Cybersecurity lawsuits are being filed at a pace never seen before, with 1,488 data breach class actions filed in 2024 alone — a 1,265 percent jump since 2018.1Duane Morris. Data Breaches Give Rise to an Unprecedented Number of Class Action Filings The field has shifted sharply in the past two years. The SEC’s landmark enforcement case against SolarWinds collapsed in late 2025, but private plaintiffs, state attorneys general, and the FTC have moved into the gap, and massive multidistrict litigations over breaches at Change Healthcare, MOVEit, and Snowflake customers are now working through the federal courts on behalf of hundreds of millions of people.
The Largest Active Breach Class Actions
Three multidistrict litigations dominate the current landscape, each tied to a single incident or software vulnerability that cascaded across dozens of companies.
Change Healthcare
The February 2024 ransomware attack on Change Healthcare, a UnitedHealth Group subsidiary, compromised data belonging to an estimated 100 million people and disrupted claims processing, pharmacy transactions, and patient authorizations across the country. UnitedHealth has projected up to $1.6 billion in related costs for 2024 alone.2Healthcare Dive. Change Healthcare Cyberattack Lawsuit Consolidation
Roughly 50 lawsuits are consolidated as MDL No. 3108 in the District of Minnesota before Judge Donovan W. Frank, split into one track for patients whose personal and health data was exposed and another for providers who suffered financial harm from the shutdown. The court ruled on motions to dismiss in December 2025, granting some and denying others, with discovery set to close by November 2026. Settlement talks have been described by the court as “likely premature.”3U.S. District Court, District of Minnesota. Change Healthcare, Inc. Data Breach Litigation
MOVEit Transfer
The CL0P ransomware group’s 2023 exploitation of Progress Software’s MOVEit file-transfer tool affected an estimated 85 million people whose data was held by the companies and agencies using it.4First Class Defense. MOVEit Data Breach Litigation: District of Massachusetts Allows Bellwether Claims to Proceed The consolidated litigation sits before Judge Allison D. Burroughs in the District of Massachusetts as MDL No. 3083.
In July 2025, the court largely denied motions to dismiss from Progress Software and bellwether defendants, letting negligence, breach of contract, unjust enrichment, and several state consumer protection claims move forward. The court found that both Progress and the companies using MOVEit had a duty to implement reasonable safeguards.4First Class Defense. MOVEit Data Breach Litigation: District of Massachusetts Allows Bellwether Claims to Proceed Progress itself has not reached a global settlement. One individual defendant, Nuance Communications, agreed to an $8.5 million settlement covering roughly 1.59 million class members, with final approval pending as of early 2026.5Top Class Actions. $8.5M Nuance Communications MOVEit Data Breach Class Action Settlement
Snowflake Customer Breaches
Breaches of the Snowflake cloud platform in mid-2024 exposed data belonging to more than 500 million people across clients including AT&T, Ticketmaster/Live Nation, Advance Auto Parts, and Neiman Marcus. The consolidated cases, MDL No. 3126, are before Judge Brian Morris in the District of Montana.6U.S. District Court, District of Montana. Snowflake Data Security Breach Litigation
Several defendants have resolved their portions. Advance Auto Parts received final settlement approval in October 2025, and Neiman Marcus received preliminary approval in May 2025. Claims against Snowflake itself were dismissed with prejudice as part of those settlements. AT&T’s portion is the biggest piece: a proposed $177 million settlement covering two separate 2024 breaches. A six-hour final approval hearing was held in January 2026, with about 4.38 million claims filed. If approved, eligible claimants could receive up to $7,500 for documented losses across both breaches.7New Haven Register. AT&T Data Breach Settlement Attorney Fees
The SEC’s SolarWinds Case Collapses
The SEC filed suit against SolarWinds Corp. and its Chief Information Security Officer, Timothy G. Brown, in October 2023, alleging they had misled investors about the company’s cybersecurity practices before and after the SUNBURST supply-chain attack. The case was treated as a bellwether for how aggressively the federal government could use securities law to police corporate cybersecurity.8Perkins Coie. SEC Dismisses Cyber Disclosure Case Against SolarWinds and CISO
In July 2024, Judge Paul Engelmayer dismissed the bulk of the SEC’s claims, including those tied to pre-attack risk disclosures, post-attack 8-K filings, and internal controls. He found that “cybersecurity controls are not internal accounting controls” and said the SEC had relied on “hindsight and speculation.”9CFO Dive. Judge Deals Major Blow to SEC’s Tough Cybersecurity Stance10Holland & Knight. Settlement Alert: The Dust Settles in SEC’s Cybersecurity Lawsuit On November 20, 2025, the SEC and the defendants filed a joint stipulation dismissing the entire case with prejudice. No penalties, no consent order, no conditions.11Harvard Law School Forum on Corporate Governance. SolarWinds Dismissed: What the SEC’s U-Turn Signals for Cyber Enforcement12SEC. Litigation Release No. 26423
The SEC’s 2023 cyber incident-reporting rules remain in force and can still be enforced by private plaintiffs, but the dismissal signals a less aggressive posture from the agency itself on cybersecurity disclosure cases.8Perkins Coie. SEC Dismisses Cyber Disclosure Case Against SolarWinds and CISO
Shareholder Suits Still Follow Big Breaches
Even with the SEC pulling back, private securities class actions after breaches have continued. Two large ones were filed in December 2025.
