Cybersecurity lawsuits this week are led by a fast-growing docket against Instructure over the Canvas breach, a new class action against ADT, ongoing multidistrict litigation over the Change Healthcare ransomware attack, and a $117.5 million proposed Comcast settlement awaiting final approval in August. Several other breach settlements have claim deadlines running out this month, and two freshly disclosed breaches at Nexstar and Evertec are likely to produce complaints soon.
Instructure (Canvas) Breach Draws Two Dozen Federal Suits
Instructure, the company behind the Canvas learning management system, is now facing more than two dozen federal lawsuits after the hacking group ShinyHunters breached its systems on April 25, 2026. The group claims to have stolen over 275 million records from roughly 9,000 educational institutions, including Stanford, Yale, Princeton, the University of Manchester, and the University of Oslo. The stolen data reportedly includes names, email addresses, student ID numbers, and private messages between Canvas users, totaling about four terabytes. Instructure says it has found no evidence that Social Security numbers, dates of birth, passwords, or financial information were compromised.
The attackers exploited a weakness in Instructure’s “Free-for-Teacher” demo accounts. After an initial intrusion on April 29, hackers struck again on May 7, defacing pages on the platform and prompting Instructure to take Canvas offline temporarily. The company confirmed it reached a deal with the hackers to delete the stolen data but has not disclosed the terms.
At least seven of the filings are proposed class actions, six in the U.S. District Court for the District of Utah and one in the Southern District of New York. KKR & Co., which bought Instructure in 2024 for approximately $4.8 billion, is also named. The complaints assert negligence, breach of legal obligations, and unjust enrichment, with at least one suit seeking damages above $5 million. The cases have not been consolidated into a multidistrict litigation, and none have reached class certification.
ADT Faces Class Action Over Vishing Attack
The same hacking group behind the Canvas breach is also responsible for a major intrusion at ADT Inc. ADT disclosed that it discovered unauthorized access on April 20, 2026, after attackers used a voice phishing attack on an employee’s single sign-on account to reach the company’s Salesforce instance. Estimates of exposure range from 5.5 million accounts to more than 10 million individuals. Compromised information includes full names, phone numbers, physical addresses, email addresses, dates of birth, and partial Social Security numbers and tax identification numbers. ADT has said no payment information was accessed.
A class action complaint, James v. ADT Inc. (Case No. 9:26-cv-80546), was filed on May 12, 2026, in the U.S. District Court for the Southern District of Florida. The plaintiff alleges negligence, breach of implied contract, and unjust enrichment, and seeks declaratory relief that includes lifetime identity theft protection for affected customers. The case is in its earliest stages, with no judge assigned and no settlement discussions underway.
Change Healthcare MDL Moves Toward Settlement Talks
The litigation over the Change Healthcare ransomware attack remains the largest cybersecurity case in the country by scale. The February 2024 breach affected approximately 192.7 million individuals and exposed health records, Social Security numbers, driver’s license and passport numbers, and financial data. It is classified as the largest healthcare data breach on record.
Dozens of class actions have been consolidated into In re Change Healthcare, Inc., Customer Data Security Breach Litigation (MDL No. 3108, Case No. 24-MD-03108-DWF-DJF) in the District of Minnesota, before Judge Donovan W. Frank. The litigation is split into “Patient” and “Provider” tracks with separate co-lead counsel. Plaintiffs allege inadequate security controls, a nine-day gap between the initial breach and its detection, and delayed notification. Defendants include Change Healthcare, UnitedHealth Group, and Optum.
In December 2025, Judge Frank granted motions to dismiss in part and denied them in part across both tracks. As of June 2026, the case is in active discovery, with fact discovery set to close by November 2, 2026. The court has begun facilitating informal settlement discussions and ordered a status conference with lead counsel for June 18, 2026, to advance those talks. No global settlement has been reached. A parallel state lawsuit filed by the Nebraska Attorney General has survived a motion to dismiss, and a federal Office for Civil Rights HIPAA investigation opened in March 2024 remains pending.
Comcast $117.5 Million Settlement Awaits Final Approval
The largest cybersecurity settlement pending final approval right now involves Comcast. Hasson v. Comcast Cable Communications, LLC (Case No. 2:23-cv-05039-JMY) sits in the U.S. District Court for the Eastern District of Pennsylvania. It stems from an October 2023 breach in which attackers exploited the “Citrix Bleed” vulnerability in Citrix NetScaler products used by Comcast. During a three-day window from October 16 to 19, 2023, hackers stole usernames, hashed passwords, customer names, contact information, dates of birth, the last four digits of Social Security numbers, and security questions. Comcast disclosed the breach on December 18, 2023.
The proposed settlement creates a $117.5 million non-reversionary fund for an estimated class of 31.6 million current and former Comcast customers who received individual breach notification. Class members can claim up to $10,000 for documented out-of-pocket losses, up to $150 for lost time, or a flat $50 cash payment with no documentation required. The settlement also includes two years of identity defense and restoration services. Comcast denies all allegations of wrongdoing.
The final approval hearing is scheduled for August 5, 2026. The deadline to opt out or object is July 1, 2026, and the claims deadline is September 14, 2026.
Other Settlements With Active Claim Windows
Several breach settlements are either paying out or approaching their claim deadlines:
- Yale New Haven Health reached an $18 million settlement following a March 2025 breach affecting over 5.5 million individuals. Eighteen separate class actions were consolidated in the District of Connecticut as In Re: Yale New Haven Health Services Corp. Data Breach Litigation (Case No. 3:25-cv-00609-SRU). The court granted final approval on March 3, 2026, and payments began dispersing on May 27, 2026. Class members could claim up to $5,000 for documented losses or an estimated $100 flat payment, plus two years of medical data monitoring.
