Deloitte Lawsuit: $172M ERP Suit, Data Breach & Penalties

Deloitte is currently defending a $172 million lawsuit from medical device maker Zimmer Biomet over a failed software rollout, along with a proposed class action from former employees who say the firm penalizes workers who take family leave. In the past year, Deloitte has also paid to resolve a large Rhode Island data breach, agreeing to a $6.3 million class action settlement and a separate $12 million deal with the state. Those cases sit on top of a long enforcement record that includes more than $301 million in documented penalties since 2000.¹

Zimmer Biomet’s $172 Million ERP Lawsuit

The largest active suit against Deloitte was filed by Zimmer Biomet Holdings on September 4, 2025, in the Supreme Court of the State of New York, New York County (Case No. 2511582).² At issue is a cloud-based SAP S/4HANA platform Deloitte was hired in 2021 to build under a $69 million work order. Deloitte’s own analysis had projected the new system would save Zimmer Biomet between $197 million and $316 million over a decade.³

The system was supposed to go live in February 2023. After repeated delays, it launched in North America on July 4, 2024. According to Zimmer Biomet’s complaint, Deloitte pushed the go-live date despite unresolved “showstopper” risks.⁴ Zimmer Biomet says it was “barely operational” through the third quarter of 2024, unable to ship or receive products, issue invoices, or generate basic sales reports. Because the company makes orthopedic implants used in surgery, halted shipments meant doctors and patients could not get devices they needed.⁵

The complaint also targets how the project was staffed. Zimmer Biomet alleges the consulting team lacked necessary skills, leaned on an offshore team in India with “constant” turnover, and received little oversight from onshore staff. Over the life of the engagement, 51 change orders added $23 million to the contract, bringing total fees to $94 million, or 36% over budget. Zimmer Biomet says Deloitte “change-ordered Zimmer Biomet to death.”³

The complaint asserts four causes of action: fraud, breach of contract, negligent misrepresentation, and deceptive trade practices under New York General Business Law § 349.⁶ Zimmer Biomet is seeking at least $173 million: $94 million in fees paid to Deloitte, $15 million for failed remediation work, and $72 million in additional internal costs to stabilize the system after go-live.³ The company is represented by Loeb & Loeb LLP, led by partner Mark P. Ressler.

The financial fallout was significant. In October 2024, Zimmer Biomet cut its full-year revenue growth guidance from 4.0–5.0% to 3.5–4.0% and lowered its adjusted earnings-per-share forecast from $8.00–$8.15 to $7.95–$8.05, citing implementation challenges.⁷ Following the disclosures, the company’s market capitalization dropped by roughly $2 billion.⁴

Deloitte’s Response

Deloitte moved to dismiss on November 7, 2025.⁵ The firm argues Zimmer Biomet never followed the contract’s required notice procedure, which required flagging unacceptable work in writing within 15 days, and says no such notice was ever provided. On the merits, Deloitte says it served the company “diligently and ably,” that the new system produced “significant, tangible benefits,” and that Zimmer Biomet had earlier described the project as a “success,” approved deliverables, and “repeatedly praised Deloitte’s work in effusive terms.” The firm called the fraud allegations “delusionary.”⁸ Deloitte separately asks the court to dismiss the GBL § 349 claim, arguing the relationship was not “consumer-oriented” conduct. As of mid-2026, the court had not ruled on the motion, and the case remained pending.

RIBridges Data Breach: Settled

Deloitte was the contractor and vendor for RIBridges, Rhode Island’s system for administering Medicaid, food stamps, and the HealthSource RI marketplace. In July 2024, an attacker group called “Brain Cipher” got into the system using a stolen Deloitte username and password. The intruders stayed inside for roughly five months. Deloitte notified the state on December 5, 2024, one day after the stolen data appeared on the dark web, and Governor Dan McKee disclosed the breach publicly on December 13.⁹ An estimated 644,401 people who had applied for or received benefits had their information compromised, including Social Security numbers, banking information, and health data.¹⁰

The $6.3 Million Class Action Settlement

A class action, Pannozzi v. Deloitte Consulting LLP (Case No. 1:24-cv-00524-MRD-LDA), was filed in the U.S. District Court for the District of Rhode Island. Deloitte agreed in October 2025 to a $6.3 million settlement while denying wrongdoing.¹¹

Class members could claim up to $5,000 for documented breach-related losses or take a flat estimated payment of about $100 without documentation. All class members were eligible for two years of free medical data monitoring. The fund also covered attorneys’ fees of up to one-third and $2,500 payments to each of the seven named plaintiffs.¹¹¹²⁹ The claims window is closed.

