Loading story…
Bojangles and law firm Blank Rome are facing class-action litigation after separate breaches exposed sensitive personal data. In North Carolina, a Business Court judge ruled that a lawsuit over Bojangles’ 2024 employee breach can proceed in state court after a similar federal case was dismissed. The suit, filed by nine former employees on behalf of other affected workers, alleges that hackers tied to Hunters International stole more than 387,000 files totaling over 290 GB and later posted data on the dark web, including Social Security numbers and other employee information.
Blank Rome was hit with two proposed class actions after a May breach allegedly affected more than 57,000 current, former, and prospective clients. The firm said the incident began with a social-engineering attack in which a cybercriminal impersonated the IT department and persuaded an attorney to upload files to an external hosting site. Plaintiffs allege the firm lacked adequate cybersecurity controls and employee training, delayed notification for more than a month after the May 21 incident, and exposed personal, financial, and health-related information.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
A North Carolina Business Court judge ruled that the class-action lawsuit over Bojangles' 2024 employee data breach can proceed in state court. The decision marked a reversal from the earlier federal-court dismissal described in the article.
Blank Rome became the target of two lawsuits over the May data breach affecting more than 57,000 clients. The complaints allege inadequate cybersecurity safeguards, insufficient employee training, and delayed notification to affected individuals.
In 2025, litigation over the Bojangles employee data breach was dismissed in federal court. The article says plaintiffs later found more success pursuing the matter in North Carolina state court.
In January 2025, nine former Bojangles employees filed a lawsuit on behalf of themselves and other affected workers over the company's 2024 employee data breach. The suit sought relief for the exposure of sensitive employee information.
In 2024, Bojangles suffered an employee data breach linked in the article to the Russian hacking group Hunters International. The attackers allegedly stole more than 387,000 files and over 290 GB of data, including employees' Social Security numbers and other personal information, and posted sensitive data on the dark web.
On 2026-05-21, Blank Rome LLP says a cybercriminal impersonated the firm's IT department and convinced an attorney to upload files to an external file-hosting site. The incident allegedly exposed personal information belonging to more than 57,000 current, former, and prospective clients.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourceteiss.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US healthcare data-breach litigation and enforcement activity saw multiple updates, including new criminal charges tied to the **2023 Geisinger Health** breach. Prosecutors filed a superseding indictment adding **two counts of false statements** against **Max Vance**, a former **Nuance Communications** employee accused of intentionally accessing a protected computer and obtaining **PHI for more than 1.3 million Geisinger patients** shortly after his termination; the new counts allege he lied to the FBI about downloading or storing unauthorized data on personal devices. Separately, two civil class-action matters reached settlement in breach cases involving patient data exposure. **Capital Health** agreed to a **$4.5M** settlement tied to a **2023 ransomware incident** in which intruders had network access for roughly two weeks and encrypted files; **LockBit** claimed responsibility and alleged **~7 TB** of data exfiltration, while Capital Health reported the incident to HHS OCR as affecting **503,071 individuals**. **Gryphon Healthcare** agreed to a **$2.87M** settlement (including a **$2.8M** fund) over a **2024 cyberattack** affecting a billing-services partner relationship, with **393,358 patients’ PHI** potentially viewed or obtained; the company denied liability but settled to avoid continued litigation costs and uncertainty.
Jun 29, 2026
Several US organizations have reported significant data breaches affecting thousands of individuals. Pearlman Aesthetic Surgery in New York disclosed a hacking incident compromising the protected health information of nearly 12,000 patients, though specific details remain undisclosed. Methodist Homes of Alabama and Northwest Florida notified residents and employees of a second breach within seven months, involving unauthorized access to an employee email account containing sensitive personal and medical information. Gulshan Management Services, which operates over 150 gas stations and convenience stores, confirmed a breach that exposed the personal data of more than 377,000 people, including Social Security numbers and financial information, with delayed notification to affected individuals. Community First Medical Center in Chicago reached a $1 million preliminary settlement following a 2023 breach that exposed the data of approximately 216,000 patients, with allegations of inadequate cybersecurity measures and delayed response. These incidents have led to regulatory filings, class action lawsuits, and increased scrutiny over the timeliness and adequacy of breach notifications. The breaches highlight ongoing challenges in protecting sensitive data across healthcare and retail sectors, with attackers exploiting both network vulnerabilities and email accounts. Organizations are facing legal and reputational consequences, emphasizing the need for robust cybersecurity practices and prompt communication with affected individuals.
Jun 29, 2026
**Bell Ambulance** reported that a February 2025 network intrusion led to the compromise of protected health information for **237,830 individuals**, after unauthorized activity was detected on **Feb. 13, 2025**. The organization said the exposed data can include **names, dates of birth, Social Security numbers, driver’s license numbers, financial account information, medical information, and health insurance information**; it offered **12–24 months** of credit monitoring/identity protection and stated it was not aware of misuse at the time of notification. The incident response included third-party forensic support, and notifications were issued in phases as the data review progressed, with additional letters sent into March 2026. Separately, **Cornerstone Specialty Hospitals** agreed to pay **$2.35 million** to settle a class action lawsuit tied to a data breach that reportedly affected **nearly 500,000 individuals**. The available reporting focuses on the settlement amount and impacted population size, indicating ongoing legal and financial consequences for large-scale healthcare data exposure even when technical details of the underlying intrusion are not publicly described in the same source.
Jun 29, 2026