McMorris v. Carlos Lopez & Associates (Apr 26, 2021), endorsing a three-factor increased-risk test after an internal PII disclosure in the United States Second Circuit.
5/13/2021 • Regulation, Law & Enforcement • General
The Third Circuit in Pennsylvania held on Sept. 2 that substantial identity-theft risk plus a separate present harm can establish standing in data-breach suits.
1/1/1900 • Regulation, Law & Enforcement • General
U.S. federal and state courts in the 2020s are requiring concrete, traceable injuries—beyond speculative increased risk—for standing in data breach class actions in Illinois and Wisconsin.
1/1/1900 • Regulation, Law & Enforcement • General
On September 3, 2026, Judge Stearns allowed negligence and third-party beneficiary claims against Sefas Innovation to proceed in a U.S. data-breach case involving Frost Bank and Citizens Bank customers.
9/8/2026 • Regulation, Law & Enforcement • General
The Massachusetts Appeals Court ruled in June 2026 that Ramon Cruceta lacked standing against J.C. Cannistraro LLC because a 2020 breach exposed information without cognizable damage.
8/24/2026 • Regulation, Law & Enforcement • General
The Massachusetts Appeals Court affirmed dismissal of Ramon Cruceta's data breach lawsuit after finding no concrete injury from a 2020 ransomware exposure.
8/24/2026 • Regulation, Law & Enforcement • General
Judge Stanley R. Chesler dismissed Arthur Ojo's proposed class action against New Jersey-based TABB Inc. after finding that alleged 2024 data-leak exposure did not establish concrete injury.
8/17/2026 • Regulation, Law & Enforcement • General
On August 13, U.S. District Judge Stanley R. Chesler dismissed Arthur Ojo's federal data breach lawsuit against TABB in New Jersey for lack of concrete injury.
8/15/2026 • Regulation, Law & Enforcement • General
On an unspecified date in 2024, Judge Julianna T. Earp allowed former restaurant employees to pursue most claims in North Carolina over a breach exposing personal and health information.
8/12/2026 • Regulation, Law & Enforcement • General
U.S. bankruptcy judge Brian Walsh ruled in St. Louis that California cannot seek monetary damages against 23andMe for a 2023 genetic data breach while allowing non-monetary remedies.
7/10/2026 • Regulation, Law & Enforcement • General
Brian Walsh ruled in St. Louis in 2026 that California cannot seek monetary damages tied to a 2023 23andMe genetic-data breach under Chapter 11.
7/10/2026 • Regulation, Law & Enforcement • General
First Circuit affirmed dismissal of a Puerto Rico hospital ransomware class action in June 2026 after finding the plaintiff did not plausibly link alleged cellphone fraud to the 2019 breach.
6/30/2026 • Data Breaches & Exposure Events • General
On Jan. 12, 2026, a Western District of Michigan judge denied a Missouri venue transfer request in a healthcare data-breach class action, ordering CAFA discovery tied to Michigan notice recipients.
6/30/2026 • Regulation, Law & Enforcement • General
Betzaida Santos Pagan appealed dismissal of a class action against Bayamon Medical Center after a 2019 Puerto Rico ransomware attack, but First Circuit found traceability insufficient for Article III standing.
6/30/2026 • Data Breaches & Exposure Events • General
On June 16, Trina L. Thompson denied class certification in a San Francisco suit alleging Capital One embedded tracking code that shared financial data with Meta, Google, Microsoft, and Adobe for targeted ads.
6/23/2026 • Regulation, Law & Enforcement • General
Santos Pagán challenged a Bayamón Medical Center data breach in the First Circuit, but the court dismissed claims for lack of Article III standing.
6/22/2026 • Data Breaches & Exposure Events • General
Santos Pagán appealed a medical data breach class action dismissal against Bayamón Medical Center, and a U.S. Circuit Court of Appeals affirmed due to failed traceability.
6/16/2026 • Regulation, Law & Enforcement • General
Hala Jarbou denied Munson Healthcare venue transfer on June 3 for two class-action breach suits tied to Cerner systems after alleged unauthorized access starting in January 2025.