The State’s Separate $12 Million Deal

Rhode Island reached its own agreement with Deloitte, apart from the class action. The state had already received a $5 million payment from Deloitte in February 2025. On April 24, 2026, the Rhode Island Department of Administration announced an additional $7 million settlement, bringing the state’s total cash recovery to $12 million. Deloitte also provided roughly $6 million in system enhancements and operational support at no cost. Both sides described the agreement as a compromise of disputed claims, with neither party admitting liability, and agreed to non-disparagement clauses.⁹

Parental and Family Leave Discrimination Claims

Deloitte is also defending a proposed class action alleging it penalizes employees who take parental or family leave. In Barela v. Deloitte Consulting LLP (Case No. 3:26-cv-03051-RS), filed April 9, 2026 in the U.S. District Court for the Northern District of California, former senior manager Joanne Barela alleges Deloitte’s performance review system requires employees who take pregnancy-related, parental, or family leave to hit the same annual performance targets as colleagues who worked a full 12 months. Because scores drive salary increases and bonuses, Barela says the system produces a cumulative financial penalty for using leave. She alleges her December 2025 termination during a reduction in force was based on ratings that had been lowered by her protected leave. The complaint raises claims under the FMLA, the Pregnant Workers Fairness Act, and Title VII of the Civil Rights Act.¹³¹⁴ As of mid-2026, Deloitte had not publicly responded, and the court had not ruled on class certification.

The Barela case echoes an earlier suit. In September 2020, former senior manager Saxon Knight filed a proposed class action in the Southern District of New York (Knight v. Deloitte Touche Tohmatsu Limited, Case No. 1:20-cv-07114). Knight alleged Deloitte advertised a 16-week paid family leave program but enforced an undisclosed policy under which employees who took more than 12 weeks forfeited their right to return to their prior position. After taking parental leave in 2019, Knight said she was denied her former role, assigned demeaning tasks, and terminated in July 2020. The complaint raised claims under the FMLA, the New York State Human Rights Law, and the New York City Human Rights Law.¹⁵ The parties filed a stipulation of voluntary dismissal with prejudice in June 2022, indicating a confidential settlement.¹⁶

Prior Penalties and Failed ERP Projects

Since 2000, Deloitte has accumulated more than $301 million in documented penalties across at least 32 enforcement actions.¹¹⁷¹⁸ In 2016, Deloitte Consulting LLP paid $11.38 million to settle False Claims Act allegations that it failed to pass along required price reductions to the federal government under a GSA information technology services contract from 2006 to 2012.¹⁹

The SEC has brought its own actions. In 2005, Deloitte paid $50 million to settle SEC charges that it conducted “a critically flawed audit” of Adelphia Communications, which had excluded $1.6 billion in debt from its balance sheet and overstated stockholders’ equity by $375 million. Deloitte settled without admitting or denying wrongdoing.²⁰ In 2022, the SEC fined Deloitte’s China affiliate $20 million over audit failures spanning 12 PCAOB audits, alleging the firm let clients select their own samples for testing and prepare audit documentation.²¹

The Zimmer Biomet dispute also is not Deloitte’s first fight over a failed enterprise software implementation. In 2010, Marin County, California sued Deloitte for $30 million, alleging Deloitte misrepresented its capabilities, failed to provide experienced staff, and delivered an SAP ERP system that produced payroll error rates five times higher than the legacy system it replaced. The county fired Deloitte in late 2007. Deloitte countered that the software was working properly when its work concluded and filed its own claim for unpaid fees.²²

1
Good Jobs First Violation Tracker. Deloitte
2
Becker’s Spine Review. Zimmer Biomet Sues Deloitte for $172M
3
MassDevice. Zimmer Biomet Sues Deloitte for $172 Million
4
Upper Edge. Zimmer Biomet’s $172M ERP Lawsuit Against Deloitte: Disaster, Disclosure, and Investor Risk
5
MassDevice. Zimmer Biomet Deloitte Response ERP Lawsuit Looking Glass
6
Loeb & Loeb LLP. Loeb Represents Zimmer Biomet in $172 Million Lawsuit Against Deloitte
7
Zimmer Biomet. Zimmer Biomet Reports Third Quarter 2024 Financial Results
8
Journal Gazette. Zimmer Biomet Lawsuit Against Deloitte Consulting Continues to Move Through New York Court
9
Rhode Island Current. State Announces $7 Million Settlement With Contractor Deloitte Over RIBridges Cyber Breach
10
Top Class Actions. $6.3M RIBridges Data Breach Class Action Settlement
11
Rhode Island Current. Deadline to Submit Claims for RIBridges Data Breach Settlement Is Jan. 14, 2026
12
RIBridges Data Settlement. Documents
13
Yahoo Finance. Deloitte Consulting Penalized Employees Taking Leave
14
Barela Complaint. Barela v. Deloitte Consulting LLP, Complaint
15
Deloitte Class Action Complaint. Knight v. Deloitte Touche Tohmatsu Limited, Complaint
16
Bloomberg Law. Deloitte, Ex-Senior Manager Resolve Parental Leave Bias Lawsuit
17
Reuters. Deloitte to Pay $149.5 Million to U.S. Over Failed Mortgage Lender
18
HUD OIG. Deloitte & Touche Agrees to Pay $149.5 Million to Settle Claims Arising From Its Audits
19
U.S. Department of Justice. Deloitte Consulting LLP Agrees to Pay $11 Million for Alleged False Claims Related to General Services
20
The New York Times. Deloitte to Pay $50 Million to Settle Adelphia Case
21
Thomson Reuters Tax & Accounting. SEC Fines Deloitte China for Audit Failures
22
Computerworld. Deloitte Hit With $30M Lawsuit Over ERP Project