District of Massachusetts Allows Higher-Ed Student Data Breach Claims to Survive

According to The National Law Review, on 5 September 2025 Judge Angel Kelley of the U.S. District Court for the District of Massachusetts issued a mixed ruling on a motion to dismiss in Shea v. American International College, shaping the standing and contract claims in data breach litigation.

The Shea case stems from a late-2023 data breach at American International College, during which hackers allegedly exfiltrated over 5,000 gigabytes of unencrypted data containing the personal information of more than 11,000 current and former students over nineteen days, with breach notices mailed in May 2024. Plaintiff Kelly Shea, a former student, brought a putative class action alleging negligence, breach of implied contract, unjust enrichment, invasion of privacy under G.L. c.

214, § 1B and Chapter 93A, and declaratory judgment. The District of Massachusetts matter is discussed in the context of Webb v. Injured Workers Pharmacy and Shea v. American International College as recent examples informing Article III standing, the economic loss doctrine, and the viability of implied contract and invasion of privacy claims. The post notes that the concrete harm shown included actual misuse, mitigation, and distress, which helped secure standing.