On October 19, 2026, a federal district court judge allowed ordinary negligence and implied-contract claims to proceed in a proposed class action against Kaplan North America. See Linsell v. Kaplan N. Am., LLC, No. 0:26-cv-60785-WPD, slip op. (S.D. Fla. Oct. 19, 2026). The plaintiffs all sought Kaplan’s test-preparation, professional-licensing, or educational services. The case stems from an unauthorized actor’s access to Kaplan’s servers between October 30 and November 18, 2025, and the alleged theft of files containing names, Social Security numbers, and/or driver’s license numbers. Several plaintiffs allege actual misuse, including fraudulent charges, unauthorized account activity, attempted accounts or loans, and dark-web notifications. One news report put the number of affected consumers at about 1.4 million.
Kaplan’s motion to dismiss failed on the ordinary-negligence and implied-contract claims. The court found the alleged timing and misuse sufficient to plausibly connect some plaintiffs’ injuries to the breach at this stage. It also reasoned that customers required to provide sensitive information to receive services could plausibly expect Kaplan to safeguard it, even without an express promise to provide separate data-security services. The ruling does not establish that Kaplan’s security was inadequate or that it is liable.
Other claims were dismissed. The court dismissed unjust enrichment because plaintiffs did not plausibly allege Kaplan received an additional benefit from the data breach beyond payment for services worth what they cost. It also dismissed the California Consumer Privacy Act (CCPA) claim for lack of standing, holding that the California plaintiff alleged diminished information value and mitigation efforts, but no actual misuse or specific evidence of misuse. The court did not decide the CCPA claim’s merits.
For organizations, the ruling illustrates two distinct risks after a data breach. A negligence claim may focus on whether safeguards were reasonable in light of the information’s sensitivity, whereas an implied-contract claim may focus on whether the circumstances of collecting that information created a reasonable expectation that it would be protected.