Cybersecurity lawsuits climbed sharply in 2026, with class actions filed after 14% of publicly disclosed data security incidents in 2025 (up from 9% the year before) and federal class action filings overall jumping roughly 25% year over year to more than 12,200 cases. Cybersecurity and privacy claims were identified as a leading driver of that growth.1BakerHostetler. BakerHostetler Releases 2026 Data Security Incident Response Report2LexisNexis. Key Litigation Trends of Federal Class Action Statistics The suits reach across healthcare, banking, retail, dating apps, and tech, and the U.S. Supreme Court has now taken up a case that could reshape one of the largest categories of privacy claims.
Norton Rose Fulbright’s midyear survey of 135 general counsel found 56% reporting increased federal cybersecurity and data-privacy litigation exposure since the start of 2026, and 53% reporting the same at the state level. Half named cybersecurity breaches as a likely class action trigger. Technology companies reported the highest exposure of any sector.3Norton Rose Fulbright. Midyear Litigation Trends Survey Finds Cyber, AI Threats Intensifying Corporate Litigation Exposure4Norton Rose Fulbright. Technology
The Biggest Breach Lawsuits of 2026
Stryker and the Iranian-Linked Attack
On March 11, 2026, the Iran-linked hacker group Handala claimed responsibility for a cyberattack on Stryker, the Michigan medical technology company. The attackers gained access to Microsoft Intune, wiped employee phones, and blocked access to company computers, disrupting order processing, manufacturing, and shipping. Stryker disclosed a “global disruption to the company’s Microsoft environment” in an SEC filing.5NBC News. Iran Cyber Attack Stryker US Company6Nextgov/FCW. CISA Launches Investigation Into Stryker Cyberattack
The first class action, Mesmer v. Stryker Corporation (Case No. 1:26-cv-832), was filed in federal court in Michigan two days later. The complaint alleged that approximately 50 terabytes of data had been extracted, including names, dates of birth, Social Security numbers, employment information, and private health information of consumers and current and former employees. Plaintiffs accused Stryker of failing to implement basic measures such as intrusion detection and network vulnerability management, and noted the company had not yet notified affected individuals. At least four lawsuits followed, including one from a current Stryker employee. Stryker said the breach was contained and declined to comment on the pending litigation.7ClassAction.org. Data Breach Lawsuit Alleges Stryker Failed to Protect Private Info From March 2026 Cyberattack8WWMT. Stryker Cyberattack Lawsuits: Several Allege Failure to Protect Sensitive Data
Citizens Bank and Frost Bank
Citizens Bank and Frost Bank face six proposed class actions after the ransomware group Everest claimed to have stolen 3.4 million records from Citizens and more than 250,000 Social Security numbers from Frost. Both banks say the breach occurred at a third-party vendor and that their own networks were not compromised. Neither has publicly identified the vendor.
