Cybersecurity lawsuits in New Jersey have grown into a distinct body of litigation, with class actions against hospitals and universities, a municipal fraud case out of Bergen County, a landmark insurance-coverage fight over a nation-state cyberattack, and active Attorney General enforcement all running at the same time. The state combines a breach notification statute tied to the Consumer Fraud Act, a newer comprehensive privacy law, and a federal appellate rule that makes it easier for breach victims to get through the courthouse door.
Can You Sue After a Breach? The Standing Question
For anyone whose data was exposed, the first legal hurdle in federal court is standing: proving you were actually harmed. The Third Circuit, which covers New Jersey, has made that showing easier.
The controlling case is Clemens v. ExecuPharm, Inc., 48 F.4th 146 (3d Cir. 2022). A ransomware gang called CLOP stole Social Security numbers, bank details, tax forms, and passport numbers from a pharmaceutical company and, when the ransom went unpaid, published the files on the Dark Web. The district court dismissed the former employee’s suit as speculative. The Third Circuit reversed, holding that plaintiffs do not need to wait for actual identity theft to sue. A “substantial risk of future injury” is enough when the breach was intentional, the stolen data was published on a platform used for illegal activity, and the information carries a high risk of misuse. The court also treated money and time spent on credit monitoring and fraud alerts as a concrete, present injury.1United States Court of Appeals for the Third Circuit. Clemens v. ExecuPharm Inc., No. 21-1506
That ruling effectively opened the courthouse doors for breach class actions across New Jersey, Pennsylvania, and Delaware, and it is the standard plaintiffs in the Monmouth University suits and similar cases are relying on today.
What You Can Sue Under
New Jersey’s Identity Theft Prevention Act (N.J.S.A. 56:8-161 through 166) requires any business or public entity operating in the state to notify affected individuals after a breach of computerized records containing personal information. Personal information covers a name linked to a Social Security number, driver’s license number, financial account number with access codes, or a username and password combination. Notice must go out “in the most expedient time possible and without unreasonable delay,” though it can be deferred if law enforcement says disclosure would impede an investigation. The breach must be reported to the Division of State Police before customers are notified.2NJ Division of Consumer Affairs. Identity Theft Prevention Act
Willful, knowing, or reckless violations of the notification rules are treated as unlawful practices under the New Jersey Consumer Fraud Act, with penalties up to $10,000 for a first offense and $20,000 for subsequent offenses.3NJ Legislature. P.L. 2019, Chapter 95 For private plaintiffs the key feature is the Consumer Fraud Act’s mandatory treble damages and attorneys’ fees, which turn an ordinary breach notification failure into a serious financial exposure for the defendant.4Pro Bono Partnership. NJ Amends State Consumer Fraud Act to Expand Businesses’ Responsibilities in an Electronic Data Breach
What You Can’t Sue Under Directly
The New Jersey Data Protection Act (N.J. Stat. ยง 56:8-166.4 et seq.) took effect on January 15, 2025, and is the state’s comprehensive consumer privacy law. It applies to entities processing the personal data of at least 100,000 New Jersey consumers, or at least 25,000 consumers if the entity derives revenue from selling that data. It gives consumers rights to access, correct, and delete personal information, to opt out of data sales and targeted advertising, and to require consent before a business processes sensitive data such as health, financial, or biometric information.5NJ Division of Consumer Affairs. NJ Data Privacy Law FAQ
If you are hoping to sue under this statute, you can’t. The Data Protection Act does not create a private right of action. Enforcement rests exclusively with the Attorney General, with penalties running from $2,500 for a first violation to $20,000 for a fourth and subsequent violations, plus investigative costs and attorneys’ fees. The initial 30-day cure period expired in July 2025, so the AG can now pursue violators without first offering a chance to fix the problem.5NJ Division of Consumer Affairs. NJ Data Privacy Law FAQ
What Recent New Jersey Breach Cases Look Like
Monmouth University
In March 2026, Monmouth University in West Long Branch disclosed a ransomware attack by a group calling itself PEAR (Pure Extraction and Ransom), which claimed to have stolen 16 terabytes of data. The exposed information reportedly included names, addresses, phone numbers, insurance and financial records, student grades, email correspondence, HR files, protected health records, and data belonging to minors.6Outlook (Monmouth University). Lawsuits Mount After Data Is Breached in Cybersecurity Incident
Three class actions followed in late March 2026 in the U.S. District Court for the District of New Jersey, filed by former students. The complaints allege the university was negligent in its cybersecurity protocols, failed to train employees, and failed to encrypt data. One of the suits, brought by plaintiff Erin Masterson, seeks damages over $5 million on behalf of a class of 100 or more members. The university said it cannot comment on active litigation.6Outlook (Monmouth University). Lawsuits Mount After Data Is Breached in Cybersecurity Incident
