The Snowflake lawsuit landscape splits into two tracks: a consolidated multidistrict data breach case in Montana federal court arising from the 2024 credential-based attacks on customer accounts, and two separate securities fraud class actions in the Northern District of California accusing executives of misleading investors about the company’s revenue and consumption trends. As of mid-2026, the breach MDL has 74 pending actions with two corporate defendants already settled, and both securities cases are still at the pleading stage.
The 2024 Data Breach Multidistrict Litigation
Between April and June 2024, attackers used login credentials stolen by infostealer malware to break into roughly 165 Snowflake customer environments. The breach did not exploit Snowflake’s own infrastructure. It took advantage of the fact that Snowflake did not require customers to turn on multi-factor authentication, which was off by default.1Huntress. Snowflake Data Breach
The list of affected companies reads like a directory of major consumer brands: Ticketmaster and Live Nation, AT&T, Santander Bank, Advance Auto Parts, Neiman Marcus, LendingTree, and Pure Storage, among others. More than 500 million consumers and employees had personal information exposed. AT&T’s stolen data covered call and text metadata for about 110 million customers. Ticketmaster lost names, addresses, and partial payment card data for roughly 560 million people.2U.S. District Court for the District of Montana. Snowflake Data Security Breach Litigation1Huntress. Snowflake Data Breach
On October 4, 2024, the Judicial Panel on Multidistrict Litigation consolidated the consumer cases as In Re: Snowflake, Inc., Data Security Breach Litigation, MDL No. 3126, before Chief Judge Brian Morris in the District of Montana. By June 2026, 104 actions had been filed; 74 remained pending and 30 had been resolved.3MDL Update. MDL-3126 Snowflake Inc. Data Security Breach Litigation
Plaintiffs allege that Snowflake failed to follow industry-standard cybersecurity practices, particularly by not enforcing MFA on customer accounts, while marketing itself as offering “industry-leading” security. Financial institution plaintiffs also claim they lost money investigating the breach, reimbursing fraudulent charges, and reissuing cards. At the pleading stage, the court found those plaintiffs had adequately alleged Snowflake owed a duty of care, breached it through inadequate MFA enforcement, and caused their injuries.4CaseMine. In Re Snowflake Inc. Data Security Breach Litigation
In late October 2025, Judge Morris denied efforts by Snowflake and several of its corporate clients, including Ticketmaster and LendingTree, to dismiss the cases or push them into arbitration.5Law360. Snowflake Clients Can’t Escape MDL Over Cloud Data Breach
Settlements With Advance Auto Parts and Neiman Marcus
Two corporate defendants have settled with affected consumers.
Advance Auto Parts agreed to a $10 million non-reversionary settlement fund covering an estimated 2.3 million class members. Eligible individuals could claim up to $5,000 for documented out-of-pocket losses, receive two years of credit and identity monitoring, or take an alternative cash payment estimated at $100. The court granted preliminary approval on May 22, 2025, and final approval on October 23, 2025. Class counsel received $3,333,000 in fees plus $85,243.79 in costs.6ClassAction.org. Snowflake Data Security Breach Litigation Settlement Agreement7U.S. District Court for the District of Montana. Order Granting Class Action Settlement – Advance Auto Parts
Neiman Marcus agreed to a separate $3.5 million non-reversionary fund for consumers whose information was compromised in the May 2024 incident. Class members could claim up to $2,500 in documented losses and two years of credit monitoring. Preliminary approval came on May 22, 2025, and final approval on October 23, 2025.8ClassAction.org. Snowflake Data Security Breach Litigation – Neiman Marcus Settlement Agreement9Claim Depot. Neiman Marcus Group $3.5 Million Data Breach Settlement
On December 19, 2025, the court dismissed with prejudice all claims by the Advance Auto Parts and Neiman Marcus plaintiff groups against Snowflake itself. Claims against Snowflake and other corporate defendants in the MDL continue.10U.S. District Court for the District of Montana. Order Granting Joint Motion to Dismiss Claims – Neiman Marcus Group2U.S. District Court for the District of Montana. Snowflake Data Security Breach Litigation
The Flannery Securities Fraud Case (2020–2022)
Flannery v. Snowflake Inc., No. 5:24-cv-01234, was filed on February 29, 2024, in the Northern District of California before Judge P. Casey Pitts. The class period runs from September 16, 2020, to March 2, 2022. Plaintiffs allege Snowflake oversold computing capacity, used unsustainable pre-IPO discounts to inflate sales, and then rolled out “platform efficiency adjustments” that reduced customer consumption and revenue, inflating product revenue and key metrics in the meantime.11BusinessWire. Robbins Geller Rudman Dowd LLP Files Class Action Lawsuit Against Snowflake Inc.
The alleged corrective disclosure came on March 2, 2022, when Snowflake projected fiscal 2023 product revenue growth of only 65% to 67%, well below prior triple-digit expectations, and CFO Michael P. Scarpelli attributed the drop to “platform enhancements” that lowered credit usage. The stock fell nearly 28% over several sessions.11BusinessWire. Robbins Geller Rudman Dowd LLP Files Class Action Lawsuit Against Snowflake Inc.