Coupang, the South Korean e-commerce company, was sued after disclosing that a former employee who left in 2024 had kept active access credentials and used them to reach information on about 33.7 million customers. The breach was detected on November 18, 2025, but the company did not inform investors until a December 16 Form 8-K. Market capitalization dropped by more than $8 billion, and the CEO of the South Korean unit resigned.13Market Chameleon. Coupang Faces Securities Class Action, Data Breach, Executive Departure
F5, a network security company, is accused of concealing that a nation-state threat actor maintained persistent access to its systems for years, exfiltrating source code from the BIG-IP product environment. F5 learned of the intrusion in August 2025 but waited until October to disclose, triggering stock declines that erased more than $2 billion in market value. The company also cut its fiscal 2026 revenue guidance.14Newsfile. Hagens Berman Alerts F5 Investors to Deadline in Securities Class Action A judge in the Western District of Washington appointed lead counsel in March 2026, and the case is in early stages.15DiCello Levitt. DiCello Levitt Named Lead Counsel in F5 Securities Class Action Both complaints allege violations of Sections 10(b) and 20(a) of the Securities Exchange Act and Rule 10b-5.16D&O Diary. Two Tech Companies Hit With Data Breach-Related Securities Suits
Federal Regulators Fill the Gap
The FTC and DOJ have continued to pursue cybersecurity failures through consumer protection and fraud theories.
In December 2025, the FTC took action against Illuminate Education after a breach exposed personal data of 10.1 million students, including dates of birth, health information, and medical diagnoses. A hacker had used credentials belonging to an employee who had left the company 3.5 years earlier. The FTC alleged that Illuminate stored student data in plain text, left known vulnerabilities unremediated since January 2020, and waited nearly two years to notify school districts representing more than 380,000 students. The consent order requires a comprehensive security program and deletion of unnecessary personal data.17FTC. FTC Takes Action Against Education Technology Provider for Failing to Secure Students’ Personal Data Other recent FTC actions include a $10 million settlement with Disney over unlawful collection of children’s data, a $5.7 million penalty against Dun & Bradstreet, and a finalized order against General Motors and OnStar for collecting and selling geolocation data without informed consent.18FTC. Privacy and Security Enforcement
The Department of Justice settled a False Claims Act case against Illumina Inc. in July 2025 for $9.8 million. The government alleged that the genomic sequencing manufacturer sold systems with cybersecurity vulnerabilities to federal agencies from February 2016 through September 2023, falsely representing that its software met ISO and NIST standards. Illumina did not admit liability.19DOJ. Illumina Inc. to Pay $9.8M to Resolve False Claims Act Allegations Arising From Cybersecurity
Why Some Victims Can’t Sue in Federal Court
The Fourth Circuit raised the bar for data breach plaintiffs in October 2025 in Holmes v. Elephant Insurance Company. The court held that plaintiffs must show their stolen information was actually disseminated publicly — posted on the dark web, for example — to establish the concrete injury Article III requires. Theft alone is not enough, and the court rejected the idea that speculative future harm from identity theft risk, mitigation costs, or emotional distress could independently support standing.20Cybersecurity Law Fundamentals. Chapter 4: Cybersecurity Litigation
Drawing on the Supreme Court’s TransUnion v. Ramirez framework, the court analogized data breaches to the common law tort of public disclosure of private information. Plaintiffs whose driver’s license numbers were found on the dark web cleared the bar; others did not. The ruling aligns the Fourth Circuit with the First, Second, and Third Circuits, though the Seventh Circuit has taken a more plaintiff-friendly view for sensitive data like driver’s license numbers.20Cybersecurity Law Fundamentals. Chapter 4: Cybersecurity Litigation This affects federal lawsuits only. State breach notification obligations still kick in regardless of whether stolen data ever surfaces publicly.
