Sefas Innovation, Inc. Data Breach Class Action Allowed to Proceed on Key Claims
September 23, 2026 – The United States District Court for the District of Massachusetts has denied, in significant part, Sefas Innovation, Inc.’s motion to dismiss a putative class action arising from a data breach that allegedly compromised the personally identifiable information of millions of Frost Bank and Citizens Bank customers. The case is Charles Fuller, Octavia Adams, John Shelton, and Elizabeth Ocejo, individually and on behalf of all others similarly situated v. Sefas Innovation, Inc., Case No. 26-12030-RGS.
According to the allegations, hackers associated with the cybercriminal group “Everest” breached Sefas’s servers beginning in December 2025 and obtained files containing customers’ names, addresses, Social Security numbers, and financial account information. The Court noted that Sefas allegedly did not discover the breach until April 16, 2026, and that the stolen files were later uploaded to the dark web and viewed thousands of times.
In its September 3, 2026 Memorandum and Order, the Court rejected Sefas’s challenge to the plaintiffs’ standing. The Court found that the alleged attack was targeted, that one plaintiff plausibly alleged actual misuse of his information, and that the compromised information—including Social Security numbers and financial account information—was sufficiently sensitive to create a high risk of identity theft or fraud.
The Court also allowed the plaintiffs’ negligence and breach of third-party beneficiary contract claims to proceed. In addressing negligence, the Court declined at this stage to find that Sefas owed no duty to safeguard the information it stored and found the allegations regarding inadequate data security safeguards sufficient to survive dismissal. The Court also permitted the third-party beneficiary claim to proceed based on the alleged contracts involving the storage and protection of bank customers’ personal information.
The Court further denied Sefas’s request to strike the class allegations, finding that it was not apparent from the pleadings that the case could not proceed on a classwide basis. The negligence per se and unjust enrichment claims were dismissed, while the remaining claims will proceed to discovery.
Federman & Sherwood represents individuals affected by data breaches and privacy incidents nationwide and continues to pursue claims involving the alleged failure to adequately protect sensitive personal information.
For more information regarding this litigation or your legal rights following a data breach, contact Federman & Sherwood at 1-800-237-1277 or info@federmanlaw.com.