DISA Global Solutions, the Houston-based employee screening company, is facing two distinct lines of lawsuits: a consolidated class action in federal court over a 2024 data breach that exposed personal information of more than 3.3 million people, and a series of individual suits from workers who say the company’s drug-testing operations produced false positive results that cost them their jobs. The data breach litigation is the larger and more accessible track for affected individuals, and DISA is currently offering free identity monitoring to those who received a notice.
What Happened in the 2024 Data Breach
DISA discovered on April 22, 2024, that an unauthorized third party had been inside its computer systems since February 9, 2024. That is roughly two and a half months of undetected access. The company called it a cyber attack but has not publicly named the intruder or described how they got in.1HR Dive. DISA Data Breach Affects 3.3M People2Cybersecurity Dive. DISA Data Breach Affects 3.3M People
A forensic investigation could not definitively determine what the intruder actually took. Even so, DISA acknowledged that the exposed files contained a broad set of personal information on current and former employees of its client companies, along with job candidates. That included names, Social Security numbers, driver’s license numbers, dates of birth, and financial account details. More sensitive categories were also in the files: drug and alcohol testing results, criminal background check data, and medical or health-related records.1HR Dive. DISA Data Breach Affects 3.3M People3New Jersey Office of Homeland Security and Preparedness. DISA Global Solutions Data Breach4Maryland Office of the Attorney General. DISA Global Solutions Breach Notification
The total count reported was 3,332,750 affected individuals. DISA did not publicly disclose the breach until February 2025, roughly ten months after discovering it, and began mailing notification letters on February 21, 2025. Breach notices were also filed with state attorneys general, including in Maine and Maryland.2Cybersecurity Dive. DISA Data Breach Affects 3.3M People4Maryland Office of the Attorney General. DISA Global Solutions Breach Notification
The Class Action Now Pending in Houston
Litigation began within days of DISA’s public notification. On February 25, 2025, plaintiff Drew Webster filed a proposed class action in the U.S. District Court for the Southern District of Texas.5ISMG. Webster v. DISA Global Solutions Complaint Multiple similar suits followed, and the cases have been consolidated under lead case No. 4:25-cv-821 before Judge Keith P. Ellison.6PACER Monitor. Webster v. DISA Global Solutions, Inc.
The consolidated litigation seeks compensation on behalf of the millions of affected individuals for loss of privacy, time spent responding to the breach, and out-of-pocket costs tied to identity protection.7ClassAction.org. DISA Global Solutions Data Breach Lawsuits The case is still in its early stages. No class has been certified. No settlement has been announced. If you received a DISA notification letter, you would fall inside a proposed class if one is certified, but there is nothing to claim yet.
Free Identity Monitoring You Can Enroll in Now
Separate from the lawsuit, DISA is offering affected individuals 12 months of complimentary identity monitoring through Experian’s IdentityWorks program. The package includes credit monitoring on the individual’s Experian file, access to identity restoration specialists, and up to $1 million in identity theft insurance covering certain costs and unauthorized fund transfers. The enrollment deadline is June 30, 2025.4Maryland Office of the Attorney General. DISA Global Solutions Breach Notification Enrolling in the monitoring does not release your right to participate in the class action.
The Drug-Testing Lawsuits Against DISA
DISA is a third-party administrator for employer drug-testing programs across the oil and gas, transportation, and industrial sectors. That business has generated a separate line of cases from workers who say inaccurate test results ended their careers. These are individual lawsuits, not a class action, and outcomes have been mixed.
Marcus Davis
Marcus Davis, an oil and gas worker, sued DISA in June 2024 in the Southern District of Texas (Case No. 4:24-cv-02253) after being fired in 2022 following what he alleged was a false positive result for methamphetamine.8Fox 26 Houston. DISA Global Solutions Accused of False Positive Drug Tests9Law360. Davis v. DISA Global Solutions, Inc. et al No public outcome has been reported.
Brady Bass
Brady Bass sued DISA and several co-defendants after a 2017 hair follicle test allegedly returned a false positive he said made him unemployable in the petrochemical industry. The East Baton Rouge Parish trial court granted summary judgment to DISA, finding the company owed him no legal duty because it served only as program administrator and did not collect or analyze samples. The court also ruled the defamation claim failed because the results DISA reported had been confirmed by the testing lab, making truth a defense. The Louisiana Court of Appeal affirmed the dismissal in July 2024.10Midpage AI. Brady Bass v. DISA Global Solutions, Inc., et al.
Irvin Dauphine
Irvin Dauphine, an offshore management professional, was suspended in August 2017 after a hair test allegedly came back positive for marijuana. A re-test was negative and he was reinstated. On the day he returned to work, DISA asked the lab to re-analyze the specimen at a lower threshold. The lab flipped the result to positive, and Dauphine was fired on September 8, 2017.11FindLaw. Dauphine v. DISA Global Solutions, Inc.
His lawsuit was initially dismissed as time-barred, with the trial court running the one-year filing clock from his suspension. The Louisiana Third Circuit Court of Appeal reversed in November 2022, holding the clock did not start until September 8, 2017, when Dauphine learned of his termination. The appellate court found it reasonable that he believed the matter was resolved after the negative re-test and reinstatement.11FindLaw. Dauphine v. DISA Global Solutions, Inc.12Bloomberg Law. Dauphine v. DISA Global Solutions, Inc.
Why Drug-Test Claims Are Harder to Win in Texas
A June 2023 ruling from the Texas Supreme Court has made these cases considerably tougher in the state where DISA is headquartered. In Houston Area Safety Council, Inc. v. Mendez, the court held that third-party entities hired by an employer to collect and test biological samples owe no common-law duty of reasonable care to the employee being tested.13Texas Courts. Houston Area Safety Council, Inc. v. Mendez
The court reasoned that testing companies have a contract with the employer, not the worker, and that imposing a negligence duty could conflict with Texas’s employment-at-will doctrine. It pointed to existing safeguards such as medical review officers who evaluate positive results before they are finalized. Whether such a duty should exist, the court said, is a policy question for the Texas Legislature.13Texas Courts. Houston Area Safety Council, Inc. v. Mendez For a Texas worker considering a suit against DISA over a false positive, that ruling is the first obstacle any lawyer will raise.