6/3/2026 • Data Breaches & Exposure Events • General
Roseann A. Ketchmark partially dismisses a MAPS healthcare data breach class action while allowing implied contract and unjust enrichment claims to proceed in April 2026 proceedings.
5/4/2026 • Data Breaches & Exposure Events • General
Judge Jacqueline Scott Corley allowed most proposed class action claims against Salesforce Inc. to proceed in California over personal information exposed in a 2025 data breach.
9/15/2026 • Regulation, Law & Enforcement • General
A Minnesota federal judge dismissed Andrew Fitzgerald's class action against Jeff Anderson & Associates after finding insufficient allegations of concrete harm from an alleged data breach.
8/4/2026 • Regulation, Law & Enforcement • General
Zachary Clark sought a proposed class action against Valparaiso University over a 2025 data breach; a Northern District of Indiana judge dismissed the case on July 10.
7/13/2026 • Data Breaches & Exposure Events • General
A federal judge dismissed an A-Line Staffing Solutions class action in 2024 data breach negligence claims in the Eastern District of Michigan.
5/28/2026 • Regulation, Law & Enforcement • General
On May 14, 2026, the California Supreme Court in J.M. v. Illuminate Education set a CMIA medical breach standard requiring significant risk, not proof of actual hacker viewing.
7/7/2026 • Regulation, Law & Enforcement • General
First Circuit affirmed dismissal of a Bayamón Medical Center data breach class action in Santos-Pagán after finding insufficient traceability from alleged identity harm to a May 2019 ransomware attack.
6/24/2026 • Regulation, Law & Enforcement • General
On May 14, 2026, the California Supreme Court in J.M. v. Illuminate Education replaced the CMIA actually-viewed defense with a significant-risk standard and narrowed customer-standing under the Customer Records Act.
5/21/2026 • Regulation, Law & Enforcement • General
California Supreme Court decided J.M. v. Illuminate Education on CMIA and CRA pleading standards after an educational technology data breach.
5/19/2026 • Regulation, Law & Enforcement • General
Judge William Ray dismissed Quincey Hall's Bitcoin Depot ATM data breach class action in April 2026 for insufficient Article III standing.
4/30/2026 • Regulation, Law & Enforcement • General
A data breach class action defense approach addresses vendor-originating intrusions by emphasizing vendor contracting, audit rights, and standing and class certification challenges.
4/21/2026 • Data Breaches & Exposure Events • General
On August 7, 2026, a Pennsylvania federal court allowed casino data-breach negligence claims to proceed based on alleged matching data misuse and mitigation costs.
8/14/2026 • Data Breaches & Exposure Events • General
On August 7, 2026, a Pennsylvania federal court allowed Rivers Casino Philadelphia breach negligence claims to proceed based on alleged matching data misuse and mitigation costs.
8/13/2026 • Regulation, Law & Enforcement • General
Interesting
A federal judge denied class certification in Young v. Salesforce after finding that an intercepted Rite Aid COVID test chat caused no concrete privacy injury.
9/4/2026 • Regulation, Law & Enforcement • General
On October 29, 2025, Judge Brian Morris allowed financial institutions in Montana multidistrict litigation to pursue damages claims against Snowflake, Ticketmaster, and Live Nation over the alleged cloud-platform breach.
8/13/2026 • Regulation, Law & Enforcement • General
In 2025, the U.S. District Court for the Western District of Michigan dismissed Michigan data breach class action claims after finding standing but insufficient factual support for alleged injuries and state-law causes of action.
7/28/2026 • Regulation, Law & Enforcement • General
Himanshu Pathak filed a Supreme Court special leave petition on July 24, 2026, challenging Madras High Court dismissal of requests for MeitY, IRDAI, and SEBI action against Star Health over alleged cybersecurity vulnerabilities.
7/21/2026 • Regulation, Law & Enforcement • General
A San Jose, California federal judge denied a motion to modify a September 2025 class-certification order tied to Social Security number exposure on July 16, 2026.