State Privacy Law Is the New Front
As federal standing has tightened in some circuits, state privacy statutes have opened new theories of liability — not for hacking at all, but for how companies share data with third-party trackers.
In Shah v. Capital One Financial Corp., decided in March 2025, a federal judge in the Northern District of California denied a motion to dismiss California Consumer Privacy Act claims alleging that Capital One let Google, Meta, and Microsoft embed trackers that transmitted user data without consent. The court held plaintiffs did not need to allege a conventional data breach to invoke the statute. A similar ruling in M.G. v. Therapymatch, Inc. in September 2024 allowed CCPA claims based on embedded Google Analytics code intercepting personal information without adequate disclosure.21Skadden. District Court Rulings Could Signal Expansion Those rulings conflict with earlier decisions limiting the CCPA’s private right of action to traditional breaches, and the California Supreme Court has not resolved the split.
If the broader reading holds, companies that embed standard analytics and advertising tools could face statutory damages of $100 to $750 per consumer per violation, with no hacking required. The Federal Wiretap Act has become another common vehicle for similar claims, with lawsuits pending against Amazon, Apple, Google, Meta, LinkedIn, and Reddit.22Shumaker. Digital Risk Report June 2026
The same theory produced one of the field’s largest resolutions. In February 2026, the Ninth Circuit affirmed a $115 million settlement in Katz-Lacabe et al. v. Oracle America, Inc., which alleged Oracle operated as a data broker, tracking consumers online and offline to build profiles of geolocation, finances, demographics, interests, and health data. Plaintiffs said Oracle’s “coretag” tracking code intercepted communications without consent, even from people with no direct relationship to the company. The settlement also requires Oracle to change business practices, restrict certain electronic communications, and audit customer compliance with consumer privacy obligations.23Lieff Cabraser. Privacy24Top Class Actions. Oracle Class Action Alleges Company Earns Billions Selling Internet Users’ Personal Information
State enforcement is active too. In May 2026, Texas Attorney General Ken Paxton sued Meta and WhatsApp in a Harrison County state district court under the Texas Deceptive Trade Practices Act, alleging the messaging platform’s end-to-end encryption does not work as advertised and that Meta can and does access unencrypted message contents.25Texas Tribune. Texas WhatsApp Meta Privacy Encryption Lawsuit The state’s evidence rests mainly on a Bloomberg report citing a Commerce Department email and unnamed whistleblowers. Meta has denied the allegations and called them “baseless.” Cybersecurity experts cited in reporting on the case have described the evidentiary basis as “thin.”26Ars Technica. Texas AG Sues Meta Over Claims That WhatsApp Doesn’t Provide End-to-End Encryption Texas is seeking a permanent injunction and $10,000 per violation.
How Big Are the Settlements, Really
The dollar figures keep climbing. Capital One’s $190 million settlement from its 2019 breach was still paying out through the end of 2025.27Mason LLP. Biggest Data Breaches and Class Actions MGM Resorts settled for $45 million covering breaches in 2019 and 2023. Apple settled Siri privacy claims for $95 million.28Expert Institute. Top Class Action Settlements AT&T’s pending $177 million Snowflake-related settlement would rank among the largest consumer breach payouts if approved.
One detail reshapes how to read those numbers. Very few of these cases ever reach class certification. In 2024, courts issued only four or five rulings on class certification motions in data breach cases, with plaintiffs winning about 40 percent of the time. Nearly every other case settles before that stage, which analysts say rewards plaintiffs who file early and encourages still more filings.1Duane Morris. Data Breaches Give Rise to an Unprecedented Number of Class Action Filings Shareholder derivative suits remain harder for plaintiffs to win, with the business judgment rule shielding most directors and officers; the $29 million Yahoo derivative settlement is still the outlier.29Bailey Cavalieri. Update on Recent D&O Claims Developments
Taken together, the current wave of cybersecurity lawsuits shows the private bar, state attorneys general, and the FTC absorbing the enforcement space the SEC appears to be giving up. Companies now face liability not only for hacking incidents, but for how they describe their security, how quickly they notify affected people, and whether their websites quietly share user data with trackers their privacy policies don’t disclose.