The class action lawsuit over the A-Line Staffing data breach was dismissed in May 2026, when a federal judge in the Eastern District of Michigan threw out every claim brought by employees whose personal information was stolen in a 2024 ransomware attack. The employees had enough of an injury to get into court, Judge Robert J. White ruled, but they could not plausibly show that A-Line’s security failures caused the specific harms they alleged.1Inside Class Actions. Standing Found but Negligence Fails: Eastern District of Michigan Dismisses Data Breach Claims for Lack of Causation
What Happened in the Breach
A-Line Staffing Solutions is a third-party contracting and staffing company. In 2024, it was hit by a ransomware group known as “Underground.” The breach was first reported on June 17, 2024, and a filing with the Texas Attorney General on July 22, 2024, disclosed that at least 6,243 individuals in Texas alone were affected.2Staffing Industry Analysts. A-Line Staffing Solutions Reports Data Breach The attackers took Social Security numbers and other employment-related information.
Affected employees filed a consolidated class action in the U.S. District Court for the Eastern District of Michigan, Southern Division, docketed as Case No. 24-cv-11917. The complaint brought claims for negligence, breach of implied contract, unjust enrichment, breach of fiduciary duty, breach of confidence, and declaratory relief. Plaintiffs said they had spent time and money on credit monitoring and mitigation and faced an increased risk of fraud, and at least one plaintiff alleged specific fraudulent activity on their accounts.1Inside Class Actions. Standing Found but Negligence Fails: Eastern District of Michigan Dismisses Data Breach Claims for Lack of Causation
What the Judge Decided
Judge White issued his order on May 27, 2026, granting A-Line’s motion to dismiss the amended complaint.3Leagle. In re A-Line Staffing Solutions Data Security Incident Litigation The opinion split cleanly in two. A-Line had filed separate challenges: one arguing the plaintiffs did not have standing to sue at all, and one arguing that even if they did, their claims were legally insufficient. The court rejected the first and accepted the second.
On standing, the judge sided with the employees. Following the Sixth Circuit’s decision in Galaria v. Nationwide Mutual Insurance Co., he held that people whose personal data is stolen because of a company’s lax security have enough of a traceable injury to be in federal court.4FindLaw. Galaria v. Nationwide Mutual Insurance Co. At that stage, plaintiffs do not have to prove the breach definitively caused their harm.
Then the court moved to whether the plaintiffs had actually stated viable claims, and every count fell.
Why the Negligence Claim Failed
Negligence was the heart of the case, and it collapsed on causation. To plead negligence, the court held, plaintiffs needed to show both an actual, present injury and a “but for” causal link between the breach and that injury. That is a higher bar than the one for standing.1Inside Class Actions. Standing Found but Negligence Fails: Eastern District of Michigan Dismisses Data Breach Claims for Lack of Causation
The complaint, in the court’s view, pointed to the fact that identity theft and fraud happened after the breach and asked the court to infer the breach was the cause. That reliance on “temporal proximity and correlation” was “too speculative and conclusory” to state a claim.5Bloomberg Law. A-Line Staffing Defeats Workers’ Lawsuit Over 2024 Data Breach Judge White had taken the same approach a few months earlier in Higgins v. Grede Holdings LLC, where he wrote that “it is axiomatic in logic and in science that correlation is not causation” and that Michigan law does not recognize the mere risk of future harm, or the release of information itself, as a compensable negligence injury.6Justia. Higgins et al v. Grede Holdings LLC
The practical problem for employees is real. Data stolen in a breach often lands on underground markets and gets mixed with records from other incidents, which makes pinning any particular fraud on any one source difficult. Without that direct link, this court has signaled, negligence claims will not survive.
Why the Other Claims Failed
The rest of the complaint was dismissed on different grounds.1Inside Class Actions. Standing Found but Negligence Fails: Eastern District of Michigan Dismisses Data Breach Claims for Lack of Causation
- Breach of implied contract and unjust enrichment both failed because the court treated the handing over of personal information to a staffing company as “incidental” to the employment relationship. That exchange, the judge ruled, is not independent consideration for a separate data-protection agreement, and the company did not receive an unjust benefit from the data itself.
- Breach of fiduciary duty was dismissed because there was no “special relationship” between A-Line and its employees that would create a fiduciary obligation over data security.
- Breach of confidence requires an affirmative disclosure by the defendant. The data here was taken by hackers, not disclosed by A-Line, so the claim did not fit the facts.
- Declaratory and injunctive relief failed because the plaintiffs were asking the court to order measures aimed at preventing a future breach rather than addressing one that had already occurred.
What This Means for Affected Employees
The dismissal was without prejudice, which means the plaintiffs can, in principle, try again with a stronger complaint.1Inside Class Actions. Standing Found but Negligence Fails: Eastern District of Michigan Dismisses Data Breach Claims for Lack of Causation Whether they will attempt an amended complaint has not been reported. To clear the bar the judge has set, any refiled negligence claim would need concrete, specific facts tying the fraud a plaintiff suffered back to the A-Line breach rather than to the general pool of stolen data circulating online.
For employees watching the case, the ruling does not say the breach did not happen or that A-Line’s security was adequate. It says the complaint, as written, did not plausibly connect the breach to the specific out-of-pocket losses and fraud the plaintiffs described. That is a pleading problem, not a factual vindication.
How the Ruling Fits Recent Data Breach Decisions
The A-Line result lines up with how several other federal courts have handled data breach suits in the past year. In Waterman v. Paychex, Inc., a federal judge in the Eastern District of Pennsylvania dismissed a breach suit in October 2025, writing that the plaintiff “has alleged no more than temporal proximity between the Paychex data breach and the unfortunate occurrences of suspected identity theft that befell her in the months thereafter.”7CaseMine. Waterman v. Paychex, Inc. In Dougherty v. Bojangles’ Restaurants, the Western District of North Carolina dismissed a breach class action in September 2025 for lack of standing, describing the alleged injuries as the “possibility of future harm” rather than a concrete injury already suffered.8Duane Morris. Data Breach Class Actions
Taken together with Judge White’s companion ruling in Grede Holdings, the A-Line dismissal sends a consistent message from the Eastern District of Michigan: getting past the standing threshold in a data breach case is no longer the hard part. Proving that the breach actually caused the harm is.