Loading story…
A federal judge in New Jersey dismissed a proposed class action against background check company TABB Inc. stemming from a 2024 data leak, finding that the plaintiff failed to allege a sufficiently concrete injury to establish Article III standing in federal court. The suit had been brought by Arthur Ojo on behalf of himself and others allegedly affected by the incident.
The ruling marks another setback for breach-related litigation where plaintiffs cannot show tangible harm beyond exposure of data. Reporting on the case tied the lawsuit to a leak reportedly discovered in 2024 by researcher JayeLTee, who said efforts to responsibly disclose the issue to TABB were difficult and frustrating before the legal challenge was later filed.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
Researcher JayeLTee discovered a data leak involving New Jersey-based background check company TABB Inc. The sources also state that attempts at responsible disclosure to TABB were difficult and frustrating.
U.S. District Judge Stanley R. Chesler granted TABB Inc.'s motion to dismiss the proposed class action, finding the plaintiff had not alleged a concrete injury sufficient for Article III standing in federal court. The ruling was issued on a Thursday, but the sources do not provide a full explicit date for the event.
Arthur Ojo filed a proposed class action lawsuit against TABB Inc. on behalf of himself and others allegedly affected by the company's data security incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. courts are increasingly demanding that plaintiffs in data breach lawsuits demonstrate concrete, tangible harm resulting from the exposure of their personal information. Legal experts note that simply having personal data compromised is no longer sufficient grounds for a lawsuit, as judges require clear evidence of out-of-pocket expenses or actual losses due to identity theft or fraud. Emotional distress or the potential for future harm is being viewed as inadequate for establishing injury-in-fact in court. This heightened judicial scrutiny has led to more data breach cases being dismissed, especially as the proliferation of stolen data on the dark web makes it harder for victims to link specific damages to a particular breach. In this legal climate, Utah-based FinWise Bank and American First Finance are facing a consolidated class-action lawsuit following an insider data breach in May 2024 that affected 689,000 individuals. The lawsuit alleges negligence, breach of contract, and unjust enrichment, claiming that FinWise and AFF failed to adequately protect customer information. Plaintiffs are seeking lifetime credit monitoring and over $5 million in relief, despite FinWise already offering one year of complimentary credit and identity protection services. The breach notification process was delayed, with FinWise only beginning notifications in late July after discovering the incident weeks earlier. The legal action against FinWise and AFF reflects a broader trend of victims seeking accountability and compensation in the wake of large-scale data breaches. However, the evolving judicial standards mean that plaintiffs must now provide detailed evidence of direct harm, which can be challenging given the widespread trading of stolen data. The FinWise case is being closely watched as it tests the limits of what constitutes actionable harm in data breach litigation. Legal analysts suggest that the outcome could set important precedents for future class-action suits involving data privacy and cybersecurity incidents. The case also highlights the importance of timely breach notification and robust data protection measures for financial institutions. As courts continue to raise the bar for data breach claims, organizations may face fewer successful lawsuits but greater pressure to demonstrate proactive security and transparent incident response. The ongoing litigation underscores the complex interplay between legal standards, consumer protection, and cybersecurity practices in the financial sector. Both the legal and cybersecurity communities are monitoring the case for its potential impact on future breach-related litigation and regulatory expectations. The situation illustrates the growing challenges for both victims and organizations in navigating the aftermath of significant data breaches under evolving legal frameworks.
Jun 29, 2026
Bojangles and law firm Blank Rome are facing class-action litigation after separate breaches exposed sensitive personal data. In North Carolina, a Business Court judge ruled that a lawsuit over Bojangles’ 2024 employee breach can proceed in state court after a similar federal case was dismissed. The suit, filed by nine former employees on behalf of other affected workers, alleges that hackers tied to **Hunters International** stole more than **387,000 files** totaling over **290 GB** and later posted data on the dark web, including Social Security numbers and other employee information. Blank Rome was hit with two proposed class actions after a May breach allegedly affected more than **57,000** current, former, and prospective clients. The firm said the incident began with a **social-engineering** attack in which a cybercriminal impersonated the IT department and persuaded an attorney to upload files to an external hosting site. Plaintiffs allege the firm lacked adequate cybersecurity controls and employee training, delayed notification for more than a month after the May 21 incident, and exposed personal, financial, and health-related information.
Jul 7, 2026
Yahoo’s massive data breaches triggered consolidated class-action litigation in U.S. federal court after disclosures that attackers had compromised hundreds of millions of accounts and, later, all 3 billion Yahoo accounts. Reporting on the company’s security posture said Yahoo had deprioritized defensive investments and delayed stronger measures such as broader intrusion detection and a mass password reset, while the fallout drew scrutiny from regulators, lawmakers, foreign officials, and users affected in the United States and abroad. The legal fight expanded as a judge ruled that breach victims could pursue claims against Yahoo in the United States, then rejected a proposed settlement covering roughly 200 million people because it did not clearly show how much compensation class members would receive, how large the settlement fund effectively was, or whether attorney fees were reasonable. Yahoo later returned with a revised **$118 million** settlement proposal tied to the broader **3 billion-account** breach, adding commitments to spend more than **$300 million** on information security over four years and maintain a security staff of **200** employees, while ensuring any unawarded legal fees would stay in the fund for victims rather than revert to the company.
Jun 29, 2026