Securities Regulation Daily Wrap Up, FRAUD AND MANIPULATION—S.D.N.Y.: Complaint failed to show false statements concerning data breach, (Sep 10, 2025)

By R. Jason Howard, J.D.

The alleged statements in the complaint were not materially misleading as a matter of law and the plaintiffs failed to adequately allege scienter with respect to their fraud claim.

The Southern District of New York has granted a motion to dismiss a consolidated amended complaint in a putative class action brought against Block, Inc., and three individual officers and directors for alleged false or misleading statements or omissions made by Block regarding its data security both before and after an alleged December 10, 2021, data breach (In re Block, Inc., Securities Litigation, No. 1:22-cv-08636-MMG (S.D.N.Y. Sept. 9, 2025)).

Block. Block, Inc., formerly known as Square Inc., is a financial payment firm and financial services firm. Its segments include Square, which offers financial tools for sellers, and Cash App, which provides financial tools for individuals. On April 4, 2022, Block, through an SEC filing, announced that a former employee had improperly downloaded certain reports of its subsidiary, Cash App Investing, on December 10, 2021. Prior to April 4, 2022, the company had not disclosed this information to shareholders.

The consolidated amended complaint alleged that throughout the class period, between November 4, 2021, and April 4, 2022, the defendants made materially false and/or misleading statements, as well as failed to disclose material adverse facts about Block’s business, operations, and prospects. The plaintiffs brought claims under Section 10(b) and 20(a) of the Securities Exchange Act of 1934 and under Sections 12(a)(2) and 15 of the Securities Act of 1933.

Alleged misstatements. The plaintiffs alleged that Block’s 10-K “emphasized the risk of a data breach and the potential material impact on Block’s business but it failed to disclose that Block lacked the adequate security measures or protection procedures to prevent a serious data breach.” In addition, the plaintiffs alleged that the defendants made various statements following the data breach that did not reference it.

The court characterized the alleged pre-incident misstatements and omissions concerning Block’s efforts to take “reasonable measures” to protect customer information from “loss, theft, and misuse, and unauthorized access, disclosure, alteration, and destruction” as mere “puffery,” because “no reasonable investor could understand those generalized statements—which lack any meaningful detail about the quality of the measures or controls—as an assertion about the adequacy of Block’s internal controls.”

The court then addressed the post-incident statements, which it broke into two categories. The first concerned a press release describing Block’s merger with Afterpay and Block’s annual shareholder letter. The second concerned Block’s announcement that it had received an ISO 27001 certification that it said “validated the strength and effectiveness of its information security management system,” and Block’s Form 8-K which emphasized the risks of a potential data breach but did not disclose the incident.

Here, the court found that the statements in the first category were not materially misleading because the statements, which focused on the Afterpay merger and highlights from Block’s annual shareholder letter, were “topics too far removed from the topic of the incident or even Block’s data security generally, and the omission of information regarding the incident did not render them misleading.”

With respect to all the statements, the court found that the plaintiffs failed to adequately allege that the defendants knew about the incident when the statements were made. Because the court found that the plaintiffs did not allege a primary violation of the securities laws, the plaintiffs’ control person liability claims also failed.

Conclusion. The court concluded that the alleged statements in the complaint were not materially misleading as a matter of law and the plaintiffs failed to adequately allege scienter with respect to their fraud claim. The motion to dismiss was granted, the case was dismissed, and the clerk of court was directed to close the case.

The case is No. 1:22-cv-08636-MMG.

Judge: Garnett, M.

Attorneys: Gregory Bradley Linkh (Glancy Prongay & Murray LLP) for Donna Esposito. Alexander Talarides (Orrick, Herrington & Sutcliffe LLP) for Block, Inc.

Companies: Block, Inc.

LitigationEnforcement: CyberPrivacyFeed DataBreach DataSecurity DirectorsOfficers FraudManipulation GCNNews PublicCompanyReportingDisclosure DelawareNews NewYorkNews