On October 8, 2026, a federal judge in Pennsylvania allowed most claims in a student data-breach lawsuit against Fireworks Software, Inc. to proceed, while dismissing a New Jersey consumer-fraud claim. Adamek v. Fireworks Software, Inc., No. 2:24-cv-05185-NIQA, slip op. at 4–15 (E.D. Pa. Oct. 8, 2026), is a class action litigation following a 2024 breach involving Rowan College students’ personal information. Plaintiffs alleged an unknown actor accessed Fireworks’ systems, exposing names, birth dates, Social Security numbers, and Alien Registration numbers. They claimed Fireworks failed to reasonably safeguard that data, leaving students facing identity-theft risks and mitigation costs.
The court deferred a broader choice-of-law decision until the factual record develops, but applied New Jersey law to the New Jersey Consumer Fraud Act claim. It dismissed that claim because generalized allegations of inadequate security did not identify specific deceptive conduct or establish a duty to disclose Fireworks’ security measures. However, other claims survived.
As to the claim of negligence, the court found it plausible that Fireworks owed students a duty of reasonable care because, as a software provider serving higher-education institutions, it held their sensitive information. Plaintiffs alleged that Fireworks breached that duty by failing to assess security risks, maintain adequate safeguards, test and monitor its systems, detect the breach, and provide timely notice. The court also concluded that the alleged appearance of a student’s information on the dark web, together with expenses incurred to mitigate identity-theft risks, was enough at this stage to plead causation and actual damages.
The contract claim also survived because the complaint plausibly alleged that Rowan College’s agreement with Fireworks was intended to protect students’ information, making them potential third-party beneficiaries. The court also allowed the unjust-enrichment claim to proceed because, even though the students provided their data through the college, Fireworks allegedly benefited from managing and retaining it.
Though the ruling is not a finding of liability, it shows how a data breach case can move forward when plaintiffs link a vendor’s custody of sensitive information to specific security failures, resulting harm, and contractual responsibilities. For companies handling student data, those connections, as well as the agreements and safeguards behind them, can shape a dispute long after the breach itself is contained.