Two years ago, several of us wrote that Arlington, Massachusetts wasn’t “too small for cybercriminals” after a business email compromise diverted nearly half a million dollars from a town construction project. The criminals didn’t target a major enterprise or a household brand. They found a small municipality with finite staff and resources and even less financial room for error.
A recent class-action lawsuit involving a small steel manufacturer suggests that another assumption is due for retirement: Organizations don’t have to be large to attract plaintiffs’ attorneys, either.
The manufacturer experienced a breach of employee HR and benefits information including Social Security numbers, dates of birth, driver’s license information, and health-related data, affecting roughly 5,000 individuals. The intrusion reportedly lasted about two days before it was detected and contained. Within weeks of notifying affected individuals, the company was facing a class-action complaint alleging failures in training, oversight, and cybersecurity safeguards. The window to join the lawsuit just closed in May.
The Litigation Floodgates Open
Prior to 2017, most data-breach cases failed; unless plaintiffs could show actual misuse or harm (not just exposure), they didn’t have the “standing” to sue. That kept many breach claims out of federal court and limited the class-action pipeline. By 2018, however, after five circuit courts ruled that a substantial risk of future identity theft can satisfy Article III standing in data-breach cases, plaintiffs had a path into federal court even before actual misuse occurred, helping turn cyber incidents into class-action fuel.
Data Breach Litigation Is Industrializing
The details of this case matter less than what it represents. In 2024, Forrester predicted that by 2025, breach-related class-action costs would surpass regulatory fines by 50%, and that’s precisely what’s happened. More than 3,000 data-breach class actions were filed in US federal courts in 2025 alone, making breach litigation one of the fastest-growing areas of complex litigation. Duane Morris’ 2026 Class Action Review analysis counted more than 1,800 data privacy class-action filings in 2025 — that’s more than 150 per month, up more than 25% over 2024, and more than 200% since 2022. And breaches are no longer the only trigger: Cyber risk firm KYND reports that privacy-related cases have climbed from hundreds per year to more than 2,000, with small and medium-sized businesses (SMBs) disproportionately exposed because of default website configurations and third-party marketing pixels.
Portions of the plaintiffs’ bar (the community of lawyers/firms that bring lawsuits on behalf of plaintiffs) have become almost as systematic as the threat actors themselves — think coat and tie vs. a hoodie. Just as cybercriminals monitor exposed systems and credential theft opportunities, plaintiffs’ firms monitor public breach disclosures, recruit affected individuals, and move quickly when the facts suggest the possibility of cyber negligence. State privacy laws sweeten the economics: California’s Consumer Privacy Act allows statutory damages of $100–$750 per resident per incident, with no proof of actual harm required. Additionally, Coalition’s 2026 Cyber Claims Report found that 72% of privacy claims cited the California Invasion of Privacy Act, a 1967 wiretapping statute now being applied to modern web-tracking tools, with 11% specifically alleging improper data sharing through Meta Pixel. A 5,000-person breach doesn’t need to make headlines to make a business case for a lawsuit.
Your Employee Data Is The Target
Large enterprises frame breach exposure around customer records, intellectual property, and payment card data. Small organizations may not hold vast customer databases, but they almost certainly maintain payroll, benefits, healthcare, and tax records for every employee. These records are among the most sensitive assets in the organization and, from a litigation perspective, are easier to build a case around than many other categories of data.
It should also prompt a rethink of “reasonable cybersecurity.” Most breach complaints allege a failure to implement reasonable safeguards — a standard that frustrates security leaders, because “reasonable” is rarely defined. But resource-constrained organizations don’t need to replicate a Fortune 500 program. The more useful question is whether decisions are risk-based, documented, and defensible. Frameworks like NIST CSF and the CIS Controls matter because they provide a structured way to make — and prove — those decisions. Incidents are now judged not just by what happened but by what an organization can demonstrate it was doing beforehand. This is one reason our Forrester colleague James Plouffe is working on research about what we’re calling minimum viable Zero Trust (stay tuned).
What SMBs, Municipalities, And Regional Providers Should Do Now
Treat employee data as a crown-jewel asset. HR, payroll, and benefits systems deserve stronger protections than they typically receive. In addition, consider the useful lifecycle of employee data and the personal data of job applicants you collect and have in your possession. Delete what you no longer need to use or retain.
Bring HR and finance leaders into incident-response planning before a breach. They will be central to employee communications and organizational recovery.
Put security obligations in vendor contracts. Contracts are one of your most underused risk tools. Every vendor agreement should define a security incident, set notification timelines, specify required safeguards, and assign responsibility for incident response, investigation, and communications.
The lesson from Arlington, Massachusetts still holds. Small organizations are not too small for cybercriminals. The lesson from the steel manufacturer is that they are not too small for class-action litigation, either. Cyber risk and litigation risk now arrive together. And for organizations with limited budgets, staff, and margin for error, a successful intrusion may be only the beginning of their exposure.
To further discuss incident response and data privacy and protection, Forrester clients can schedule an inquiry or guidance session.
