In re: VeriSource Services, Inc. Data Breach Litigation

March 16, 2026 Nathan Ochsner, Clerk UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF TEXAS HOUSTON DIVISION § CIVIL ACTION NUMBER § 4:24-cv-03492 § § IN RE: VERISOURCE § JUDGE CHARLES ESKRIDGE SERVICES, INC. DATA § BREACH LITIGATION § § § ORDER ADOPTING MEMORANDUM AND RECOMMENDATION This case concerns an alleged data breach of confi- dential information. Defendant VeriSource Services, Inc, provides employee benefit plan services. Dkt 70 at ¶3 (second amended complaint). Defendant Southwest Water Company, LLC, is a customer of VSI, and Defendant Planned Administrators, Inc, is a benefits administrator that utilizes VSI services. Dkt 70 at ¶¶4, 52, 64–65.

Plaintiffs, who are current or former employees of companies who use VSI services, or their dependents, allege that Defendants failed to properly protect their confidential information, resulting in its theft by cybercriminals in February of 2024. Id at ¶¶1–2, 4–5.

VSI moved to dismiss under Rule 12(b)(6) for failure to plausibly allege that any purported damages are “causally linked to the cyber incident or VSI.” Dkt 76. Southwest Water and Planned Administrators together moved to dismiss under Rule 12(b)(1) for lack of standing and Rule 12(b)(6) for failure to state a claim. Dkt 77.

The matter was referred for disposition to Magistrate Judge Christina A. Bryan. Dkt 14. She issued a Memorandum and Recommendation recommending that VSI’s motion be granted in part and denied in part. Dkt 93.

She further recommends that the motion by SWC and PAI under Rule 12(b)(1) be denied, and that the motion under Rule 12(b)(6) be granted in part and denied in part.

Defendants filed objections. Dkts 94 & 95. VSI argues that (i) the negligence claims of sixteen Plaintiffs should be dismissed for failure to sufficiently allege damages, and (ii) due to the nature of their claims, Plaintiffs cannot pursue emotional distress damages. Dkt 94. SWC and PAI argue that (i) Plaintiffs lack standing, and (ii) Plaintiffs failed to plausibly allege facts to support a negligent hiring claim. Dkt 95.

The district court reviews de novo those conclusions of a magistrate judge to which a party has specifically objected. See FRCP 72(b)(3) & 28 USC § 636(b)(1)(C); see also United States v Wilson, 864 F2d 1219, 1221 (5th Cir 1989, per curiam). The district court may accept any other portions to which there’s no objection if satisfied that no clear error appears on the face of the record. See Guillory v PPG Industries Inc, 434 F3d 303, 308 (5th Cir 2005), citing Douglass v United Services Automobile Association, 79 F3d 1415, 1430 (5th Cir 1996, en banc); see also FRCP 72(b) advisory committee note (1983).

Upon de novo review and determination, Defendants’ objections lack merit.

As to VSI’s objections, they fail because Plaintiffs have sufficiently alleged damages to support their negligence claims. Dkt 94. Upon close review, the Memorandum and Recommendation is well-reasoned and supported in that regard. See Dkt 93 at 39. All Plaintiffs allege a risk of harm, loss of benefit of the bargain, mitigation costs, and emotional distress, which is sufficient to survive dismissal at this juncture. Dkt 70 at ¶¶614–15. Arguments regarding emotional distress damages may be renewed at summary judgment, after discovery and upon an undisputed factual record, if appropriate and supportable.

As to SWC and PAI’s objections, they are similarly unavailing. Dkt 95.

With respect to standing, SWC and PAI argue that the Memorandum and Recommendation improperly “conflates the Plaintiffs who plead injuries but no connection to SWC or PAI with those Plaintiffs who plead some connection to SWC or PAI but no injuries and includes the remaining Plaintiffs who plead neither (no injury and no connection to SWC or PAI), to find blanket standing.” Dkt 95 at 6. Not so. The Memorandum and Recommendation thoroughly analyzed the nuanced case law in this context and appropriately concluded that all Plaintiffs alleged cognizable injuries in fact. See Dkt 93 at 10–17. As to traceability, Plaintiffs plausibly alleged that they were “required to entrust their sensitive, non-public Private Information to one or more Defendants and by extension to VSI,” who ultimately suffered the subject breach. Dkt 70 at ¶6. In addition, Plaintiffs pleaded that, but for SWC and PAI’s failures, the VSI data breach would not have occurred and was a foreseeable consequence of their failure to properly vet and monitor VSI. Id at ¶¶9–13; see Dkt 93 at 19–20. Plaintiffs thus have plausibly alleged that their injuries are traceable to SWC and PAI, despite the intervening actions of VSI and cybercriminals. See Dkt 93 at 17–20.

Regarding the negligent hiring claim, SWC and PAI argue that Plaintiffs failed to plead any facts supporting their purported failure to “vet or investigate VSI’s data security protocols.” Dkt 95 at 15. But Plaintiffs did allege that both Defendants shared confidential information without “vetting VSI and inquiring about its data security qualifications.” Dkt 70 at ¶679. And they further allege that if SWC and PAI had done so, they “would have discovered VSI did not have data security measures in place” compliant with recognized industry standards. Id at ¶680. The Memorandum and Recommendation thus appropriately concluded that the plausible allegations by Plaintiff in that regard survive dismissal. Dkt 93 at 25–26.

The objections by Defendants to the Memorandum and Recommendation of the Magistrate Judge are OVERRULED.

Dkts 94 & 95.

No clear error otherwise appears upon review and consideration of the Memorandum and Recommendation, the record, and the applicable law.

The Memorandum and Recommendation of the Magistrate Judge is ADOPTED as the Memorandum and Order of this Court. Dkt 93.

The motion by Defendant VeriSource Services, Inc, to dismiss is GRANTED IN PART and DENIED IN PART. Dkt 76.

The motion is GRANTED as to the claims for negligence per se, breach of implied contract, breach of third-party beneficiary contract, unjust enrichment, declaratory judgment, and injunctive relief. Those claims are DISMISSED WITH PREJUDICE.

The motion is DENIED as to the negligence claim against VSI. That claim will proceed.

The motion to dismiss by Defendants Southwest Water Company, LLC, and Planned Administrators, Inc, is GRANTED IN PART and DENIED IN PART. Dkt 77.

The motion is GRANTED as to the claims for negligence and negligence per se, unjust enrichment, breach of implied contract, declaratory judgment, and injunctive relief. Those claims are DISMISSED WITH PREJUDICE.

The motion is DENIED to the extent that it proceeds under Rule 12(b)(1) for lack of standing. It is also DENIED as to the negligent hiring claim against SWC and PAI. That claim will proceed.

SO ORDERED.

Signed on March 16, 2026, at Houston, Texas.

Z.

Honorable Charles Eskridge United States District Judge