Four federal complaints against Citizens Financial were filed in the U.S. District Court for the District of Rhode Island. One case cites specific leaked file names; another asks for a court declaration that the bank’s current data security is inadequate. Two state-court petitions against Frost were filed in Bexar County, Texas, alleging the compromise of millions of records including credit card and passport information, categories the bank has not confirmed. Citizens called the claims “generally inaccurate” and said the compromised data does not contain Social Security numbers. As of April 2026, neither bank had filed a material cybersecurity incident report with the SEC.9American Banker. Customers Sue Citizens, Frost Over Third-Party Data Breach
Match Group
In late January 2026, the cybercriminal group ShinyHunters claimed the theft of more than 10 million user records from Match Group platforms, including Hinge, Match, and OkCupid, along with hundreds of internal documents. The attack reportedly used voice phishing to target single sign-on credentials. Match Group confirmed a “limited amount of user data” was involved and said it acted “quickly to terminate the reported unauthorized access,” with no evidence that login credentials, financial data, or private messages were stolen.10UpGuard. Match Data Breach
A proposed class action, Stevens v. Match Group Inc. (Docket No. 3:26-cv-00255), was filed on January 30, 2026, in the U.S. District Court for the Northern District of Texas. The plaintiff alleged that Match Group breached duties under common law, contract law, industry standards, and the Federal Trade Commission Act by failing to implement reasonable data security. CarMax was hit with a separate lawsuit arising from the same ShinyHunters spree.11Bloomberg Law. Match Group, CarMax Targeted in ShinyHunters Data Breach Spree
DentaQuest
ShinyHunters also claimed responsibility for a breach at DentaQuest, a dental and vision insurance provider under Sun Life U.S. The group alleged it exfiltrated 234 gigabytes of data after failing to reach a ransom agreement. The breach is estimated to affect 2.6 million individuals. Exposed data reportedly includes names, email addresses, dates of birth, phone numbers, home addresses, Medicaid IDs, health insurance information, and more than 1.7 million unique Social Security numbers that appear to relate to children.12HIPAA Journal. DentaQuest Data Breach As of mid-2026, attorneys were investigating potential class action claims, though no formal lawsuit had been filed.13ClassAction.org. DentaQuest Data Breach Lawsuit Investigation
LexisNexis
On February 24, 2026, a threat actor group calling itself FulcrumSec exploited an unpatched vulnerability in a React frontend application on LexisNexis’s AWS infrastructure. The company confirmed unauthorized access to a “limited number of servers” and said the data was “mostly legacy, deprecated data from prior to 2020,” including customer names, user IDs, business contact information, and support tickets. LexisNexis said the breach did not include Social Security numbers, driver’s license numbers, financial information, or active passwords.14LawNext. LexisNexis Confirms Data Breach FulcrumSec claimed the haul was larger: 3.9 million internal records, profile data for roughly 400,000 users, and information related to 118 users with government email addresses, including federal judges, law clerks, DOJ attorneys, and SEC personnel.15Paubox. Hackers Crack LexisNexis Cloud in Data Theft No lawsuits had been filed as of mid-2026, though at least one law firm announced a class action investigation.
Tracking-Pixel and Wiretap Suits
A separate wave of litigation targets companies for the tracking technologies embedded on their websites. Plaintiffs allege that pixels, analytics scripts, and session-replay tools transmit user data to third parties in violation of decades-old wiretap and video-privacy statutes. Defendants named in these disputes range from hospital systems to Amazon, Apple, Google, Meta, Reddit, and Hulu.16Law360. Privacy and Cybersecurity Litigation to Watch in 2026
Plaintiffs argue that third-party code transmitting information like IP addresses, device details, and pages visited constitutes an unlawful “interception” under the Federal Wiretap Act and state all-party-consent statutes. California leads the volume with more than 3,100 recorded cases, followed by Florida with roughly 580. Courts are split. In W.W. v. Orlando Health, Inc. (M.D. Fla., March 2025), a federal judge denied a motion to dismiss wiretap claims, calling the technical questions about data transmission inappropriate for resolution at the pleading stage. In Vita v. New England Baptist Hospital (2024), the Massachusetts Supreme Judicial Court ruled that the state wiretap statute does not apply to “ordinary web browsing activity,” saying it was meant to address secret audio surveillance. Plaintiffs have responded to such setbacks by shifting toward federal statutory theories.17Darrow Everett LLP. Pixel Litigation Trends by State
The Supreme Court’s VPPA Case
The Video Privacy Protection Act, a 1988 law originally aimed at video-rental records, has become a centerpiece of tracking-pixel litigation. Plaintiffs allege that website tracking tools disclose their video-viewing habits and identifiers to third parties without consent. The central question: who counts as a “consumer” under the statute?
