Cybersecurity Policy Report, N.D. Tex.: Jani-King franchisees and employees have standing in data breach suit, (Aug 10, 2026)

By Donielle Tigay Stutland, J.D.

The court denied a motion to dismiss claims for negligence and breach of implied contract.

The federal district court in Dallas, Texas denied a motion to dismiss a class action lawsuit brought by employees and franchisees of Jani-King International Inc. (“Jani-King”) in a suit alleging breach of contract and negligence related to a data breach. The court granted the franchisor’s motion to dismiss as to the unjust enrichment claim and the court deferred ruling on the negligence per se claim until it has decided class certification (Cossette v. Jani-King International, Inc., No. 3:25-cv-01057-N (N.D. Tex. Aug. 4, 2026)).

Background. Jani-King is a commercial cleaning company franchisor. Between November 26, 2024, and December 21, 2024, Jani-King was the target of a cybersecurity attack in which an unauthorized third party accessed the personally identifiable information (PII) of “employees, franchisees, and other individuals” such as names, addresses, and social security numbers.” The hacker retained access to Jani-King’s system for at least a month. “Employees, franchisees, and other individuals” of Jani-King were notified the data breach on or around April 16, 2025.

A group of Jani-King employees, franchisees, and others whose PII was accessed during the data breach brought a class action against the franchisor. The suit brings claims for (1) negligence (2) negligence per se, (3) breach of implied contract, (4) unjust enrichment, and (5) declaratory and injunctive relief on behalf of a nation-wide class. The franchisor filed a motion to dismiss the claims.

Standing. The court began its analysis by reviewing the franchisor’s argument that the named claimants lack standing to bring their because they failed to plead facts sufficient to allege that they suffered a legally cognizable injury in fact. The employees and franchisees argue that they have alleged concrete and particularized harms through (1) a post-breach increase in spam communications; (2) diminution in PII value; (3) the likely theft of their PII; (4) costs associated with mitigating exposure of PII; (5) severe emotional distress, (6) violations of their privacy rights; (8) loss of the benefit of the bargain; and (9) imminent risk of future harm.

The court applied the Second Circuit’s three-factor test established in McMorris v. Carlos Lopez & Associates to determine whether an injury in the data breach context is sufficiently imminent for purposes of standing. The court found that the class members who received notice letters sufficient pleaded an imminent risk of future harm. The court highlighted that the breach was targeted, the compromised data included highly sensitive identifiers, including names and Social Security numbers, which creates a perpetual risk of identity theft or fraud, and the data was alleged to have been exposed to unauthorized third parties with a high risk of dark-web dissemination. The Second Circuit has previously determined that exposure of PII “as a result of a targeted attempt by a third party to access the data set” is sufficient to show a concrete and imminent injury for the purposes of standing. The court concluded that here emotional distress and mitigation costs, “when coupled with the risk of harm... is a concrete injury sufficient to confer standing.” The court also found that causation and redressability were adequately pleaded. The court agreed with the class members that monetary relief, including the cost of adequate credit monitoring services, would redress their injuries.

However, the court did distinguish that the complaint failed to allege standing for the claim for declaratory and injunctive relief because that claim is based on a speculative future harm.

Negligence. Turning to the underlying claims, the court next determined that the negligence claim can proceed, as the employees and franchisees plausibly allege an existing duty of care. The court outlined that, here, the employees and franchisees adequately allege that Jani-King “knew or should have known” about the risk of a data breach because Jani-King received internal and external warnings of “systemic deficiencies in its IT infrastructure, including outdated or unpatched operating systems, poor logging controls, and failure to patch known vulnerabilities” prior to the breach. Under Texas common law principles, Jani-King has a duty to safeguard PII it chooses to retain.

The court also determined that the employees and franchisees plausibly allege damages, and the economic loss rule does not bar a negligence claim. The claimants allege that because of the data breach, their PII has been or will be sold or exposed on the dark web, and they have suffered an increased risk of future harm. As such, the court determined that the economic loss rule does not bar the negligence claim at this stage.

Breach of Implied Contract. The court also denied the Motion to Dismiss the breach of implied contract claim. The court found the pleadings were sufficient to allege the existence of an implied contract to safeguard the PII. The employees and franchisees adequately alleged an implied contract formed when Jani-King accepted their PII as a condition of providing services.

Other claims. The court granted the motion to dismiss the claims for unjust enrichment. The court found the claimants did not allege that they paid specifically for data-security services or that any benefit was obtained by fraud, duress, or undue advantage. The court also deferred the claim for negligence per se until the class-certification stage.

The Case is No. 3:25-cv-01057-N.

Judge: Godbey, D.

Attorneys: William B. Federman (Federman & Sherwood) for John Cossette. Peter Lawrence Loh (Foley & Lardner LLP) for Jani-King International Inc.

Companies: Jani-King International Inc.

Cases: FranchisingDistribution Privacy TexasNews CyberPrivacyFeed DataPrivacy DataSecurity