Bojangles, a Charlotte-born chicken, biscuits, and tea restaurant chain, long ago outkicked its Southeastern roots into nearly 800 locations across 17 states. That footprint, featuring more than 9,000 employees, makes it a game-day favorite for tailgaters and watch parties. But at that business scale, “It’s Bo Time!” can be a clarion call for more than hungry football fans. In Dougherty v. Bojangles Rests., Inc., 2026 NCBC 60, the Business Court tackled issues arising from the chain being targeted by hackers who preferred its data holdings over its menu items.

A group of former Bojangles employees sued the company over an alleged data breach in spring 2024 in which Hunters International, an “infamous Russian Ransomware-as-a-Service” enterprise, posted on the dark web that it had secured a large tranche of data from Bojangles that allegedly included the personally identifiable information of the plaintiffs and other Bojangles employees. The plaintiffs claimed that Hunters operated a complex data storage operation in which it made purloined personal data “available for other cybercriminals to download and use at their discretion.” Id. ¶¶ 12-14.

Plaintiffs alleged on behalf of a prospective class that Bojangles failed to prevent the breach, including not implementing appropriate cybersecurity measures and not timely notifying them of the breach so that they could take measures to protect their information and mitigate their damages. They alleged Bojangles “kept [them] in the dark” by not disclosing the breach to them for eight months.  Id. ¶¶ 15, 17.

Judge Earp denied the motion to dismiss plaintiffs’ negligence claim. The Court noted and endorsed the view of other courts that State law includes a duty of care to safeguard and protect another’s PII/PHI in one’s possession. Id. ¶ 55 (citing Curry v. Schletter Inc., 2018 WL 1472485, at *4 (W.D.N.C. Mar. 26, 2018)). The Court also approved of plaintiffs’ pleading recitation of causation and the purported exacerbation of that harm by delaying notice of the breach.

Plaintiffs alleged actual damages that included the lost value of their PII/PHI, “lost time and money to mitigate and remediate the effects” of the breach, and a lost “benefit of the bargain” – that having submitted sensitive personal information the company would take reasonable steps to protect it. Further, the Court noted their allegations of “an increased risk of future harm, embarrassment, humiliation, frustration, and emotional distress.” Id. ¶¶ 9, 19.

The Court agreed that plaintiffs’ allegations must be dismissed if they fail to allege “actual injury or damages.” As it noted, “Neither negligence without damage nor damage without negligence will constitute any cause of action.” (citing Hansley v. Jamesville & W.R. Co., 115 N.C. 602, 613) (1894)). But it rejected the idea that plaintiffs hadn’t done enough here, noting its prior holding that allegations of “embarrassment, humiliation, emotional harm, and distress” were sufficient to meet the “low bar” of notice pleading for a negligence claim. Id. ¶ 58 (quoting Rodriguez v. FastMed Urgent Care, Inc., 2025 WL 916910, at *5 (N.C. Super. Ct. Mar. 25, 2025)).

The Court drew a distinction between its judgment about the sufficiency of alleged damages in this State court action with the Western District of North Carolina’s prior dismissal on standing grounds of a similar case brought by these plaintiffs against Bojangles. In dismissing the federal action, the district court held plaintiffs’ allegations “fall short” of establishing standing by not showing “that they suffered a concrete injury that is fairly traceable” to the Bojangles breach. Dougherty v. Bojangles Restaurants, Inc., 2025 WL 2810673, *2-3 (W.D.N.C. Sept. 30, 2025). The Business Court considered the Western District decision, and defendant’s request that it be followed, but found that court’s federal standing analysis not controlling to determine the sufficiency of a negligence claim’s damages prong (Id. ¶ 57):

“While this Court takes note of the federal court’s reasoning, it does not hold Plaintiffs to the standard for standing applied in the federal court when pleading damages in this Court.”

Worth Noting

  • The Court rejected a negligence per se claim arising under either the Federal Tort Claims Act or HIPAA because neither of those regulatory schemes is a public safety statute, the violation of which is required to plead a per se claim. 2026 NCBC 60, ¶ 41.

Brad Risinger is a partner in the Raleigh office of Fox Rothschild LLP.