Kaplan Faces Class Action Lawsuit Over 2025 Data Breach
A Florida federal court allows negligence and contract claims to proceed following the organization's data security failure.
Updated on Oct. 22, 2026 in Cybersecurity
Live Poll
Should companies be held legally liable for data breaches involving consumer information?
A Florida federal judge has allowed a class action lawsuit against Kaplan to move forward following a 2025 data breach. The court permitted claims of negligence and breach of contract to proceed while dismissing other allegations.
Why it matters
This ruling establishes a legal pathway for data breach litigation to continue, testing how educational institutions are held accountable for cybersecurity lapses. It underscores the ongoing scrutiny of institutional data protection standards.
The ruling evaluated a proposed class action involving a 2025 data breach, resulting in a split decision. The court sustained negligence and contract claims while rejecting arguments regarding unjust enrichment and California data privacy law.
The players
Kaplan
An educational services company providing test preparation and professional training programs.
The details
The court issued the ruling on October 21, 2026, in response to a motion to dismiss the proposed class action lawsuit. By permitting the negligence and contract claims, the judge determined these allegations satisfy the threshold for legal discovery and further argument. Conversely, the court struck down claims related to unjust enrichment and the California Consumer Privacy Act, effectively narrowing the scope of the case to standard tort and contract-based liabilities.
Timeline
2025: Data breach occurred at Kaplan.
October 21, 2026: Judge ruled on the class action motion to dismiss.
The Tech Race
This ruling follows the pattern of similar large-scale data breach litigations in defining the boundaries of institutional liability. It marks a significant milestone in holding service providers accountable for their digital security infrastructure.
Individuals affected by the 2025 breach may see their claims proceed through discovery in federal court. This process determines whether Kaplan is held liable for failing to secure personal data, potentially leading to future legal settlements.
The takeaway
This case highlights the growing intersection of educational data privacy and federal liability standards. Watch for upcoming discovery milestones in this lawsuit to see if it sets a precedent for how data negligence is adjudicated in the education sector.
Further reading
For broader trends in digital security litigation, explore Cybersecurity.
Source note: This article includes information reported by Law360.
Live Poll
Should companies be held legally liable for data breaches involving consumer information?