7/16/2026 • Data Breaches & Exposure Events • General
Taylor Sample discusses how appellate courts evaluate data breach aftermath records, focusing on notification letters, documented access or misuse, and higher proof requirements for plaintiffs.
7/14/2026 • Regulation, Law & Enforcement • General
In Charlotte, North Carolina, a Business Court judge in 2025 allowed a Bojangles employee data-breach class action alleging dark web posting by Russian hackers.
7/7/2026 • Data Breaches & Exposure Events • General
In North Carolina, a Business Court judge in 2026 allowed most claims in a class action over a 2024 Bojangles employee data breach.
7/7/2026 • Data Breaches & Exposure Events • General
Judge Hala Jarbou dismissed without prejudice eight Stryker employee lawsuits after Stryker disclosed a February wiper attack and found no evidence attackers accessed plaintiffs' PII.
7/1/2026 • Data Breaches & Exposure Events • General
Judge Hala Y. Jarbou in Michigan denied transfer of a healthcare EHR breach class action and ordered discovery on breach notice recipient locations to assess CAFA home-state remand.
6/30/2026 • Regulation, Law & Enforcement • General
Susan D. Wigenton dismissed Danielle Lips' 2025 ransomware privacy class action against Accu Reference Medical Lab in June 2026.
6/29/2026 • Cybersecurity (Privacy-Relevant) • General
Michelle Milewski dismissed a Southern District of New York class-action against Cushman & Wakefield after a reported voice-phishing breach exposed PII from 300,000-plus accounts.
6/3/2026 • Data Breaches & Exposure Events • General
Michelle Milewski dismissed a class-action privacy lawsuit against Chicago-based Cushman & Wakefield in the Southern District of New York after an alleged cyberattack involving ShinyHunters and Qilin.
6/2/2026 • Data Breaches & Exposure Events • General
The U.S. Supreme Court dismissed a certiorari petition in an insurer data-breach class action in Washington, D.C., leaving a Fourth Circuit ruling on Article III standing for dark web posting damages.
5/28/2026 • Data Breaches & Exposure Events • General
Supreme Court plans to file an opinion in J.M. v. Illuminate Education on vendor liability for disclosed student confidential medical and personal data after a breach.
5/14/2026 • Regulation, Law & Enforcement • General
A Georgia federal judge denied Aflac Inc.'s dismissal bid Wednesday in a proposed class action alleging that a 2025 breach exposed personal information of nearly 23 million people.
8/13/2026 • Data Breaches & Exposure Events • General
On an unspecified date, Judge J. Nicholas Ranjan allowed proposed class claims against Allegheny Health Network and IntraSystems over a 2024 breach affecting approximately 294,000 patients in Pennsylvania.
8/6/2026 • Data Breaches & Exposure Events • General
Judge David C. Godbey allowed four plaintiffs to pursue negligence and implied-contract claims against Jani-King International Inc. over a 2024 personal-information breach in the Northern District of Texas.
8/6/2026 • Regulation, Law & Enforcement • General
Judge Jeffrey M. Bryan dismissed Andrew Fitzgerald's data breach class action against Jeff Anderson & Associates in Minnesota on Monday after finding no adequately alleged concrete or future harm.
8/4/2026 • Regulation, Law & Enforcement • General
CarGurus consumers voluntarily dismissed without prejudice on July 27, 2026, a consolidated Massachusetts federal lawsuit over a ShinyHunters breach allegedly affecting 12.5 million people.
7/28/2026 • Data Breaches & Exposure Events • General
Judge Elaine E. Bucklo rejected Andy Frain Services Inc. arbitration for former job applicants after an October 2024 data breach in Illinois.
7/6/2026 • Data Breaches & Exposure Events • General
In the Western District of Missouri, Judge Beth Phillips let a patient data breach negligence claim proceed against Oracle Health in a class action.