In January 2026, the U.S. Supreme Court granted certiorari in Salazar v. Paramount Global (No. 25-459) to resolve a circuit split on that question. The case arose from allegations that Paramount, through its 247Sports website, used a Facebook tracking pixel to transmit a user’s video-viewing activity to Facebook after the user signed up for an online newsletter. The Sixth Circuit held that newsletter-only subscribers do not qualify as VPPA “consumers,” while the Second and Seventh Circuits have adopted a broader reading.18Paul, Weiss, Rifkind, Wharton & Garrison LLP. Supreme Court to Resolve Circuit Split Concerning Definition of Consumer Under VPPA Oral argument is expected during the October Term 2026. A narrow ruling could eliminate a large category of tracking-pixel class actions; a broad one could expand exposure for any website that hosts video content.19Thompson Coburn LLP. Supreme Court Takes Up VPPA Consumer Question
Some tracking-pixel cases have already settled. Duke University Health System agreed to pay $3.74 million to resolve allegations that pixels on its MyChart patient portal shared health data with third-party vendors, with claims open to users who accessed the portal between February 2019 and June 2022. Thriveworks agreed to a $1.9 million settlement over similar allegations that pixels shared sensitive health data with Google and LinkedIn.20Dapeer Law. Open Settlements
What Consumers Can Actually Collect
Per-person payouts in data breach settlements are typically modest. Historical data from large settlements shows per-member payments ranging from $0.50 to $12.65, with smaller classes generally receiving more per person. The largest historical breach settlements dwarf those figures: Equifax paid $380 million, T-Mobile paid $350 million, and Yahoo settled for $117.5 million.21Directors & Boards. What Boards Need to Know About Data Breach Class Actions Attorneys’ fees in cases that settle typically run about 30% of the total.
Active cybersecurity settlements with claim deadlines in 2026 show the range of what individuals can expect:
- Flagstar Bank: $31.5 million fund for 2021 cyberattacks, with up to $25,000 for documented losses and an estimated $60 no-proof cash payment. Claim deadline: August 11, 2026.
- Lakeview Loan Servicing: $26 million for a 2021 breach, with up to $5,000 for documented losses plus a pro rata cash payment. Deadline: June 22, 2026.
- Essen Medical Associates: $4 million for a 2023 breach involving patient Social Security numbers and health insurance data. Up to $5,000 for documented losses or $100 cash. Deadline: June 1, 2026.
- Illinois Bone and Joint Institute: $4 million for a July 2024 breach, with up to $5,000 for documented losses or an estimated $50 cash payment. Deadline: July 1, 2026.
- Cardiovascular Consultants: $3.85 million for a September 2023 breach, offering up to $5,000 for documented losses or an estimated $75 cash payment. Deadline: July 1, 2026.
- Complete Payroll Solutions: $2.6 million for a March 2024 breach, with up to $5,000 for documented losses, approximately $100 cash, and three years of credit monitoring. Deadline: June 18, 2026.
- Bell Ambulance: $2 million for a February 2025 cyberattack, with up to $5,000 for documented losses or an estimated $90 no-proof cash payment. Deadline: June 29, 2026.
- Krispy Kreme: $1.6 million for a breach discovered in November 2024. Up to $3,500 for documented losses or $75 pro rata cash. Deadline: June 22, 2026.
- Avis: $1.02 million for an August 2024 breach, with up to $5,000 for out-of-pocket losses or a pro rata cash payment. Final approval hearing scheduled for July 28, 2026.
The settlements above generally deliver better per-person outcomes than the historical average, likely because they target more narrowly defined classes.20Dapeer Law. Open Settlements Documented-loss awards require receipts and other proof (bank statements, credit-monitoring bills, time spent on identity-theft recovery); no-proof cash payments require only a claim confirming class membership.