Hackensack Meridian Health
A December 2019 ransomware attack hit all 17 hospitals and clinics in the Hackensack Meridian Health system, forcing downtime procedures and rescheduling of nonemergency care. The health system paid an undisclosed ransom, covered by cyber insurance, to obtain decryption codes and restore its network.7Healthcare IT News. Hackensack Meridian Health Pays After Ransomware Attack Two patients filed a proposed class action in February 2020, Aranowitz et al. v. Hackensack Meridian Health, Inc., alleging the system stored patient data in a “reckless manner” and failed to detect the intrusion sooner. Hackensack Meridian responded that its forensic investigators found no evidence patient information had been accessed or misused.8Becker’s Hospital Review. Hackensack Meridian Health Faces Lawsuit Following Ransomware Attack
Cresskill Municipal Email Hack
Between February and May 2024, hackers compromised the municipal email account of Cresskill Tax Collector Ada Vassallo and sent spoofed messages to a local commercial property owner, 45 Legion Drive LLC, containing fake wiring instructions for property tax payments. The company wired more than $550,000 to fraudulent accounts before the scheme was discovered.9The Ridgewood Blog. Major Cyber Fraud Lawsuit Hits Cresskill After $550K in Property Tax Payments Go Missing
The LLC sued the Borough and Vassallo in Bergen County Superior Court, alleging negligence, failure to safeguard taxpayer information, and failure to notify affected parties promptly. According to the complaint, suspicious activity was flagged on the account as early as February 2024, but the borough did not secure it or inform taxpayers until July. The company also claims nearly $200,000 in forensic and remediation costs on top of the stolen funds.9The Ridgewood Blog. Major Cyber Fraud Lawsuit Hits Cresskill After $550K in Property Tax Payments Go Missing
The case is still pending. The New Jersey Tort Claims Act grants public entities immunity for damages resulting from “computer failure in certain circumstances,” along with separate immunities for discretionary activities and plan-or-design decisions.10Justia. New Jersey Revised Statutes Title 59 – Claims Against Public Entities Whether those shields protect a municipality that allegedly knew about a compromise and failed to act is an open question in the cybersecurity context, and the Cresskill ruling could set a meaningful precedent on municipal liability.
Merck v. ACE American: Who Pays for a Nation-State Attack
The biggest New Jersey cybersecurity ruling in dollar terms is Merck & Co. v. ACE American Insurance Co., which asked whether an insurer can refuse to cover a cyberattack by invoking a “hostile or warlike action” exclusion. In June 2017, the NotPetya malware, widely attributed to the Russian military, spread worldwide and caused catastrophic damage to Merck’s systems. Merck filed a $1.4 billion claim under its “all risks” property policies. The insurers denied coverage, calling the attack a hostile act by a nation-state.
A New Jersey trial judge ruled for Merck in 2022, finding war exclusions apply only to “armed conflicts and traditional forms of warfare.” The Appellate Division affirmed in May 2023, holding that the exclusion requires “the involvement of military action” and noting that insurers who wanted to carve out cyberattacks had the ability to update their policy language but failed to do so.11New Jersey Superior Court, Appellate Division. Merck & Co. v. ACE American Insurance Co., Docket Nos. A-1879-21, A-1882-21 Under New Jersey law, the court said, exclusionary clauses are construed narrowly, and if an insurer wants to exclude modern cyberwarfare it must use “specific, plain, clear, and prominent” language.
The case settled in January 2024 before the New Jersey Supreme Court could rule, so there is no binding high-court precedent. The appellate opinion still pushed the insurance industry toward more specific cyber-exclusion wording. Lloyd’s of London introduced four new cyberwar and cyber-operation exclusion clauses in 2022 to address state-backed attacks head-on.12Ropes & Gray. Merck Insurance Settlement Leaves Debate Over Cyberwar and Cyberinsurance Unsettled
The AG Enforcement Track
Alongside private suits, the New Jersey Attorney General’s office runs an active enforcement program through its Data Privacy and Cybersecurity Section, created in May 2018 within the Division of Law’s Affirmative Civil Enforcement Practice Group.13NJ Office of the Attorney General. Attorney General Grewal Announces Creation of Data Privacy and Cybersecurity Section The office played a leadership role in the multistate Equifax investigation, which produced a $600 million settlement, and has resolved investigations into children’s online privacy violations.14NJ Office of the Attorney General. Consumer Protection
In December 2021, the AG reached a $425,000 settlement with Regional Cancer Care Associates after a phishing attack compromised personal and health information for more than 105,000 patients, including about 80,000 New Jersey residents. The consent order required the providers to put specific information security measures in place going forward.15Commercial Litigation Update. New Jersey Takes Aggressive Action Against Alleged HIPAA Violations Because the Data Protection Act channels privacy enforcement through this office rather than through private suits, the AG’s docket is where a significant share of accountability actually lands.