A lead plaintiff and counsel were appointed on August 29, 2024. Defendants filed a motion to dismiss the third amended complaint on June 3, 2026, with a hearing set for August 20, 2026.12PACER Monitor. Flannery v. Snowflake Inc. et al.
The Patel Securities Fraud Case (2023–2024)
Harsh Patel v. Snowflake Inc., et al., No. 3:26-cv-01613, was filed on February 24, 2026, in the Northern District of California. It covers a class period from June 27, 2023, through February 28, 2024, and names Snowflake, former CEO and Chairman Frank Slootman, and former CFO Michael P. Scarpelli.13Levi & Korsinsky LLP. Snowflake Inc. Class Action Lawsuit
The complaint alleges Slootman and Scarpelli publicly reassured investors about the consumption-based revenue model while concealing that three specific factors were expected to materially hurt consumption and growth: product efficiency gains, customer adoption of a feature called “Iceberg Tables,” and tiered storage pricing. Investors point to statements Scarpelli made in June 2023 calling consumption “back where we’d expect it to be,” in August 2023 describing it as “really good,” and in November 2023 touting “strong consumption from a broad base of customers.” The complaint also alleges Slootman denied retirement rumors while privately planning to step down.13Levi & Korsinsky LLP. Snowflake Inc. Class Action Lawsuit14Robbins LLP. Snowflake Inc.
After the market closed on February 28, 2024, Snowflake disclosed that consumption trends had not recovered, cited revenue headwinds from efficiency gains, tiered pricing, and Iceberg Tables, withdrew its longstanding $10 billion product revenue target for fiscal year 2029, and lowered fiscal 2025 growth guidance to 22%. The same announcement revealed that Slootman had retired as CEO the day before. The stock fell $41.72 per share, an 18.14% decline, closing at $188.28 on February 29, 2024.15Kaplan Fox & Kilsheimer LLP. Snowflake Inc.16Kessler Topaz Meltzer & Check LLP. Snowflake Inc. Class Action Lawsuit
A related complaint filed in May 2026, Smith v. Snowflake Inc., No. 3:26-cv-04869, adds allegations about Slootman’s stock sales. It says he established a Rule 10b5-1 sales plan on September 25, 2023, and sold roughly $223 million worth of Snowflake stock during a 46-day period leading up to the February 2024 disclosures, including a $50 million sale just 19 days before his retirement announcement.17D&O Diary. Snowflake Complaint
On June 1, 2026, Judge James Donato appointed Meitav Provident and Pension Funds Ltd. as lead plaintiff, finding the Israeli pension fund had the largest financial interest and satisfied typicality and adequacy. Pomerantz LLP was appointed lead counsel. The court approved a stipulation setting deadlines for an amended complaint and motion to dismiss on June 18, 2026.18PACER Monitor. Patel v. Snowflake Inc. et al.
The Criminal Cases Are Separate
The federal prosecutions of the individual hackers are not lawsuits against Snowflake and do not affect the civil cases directly, but they run in parallel. In November 2024, the Justice Department unsealed an indictment in the Western District of Washington charging Alexander “Connor” Moucka, a Canadian citizen, and John Erin Binns with conspiracy, ten counts of wire fraud, four counts of computer fraud and abuse, two counts of computer-fraud extortion, and two counts of aggravated identity theft.19KrebsOnSecurity. Canadian Man Arrested in Snowflake Data Extortions20CyberScoop. Connor Moucka Snowflake Data Breach Indictment
Moucka was arrested in Kitchener, Ontario, on October 30, 2024, and consented in writing to extradition in March 2025, though transfer was still pending as of that date.21CyberScoop. Connor Moucka Snowflake Hacker Extradition Binns was arrested in Turkey in late May 2024 and remains in a Turkish prison. Fortune reported that a senior Turkish official said Binns had been granted Turkish citizenship while jailed, making extradition to the United States unlikely.22Fortune. Unlikely Trio Linked to Hack of AT&T Data
A third defendant, Cameron John Wagenius, a 21-year-old former U.S. Army soldier, pleaded guilty in federal court in Seattle to conspiracy to commit wire fraud, computer-fraud extortion, and aggravated identity theft tied to the Snowflake and AT&T attacks, and separately pleaded guilty to two counts of unlawfully transferring confidential phone records. He faces up to 27 years in prison. Sentencing is scheduled for October 6, 2025.23U.S. Department of Justice. Former U.S. Soldier Pleads Guilty to Hacking and Extortion Scheme24CyberScoop. Cameron Wagenius AT&T Snowflake Guilty Plea
Where Things Stand
Consumers whose data was exposed at Advance Auto Parts or Neiman Marcus have already had a claims process; those settlements received final approval in October 2025 and the related claims against Snowflake itself were dismissed in December 2025. Everything else in MDL 3126 is still live, including claims tied to AT&T, Ticketmaster, LendingTree, and other affected customers. On the securities side, the Flannery case will turn on the August 20, 2026 motion-to-dismiss hearing, and the Patel case is moving toward an amended complaint under new lead plaintiff Meitav and lead counsel Pomerantz LLP.