6/23/2026 • Data Breaches & Exposure Events • General
US Bankruptcy Court judge Brian C. Walsh will rule soon on whether California can proceed with a suit over Chrome Holding Co.'s 2023 breach impacting nearly 7 million users.
6/8/2026 • Data Breaches & Exposure Events • General
California Supreme Court ruled a student data breach class action against Illuminate Education Inc. was inadequately pleaded under California medical and customer records privacy laws, then remanded for possible amendment.
5/14/2026 • Data Breaches & Exposure Events • General
A Colorado federal judge, in April 2026, narrowed a fertility clinic class action over a 2024 data breach while keeping breach of contract and fiduciary claims.
4/29/2026 • Data Breaches & Exposure Events • General
Judge Joshua Wolson allowed a negligence claim against Rivers Casino Philadelphia to proceed in Pennsylvania federal court over a November 2024 data breach.
8/11/2026 • Regulation, Law & Enforcement • General
Rivers Casino Philadelphia customers filed a class action in Pennsylvania after a January cyberattack, and Judge Joshua D. Wolson allowed negligence claims over alleged data protection failures to proceed.
8/11/2026 • Data Breaches & Exposure Events • General
Judge Allison D. Burroughs ruled on June 26 that economic-loss doctrine does not require dismissal of negligence claims in ongoing MOVEit breach multidistrict litigation in Massachusetts.
6/29/2026 • Data Breaches & Exposure Events • General
Mark Lane recommended pausing FTX-related Kroll data-breach claims for arbitration and dismissing BlockFi-related claims in a Texas federal report issued in Wednesday proceedings.
7/23/2026 • Data Breaches & Exposure Events • General
A casino company asked a Colorado federal court on July 13, 2026 to dismiss a former employee class action over a 2024 cyberattack, citing standing and causation gaps.
7/13/2026 • Data Breaches & Exposure Events • General
Judge Brian C. Walsh of the Eastern District of Missouri halted California litigation against 23andMe and set a two-week deadline for dismissal or removing monetary relief.
7/11/2026 • Regulation, Law & Enforcement • General
Tina Clayton and PruittHealth Inc. filed a stipulation dismissing a data breach class action without prejudice in the Northern District of Georgia.
7/1/2026 • Data Breaches & Exposure Events • General
Donald Smith sought damages from Robert Bosch LLC after a welfare benefit program data breach allegation, but Judge Stephen J. Murphy dismissed the case with prejudice in Michigan on Tuesday.
6/3/2026 • Data Breaches & Exposure Events • General
Plaintiffs dismissed with prejudice a DMS Health Technologies 2023 data breach lawsuit filed in US District Court for the District of North Dakota.
6/1/2026 • Data Breaches & Exposure Events • General
Judge Wendy Beetlestone dismissed a patient class action in the Eastern District of Pennsylvania after plaintiffs alleged a 2023 data breach exposed personal information affecting 190,000 people.
5/6/2026 • Data Breaches & Exposure Events • General
Judge Wendy Beetlestone dismissed an 11-plaintiff class action in Pennsylvania after a 2023 Prospect Medical Holdings data breach exposed personal information for over 190,000 people.
5/6/2026 • Data Breaches & Exposure Events • General
A Colorado federal judge on April 28, 2026 narrowed a fertility-clinic class action after a 2024 data breach, preserving breach of contract and fiduciary claims while dismissing several privacy and consumer protection allegations for now.
4/29/2026 • Data Breaches & Exposure Events • General
Judge Roseann A. Ketchmark in Western District of Missouri partially dismissed claims in a proposed class action against Kansas City medical practice over a 2025 patient data breach.
4/14/2026 • Data Breaches & Exposure Events • General
Judge Joshua D. Wolson allowed plaintiffs to pursue a proposed class action against Rivers Casino operators on August 7 in Pennsylvania over alleged 2024 data security failures.
8/10/2026 • Regulation, Law & Enforcement • General
In Northern District of California litigation over the Accellion data breach, a court denied modification of class certification and kept nominal-damages limits.
7/14/2026 • Regulation, Law & Enforcement • General