A North Carolina court has ruled on a class action lawsuit against Bojangles Restaurants, Inc. concerning a significant data breach that exposed the personal information of current and former employees. The court's decision, delivered by Judge Julianna Theall Earp, addressed multiple claims made by the plaintiffs, including negligence and breach of implied contract. This ruling is crucial as it sets a precedent for how companies handle data protection and employee privacy.
The case, known as Dougherty v. Bojangles Restaurants, Inc., was filed on December 23, 2025, in Wake County Superior Court under docket number 25-CVS-46572. The plaintiffs, a group of former employees, allege that Bojangles failed to adequately protect their personal identifying information (PII) and protected health information (PHI) during a data breach that occurred between February 19 and March 12, 2024. The breach reportedly involved the theft of sensitive data, including Social Security numbers and financial information, by a cybercriminal group.
The plaintiffs in this case include Alexis Dougherty, Dennis Calabrese, Lily Nicole Portee, Jessie Ruiz-Jacobs, Peter Bungert, Christie Starnes, Kassandra Blankenship, James Higgins, and Leonardo Yon. They argue that Bojangles, as their employer, had a legal duty to protect their information and to notify them promptly about the breach. The plaintiffs claim that Bojangles' negligence in safeguarding their data has resulted in emotional distress and financial harm.
The court's ruling addressed the defendant's motion to dismiss the plaintiffs' class action complaint. Judge Earp granted the motion in part and denied it in part. Specifically, the court dismissed the plaintiffs' claim for negligence per se, stating that the laws cited by the plaintiffs, including the Federal Trade Commission Act (FTCA) and the Health Insurance Portability and Accountability Act (HIPAA), do not constitute public safety laws that could support such a claim. However, the court allowed the negligence and breach of implied contract claims to proceed.
The court ruled, "Plaintiffs have adequately alleged that Bojangles had a legal duty to protect their data. They allege that it was foreseeable that cybercriminals like Hunters would attempt a data breach and that they would be successful given Bojangles’ inadequate security measures."
Judge Earp emphasized that the plaintiffs had sufficiently demonstrated that Bojangles owed them a duty of care to protect their PII and PHI. The court noted that the plaintiffs' allegations of emotional harm, including anxiety and distress caused by the breach, were adequate to proceed with their negligence claim. The court also found that the plaintiffs had alleged sufficient damages, including the costs of monitoring their accounts for identity theft.
In terms of the breach of implied contract claim, the court ruled that the plaintiffs had adequately asserted that Bojangles had an implicit obligation to safeguard their information. The court referenced the employer-employee relationship and the requirement for employees to provide their personal information as a basis for this implied contract.
The impact of this ruling is significant for both Bojangles and other companies handling sensitive employee data. It highlights the legal responsibilities that employers have in protecting their employees' personal information and the potential consequences of failing to do so. The decision may encourage other businesses to reevaluate their data security practices and ensure compliance with industry standards to avoid similar legal challenges.
Furthermore, this ruling could set a precedent for future cases involving data breaches and employee privacy. Companies may face increased scrutiny regarding their data protection measures, and employees may feel more empowered to seek legal recourse if their information is compromised.
Looking ahead, the case is expected to proceed to trial, where the plaintiffs will have the opportunity to present their claims against Bojangles. The court's ruling allows the plaintiffs to pursue their negligence and breach of implied contract claims, potentially leading to a resolution that could impact how data breaches are handled in the future.
As of now, it is unclear whether Bojangles will appeal the court's decision or if there are related cases pending that could affect this matter. The court filing did not provide specific details on any potential appeals or related litigation.