- A Florida federal court approved a $20 million settlement in September 2025 in In re Fortra File Transfer Software Data Security Breach Litigation (Case No. 1:24-md-03090), stemming from a January 2023 Clop ransomware group attack on Fortra’s GoAnywhere file transfer software. The breach affected roughly 5 million people across about 130 organizations, including Aetna and Community Health Systems. Class members could claim up to $5,000 in documented losses or a flat $85 payment. A separate $7 million Brightline subclass settlement brought total recovery to $27 million.
- Lakeview Loan Servicing’s $26 million settlement, resolving claims from a 2021 breach that exposed Social Security numbers and loan data, has a claims deadline of June 22, 2026.
- Veradigm, a health IT company, settled a class action for $10.5 million after a July 2025 breach affecting over 2.6 million individuals.
- Florida law firm Gunster, Yoakley & Stewart reached an $8.5 million settlement in Whalen v. Gunster (Case No. 9:24-CV-80612-AMC, S.D. Fla.) over a November 2022 breach affecting 9,550 individuals. The settlement allows up to $35,000 in individual reimbursements and requires the firm to undergo a SOC Type II security audit.
Smaller settlements with claim windows running this month include Complete Payroll Solutions ($2.6 million, deadline June 18), Avis (deadline June 21), and Krispy Kreme ($1.6 million, deadline June 22). The Essen Medical Associates $4 million deadline passed on June 1.
New Breaches Under Investigation: Nexstar and Evertec
Two breaches disclosed in June 2026 are at the investigation stage and may generate litigation soon.
Nexstar Media Group, one of the largest local television station owners in the United States, is investigating claims by ShinyHunters that the group stole over 1.1 million Salesforce records, approximately 31 gigabytes of internal data, over 6,300 SharePoint files, and personnel data including names, emails, job titles, and office locations. ShinyHunters listed Nexstar on its extortion portal on June 11, 2026, with a June 14 deadline to make contact. Nexstar has acknowledged the reports but says there has been no disruption to its operations. No data had been publicly leaked as of the report date, and the claims had not been independently verified.
Evertec, a payment technology company, filed a Form 8-K with the SEC on June 9, 2026, disclosing that it discovered unauthorized access to customer data on May 13, 2026, through a compromised third-party support platform. Exposed data includes transaction records, payment card numbers, and in some cases customer names and contact information, primarily affecting financial institution clients in Puerto Rico and their customers. Popular, a major Puerto Rico bank, has issued breach notifications to affected customers. No class action has been filed, though attorneys are investigating.
Securities Fraud Suits Target Cyber Failures
Cybersecurity failures are increasingly triggering securities litigation. Two suits filed in December 2025 illustrate the trend.
A shareholder suit filed December 18, 2025, in the Northern District of California alleges that the South Korean e-commerce company Coupang violated federal securities laws by failing to disclose that a former employee accessed 33 million customer records over a six-month period. The complaint is potentially the first to allege violations of the SEC’s 2023 cybersecurity disclosure rules, which require companies to report material breaches within four business days.
A second suit, filed December 19, 2025, in the Western District of Washington, alleges that network security company F5 made “materially false and misleading statements” about its security capabilities while experiencing a “long-term, persistent” breach by a nation-state actor affecting its BIG-IP product. The Department of Justice determined in September 2025 that a delay in public disclosure was warranted because immediate disclosure posed a “substantial risk to national security or public safety.”
DOGE Access to Social Security Data Still in Court
A separate suit, with no hackers involved, remains active. A coalition of labor unions and an advocacy organization sued the Social Security Administration, alleging that personnel from the Department of Government Efficiency gained “unfettered access” to SSA data systems containing the Social Security numbers and personal information of most living Americans, in violation of the Privacy Act of 1974 and the Administrative Procedure Act.
Social Security Administration v. American Federation of State, County, and Municipal Employees (Case No. 1:25-cv-596, D. Md.) has moved through multiple courts. A federal judge in Maryland issued a temporary restraining order in March 2025. The Supreme Court lifted that order in June 2025 in an unsigned decision. In January 2026, the Department of Justice conceded in a court filing that DOGE associates may have improperly accessed sensitive SSA data, that a DOGE employee signed an agreement to share SSA data with an unnamed political advocacy group, and that DOGE utilized an “unauthorized server” with much of the data access occurring “outside of official protocols.” The government also acknowledged that two DOGE associates gained access to sensitive data after the March 2025 restraining order was in place. On April 10, 2026, the Fourth Circuit vacated the lower court’s preliminary injunction and remanded for further proceedings. The litigation remains active, with plaintiffs seeking discovery into the full extent of the access.
Courts Are Raising the Bar for Standing
Even as filings climb, courts are tightening the rules on who can sue. More than 3,000 data breach class actions were filed in 2025, a 200 percent increase since 2022, and federal class action filings overall reached more than 12,200 in 2025, roughly 25 percent higher year over year. Cybersecurity and privacy litigation is identified as a primary driver.
Several circuit courts have reinforced the requirement that plaintiffs show “concrete and particularized” injury rather than speculative future harm. The Fourth Circuit ruled in October 2025 that mere unauthorized access to data is not enough for standing; plaintiffs must show their stolen data was actually published, such as on the dark web. A Western District of North Carolina court dismissed a breach suit against Bojangles in September 2025 because the plaintiffs could not demonstrate actual misuse of their data traceable to the defendant’s breach. Courts are increasingly willing to dismiss at the pleading stage unless plaintiffs can point to real, documented harm.