Standing: The Threshold Fight in Every Case
A threshold issue in every data breach class action is whether plaintiffs can prove they were actually harmed. The Supreme Court’s 2021 decision in TransUnion LLC v. Ramirez tightened the requirements for demonstrating “concrete” injury, and defendants have leaned on it heavily in motions to dismiss. The Second Circuit’s framework in McMorris v. Carlos Lopez & Associates allows courts to consider whether the breach resulted from a targeted attack, whether any of the stolen data has already been misused, and whether the exposed data is sensitive enough to create a high risk of identity theft. Other circuits remain divided on whether the mere risk of future harm is enough.22Akin Gump Strauss Hauer & Feld LLP. Second Circuit Weighs In on Article III Standing in Data Breach Lawsuits
Beyond standing, defendants commonly rely on arbitration clauses to prevent class-wide litigation, motions to dismiss for failure to state a claim, and expert testimony asserting compliance with industry security standards.21Directors & Boards. What Boards Need to Know About Data Breach Class Actions
Regulators in the Background
The Cyber Incident Reporting for Critical Infrastructure Act, passed in 2022, would require covered entities across 16 critical infrastructure sectors to report cyber incidents to CISA within 72 hours and ransomware payments within 24 hours. The final rule has been repeatedly delayed. A partial government shutdown in early 2026 forced CISA to cancel town hall meetings meant to finalize the regulations, and the agency acknowledged that “continued delays associated with federal appropriations lapses will likely result in a delay to the issuance of the final rule.”23CISA. Cyber Incident Reporting for Critical Infrastructure Act of 2022 Acting CISA Director Nick Andersen said in June 2026 that the agency has no specific date for finalization.24Federal News Network. CISA Revives Push Toward Long-Awaited Cyber Incident Reporting Rules Without finalized federal reporting rules, companies continue to make their own judgments about when and whether to disclose. Both Citizens and Frost Bank, for instance, opted not to file SEC material cybersecurity incident disclosures after the Everest group’s claims.9American Banker. Customers Sue Citizens, Frost Over Third-Party Data Breach
The FTC uses Section 5 of the FTC Act to pursue data security failures. In 2025, the agency finalized consent orders against GoDaddy for misrepresenting its security practices, Illuminate Education for failing to secure student data affecting more than 10 million students, and the crypto protocol Nomad for inadequate code testing after a hack caused over $100 million in consumer losses. In early 2026, the FTC finalized an order against General Motors for collecting and selling geolocation data without informed consent.25FTC. Privacy and Security Enforcement Plaintiffs’ lawyers cite these orders as benchmarks in private class actions.
State attorneys general are also active, particularly around children’s data. Kentucky announced the first enforcement action under its Consumer Data Protection Act in January 2026, targeting AI-powered chatbots used by minors. Virginia’s AG declared an intent to “fully enforce” new provisions restricting minors’ social media use. Texas sued Netflix under its Deceptive Trade Practices Act, alleging misleading disclosures to collect personal information from children and the use of dark patterns.26Hunton Andrews Kurth LLP. State Attorneys General
AI as the Next Wave
Artificial intelligence is creating litigation exposure that intersects with cybersecurity. AI contributes to both the speed and scale of cyberattacks, according to the BakerHostetler report, and generates its own category of legal risk. Forty-six percent of respondents in the Norton Rose Fulbright survey reported increased federal dispute exposure related to AI, and 41% identified AI-enabled product launches as an emerging class action trigger.27Norton Rose Fulbright. 2026 Annual Litigation Trends Survey: A Midyear Industry Pulse In the technology sector, 56% of in-house counsel expect AI-related privacy or data protection violations to contribute to litigation. In healthcare, 53% of respondents reported increased federal AI exposure.4Norton Rose Fulbright. Technology
AI-assisted hiring tools are a particular flashpoint, with corporate legal leaders reporting “real uncertainty” about bias and discrimination claims being tested in courts and before the EEOC. Connecticut’s attorney general issued a legal memorandum in March 2026 on how the state’s data privacy act applies to artificial intelligence, signaling that enforcement may follow.26Hunton Andrews Kurth LLP. State Attorneys General
If you receive a data breach notice from a company involved in one of these matters, check the settlement administrator’s website for filing deadlines and documentation requirements, and keep records of any fraud, unauthorized charges, or time spent recovering from identity misuse. Those records are what distinguish a documented-loss claim from the smaller no-proof cash payment.